linux-kernel - Re: [PATCH] dmi: export dmi data through debugfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100929093403.7db92388@endymion.delvare>
Date:	Wed, 29 Sep 2010 09:34:03 +0200
From:	Jean Delvare <khali@...ux-fr.org>
To:	Olof Johansson <olof@...om.net>
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel@...r.kernel.org, Tejun Heo <tj@...nel.org>
Subject: Re: [PATCH] dmi: export dmi data through debugfs

Hi Olaf,

On Tue, 28 Sep 2010 16:12:46 -0500, Olof Johansson wrote:
> I've found this quite useful since it allows dmidecode to run without
> root privileges using --from-dump to read this file instead

This is a bad idea. We do NOT want every user to have access to all the
DMI information. There is sensitive information in there (serial
numbers and UUIDs, and possibly even more sensitive data in
OEM-specific records.) If you look in /sys/class/dmi/id/, you'll see
that files board_serial, chassis_serial, product_serial and
product_uuid are only readable by root exactly for this reason.

So this is a NACK from me, sorry.

-- 
Jean Delvare
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/