lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 5 Sep 2013 03:58:45 +0000 From: Matthew Garrett <matthew.garrett@...ula.com> To: "H. Peter Anvin" <hpa@...or.com> CC: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "linux-efi@...r.kernel.org" <linux-efi@...r.kernel.org>, "keescook@...omium.org" <keescook@...omium.org> Subject: Re: [PATCH V3 03/11] x86: Lock down IO port access when module security is enabled On Wed, 2013-09-04 at 20:52 -0700, H. Peter Anvin wrote: > On 09/03/2013 04:50 PM, Matthew Garrett wrote: > > IO port access would permit users to gain access to PCI configuration > > registers, which in turn (on a lot of hardware) give access to MMIO register > > space. This would potentially permit root to trigger arbitrary DMA, so lock > > it down by default. > > > > Signed-off-by: Matthew Garrett <matthew.garrett@...ula.com> > > Seriously... just deny CAP_SYS_RAWIO to any system in secure mode. No. CAP_SYS_RAWIO blocks things that we don't want blocked (x86 microcode updates, various disk ioctls, *device firmware uploads* and a few others) - the semantics just don't match. We could relax those permissions, but then we'd potentially break someone else's security considerations. -- Matthew Garrett <matthew.garrett@...ula.com>
Powered by blists - more mailing lists