linux-kernel - Re: [PATCH v2] x86: Preserve iopl on fork and execve

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 12 May 2015 14:12:13 -0400
From:	Austin S Hemmelgarn <ahferroin7@...il.com>
To:	Alex Henrie <alexhenrie24@...il.com>
CC:	Arjan van de Ven <arjanvandeven@...il.com>,
	Ingo Molnar <mingo@...nel.org>,
	One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>,
	Kees Cook <keescook@...omium.org>,
	"H . Peter Anvin" <hpa@...or.com>, Doug Johnson <dougvj@...il.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>,
	Tyler Hicks <tyhicks@...onical.com>,
	Al Viro <viro@...iv.linux.org.uk>,
	LKML <linux-kernel@...r.kernel.org>,
	Andy Lutomirski <luto@...nel.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Borislav Petkov <bp@...en8.de>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Arjan van de Ven <arjan@...radead.org>,
	Denys Vlasenko <dvlasenk@...hat.com>,
	Brian Gerst <brgerst@...il.com>
Subject: Re: [PATCH v2] x86: Preserve iopl on fork and execve

On 2015-05-12 14:05, Alex Henrie wrote:
> 2015-05-12 9:47 GMT-06:00 Austin S Hemmelgarn <ahferroin7@...il.com>:
>> On 2015-05-12 11:25, Arjan van de Ven wrote:
>>> If you look at a modern linux distro, nothing should need/use iopl and
>>> co anymore, so maybe an interesting
>>> question is if we can stick these behind a CONFIG_ option (default on
>>> of course for compatibility)... just like
>>> some of the /dev/mem like things are now hidable for folks who know
>>> they don't need them.
>>
>> Personally, I _really_ like this idea.  The only thing I know of on any
>> modern distro that even considers using ioperm is hwclock, and it only does
>> so if it can't access the RTC through other means (and if you have an RTC,
>> you really should have the /dev interface enabled).
>
> Removing iopl might be OK. Removing ioperm would break my use case of
> legacy code that needs direct access to the parallel port.
>
> -Alex
>
The discussion isn't about outright removing them, just providing a 
config option to disable them.  It might be a good idea though to 
provide separate config options for each of iopl() and ioperm(), as 
iopl() is more dangerous, and ioperm() is more widely used, and people 
may need one but not want to have the other.


Download attachment "smime.p7s" of type "application/pkcs7-signature" (2967 bytes)