lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20140607104102.GB23815@amd.pavel.ucw.cz> Date: Sat, 7 Jun 2014 12:41:02 +0200 From: Pavel Machek <pavel@....cz> To: Greg KH <gregkh@...uxfoundation.org> Cc: Linus Torvalds <torvalds@...ux-foundation.org>, Bin Wang <binw@...vell.com>, Nobuhiro Iwamatsu <nobuhiro.iwamatsu.yj@...esas.com>, Andrew Morton <akpm@...ux-foundation.org>, Arnd Bergmann <arnd@...db.de>, Linux Kernel Mailing List <linux-kernel@...r.kernel.org>, Norbert Ciosek <norbertciosek@...il.com> Subject: Re: [GIT PULL] char/misc driver patches for 3.16-rc1 Hi! > > > Hm, I got two different bug reports, and this same patch from two > > > different people insisting that we broke their drivers with the above > > > patches, and asked for this patch to be applied. > > > > So I do think that we might be able to apply this patch, but I think > > it needs a *lot* more thought than was obviously spent on it so far. > > > > For example, right now it's actively insecure. Do we care? Maybe we > > don't. The user-space uio side presumably is root-owned, and hopefully > > trusted. > > It better be trusted, as userspace has access to the "raw" hardware > here, and is getting notified about every irq that happens to the > device. Well, it still depends on what the hardware can do. Some crazy people (secureboot) want to secure kernel from root user. If you have "raw" hardware of few keys connected on gpio with an interrupt (anything without DMA capability, really), you can not compromise rest of kernel normally. So, yes, I have seen a lot of hardware where non-root uio would make sense. Pavel -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists