lkml.org 
[lkml]   [2017]   [Apr]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [PATCH 15/24] asus-wmi: Restrict debugfs interface when the kernel is locked down
    Date
    Andy Shevchenko <andy.shevchenko@gmail.com> wrote:

    > > From: Matthew Garrett <matthew.garrett@nebula.com>
    > >
    > > We have no way of validating what all of the Asus WMI methods do on a given
    > > machine - and there's a risk that some will allow hardware state to be
    > > manipulated in such a way that arbitrary code can be executed in the
    > > kernel, circumventing module loading restrictions. Prevent that if the
    > > kernel is locked down.
    >
    > > + if (kernel_is_locked_down())
    > > + return -EPERM;
    >
    > It looks a bit fragile when responsility of whatever reasons kernel
    > can't serve become a driver burden.
    > Can we fix this in debugfs framework instead?

    Fix it with debugfs how? We can't offload the decision to userspace.

    David

    \
     
     \ /
      Last update: 2017-04-07 14:52    [W:4.338 / U:0.048 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site