linux-kernel - Re: [PATCH] udevadm-info: Don't access sysfs 'resource<N>' files

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130316221159.GA3702@kroah.com>
Date:	Sat, 16 Mar 2013 15:11:59 -0700
From:	Greg KH <gregkh@...uxfoundation.org>
To:	Myron Stowe <myron.stowe@...hat.com>
Cc:	kay@...y.org, linux-hotplug@...r.kernel.org,
	alex.williamson@...hat.com, linux-pci@...r.kernel.org,
	yuxiangl@...vell.com, yxlraid@...il.com,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] udevadm-info: Don't access sysfs 'resource<N>' files

On Sat, Mar 16, 2013 at 03:35:19PM -0600, Myron Stowe wrote:
> Sysfs includes entries to memory that backs a PCI device's BARs, both I/O
> Port space and MMIO.  This memory regions correspond to the device's
> internal status and control registers used to drive the device.
> 
> Accessing these registers from userspace such as "udevadm info
> --attribute-walk --path=/sys/devices/..." does can not be allowed as
> such accesses outside of the driver, even just reading, can yield
> catastrophic consequences.
> 
> Udevadm-info skips parsing a specific set of sysfs entries including
> 'resource'.  This patch extends the set to include the additional
> 'resource<N>' entries that correspond to a PCI device's BARs.

Nice, are you also going to patch bash to prevent a user from reading
these sysfs files as well?  :)

And pciutils?

You get my point here, right?  The root user just asked to read all of
the data for this device, so why wouldn't you allow it?  Just like
'lspci' does.  Or bash does.

If this hardware has a problem, then it needs to be fixed in the kernel,
not have random band-aids added to various userspace programs to paper
over the root problem here.  Please fix the kernel driver and all should
be fine.  No need to change udevadm.

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/