Messages in this thread | | | From | David Howells <> | Subject | Re: [PATCH 15/24] asus-wmi: Restrict debugfs interface when the kernel is locked down | Date | Fri, 07 Apr 2017 13:50:49 +0100 |
| |
Andy Shevchenko <andy.shevchenko@gmail.com> wrote:
> > From: Matthew Garrett <matthew.garrett@nebula.com> > > > > We have no way of validating what all of the Asus WMI methods do on a given > > machine - and there's a risk that some will allow hardware state to be > > manipulated in such a way that arbitrary code can be executed in the > > kernel, circumventing module loading restrictions. Prevent that if the > > kernel is locked down. > > > + if (kernel_is_locked_down()) > > + return -EPERM; > > It looks a bit fragile when responsility of whatever reasons kernel > can't serve become a driver burden. > Can we fix this in debugfs framework instead?
Fix it with debugfs how? We can't offload the decision to userspace.
David
| |