Messages in this thread | | | From | Linus Torvalds <> | Date | Tue, 6 Sep 2016 12:48:17 -0700 | Subject | Re: [PATCH] fs/proc/kcore.c: Omit kernel text area for hardened usercopy feature |
| |
On Tue, Sep 6, 2016 at 12:41 PM, Andi Kleen <andi@firstfloor.org> wrote: > > I suspect it's more than just /proc/kcore, there could be also > legitimate cases to read kernel text from /dev/mem or /dev/kmem
Yes, that's probably true. Although I suspect that we should just say that user-copy hardening is incompatible with /dev/kmem and !STRICT_DEVMEM.
At least Fedora seems to have
CONFIG_DEVMEM=y # CONFIG_DEVKMEM is not set CONFIG_STRICT_DEVMEM=y
which should mean that you already should not be able to access normal RAM using /dev/[k]mem - ie it's purely for legacy X server kind of situations.
So we could just make HARDENED_USERCOPY force those settings. It's not like you should ever have anything else in any situation where you care about security *anyway*, so...
Linus
| |