linux-kernel - Re: [PATCH v2] x86: Preserve iopl on fork and execve

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 12 May 2015 11:47:40 -0400
From:	Austin S Hemmelgarn <ahferroin7@...il.com>
To:	Arjan van de Ven <arjanvandeven@...il.com>,
	Ingo Molnar <mingo@...nel.org>
CC:	Alex Henrie <alexhenrie24@...il.com>,
	One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>,
	Kees Cook <keescook@...omium.org>,
	"H . Peter Anvin" <hpa@...or.com>, Doug Johnson <dougvj@...il.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>,
	Tyler Hicks <tyhicks@...onical.com>,
	Al Viro <viro@...iv.linux.org.uk>,
	LKML <linux-kernel@...r.kernel.org>,
	Andy Lutomirski <luto@...nel.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Borislav Petkov <bp@...en8.de>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Arjan van de Ven <arjan@...radead.org>,
	Denys Vlasenko <dvlasenk@...hat.com>,
	Brian Gerst <brgerst@...il.com>
Subject: Re: [PATCH v2] x86: Preserve iopl on fork and execve

On 2015-05-12 11:25, Arjan van de Ven wrote:
>>
>> also the interesting question is:
>> can a process give up these perms?
>> otherwise it becomes a "once given, never gotten rid of" hell hole.
>
> If you look at a modern linux distro, nothing should need/use iopl and
> co anymore, so maybe an interesting
> question is if we can stick these behind a CONFIG_ option (default on
> of course for compatibility)... just like
> some of the /dev/mem like things are now hidable for folks who know
> they don't need them.
Personally, I _really_ like this idea.  The only thing I know of on any 
modern distro that even considers using ioperm is hwclock, and it only 
does so if it can't access the RTC through other means (and if you have 
an RTC, you really should have the /dev interface enabled).



Download attachment "smime.p7s" of type "application/pkcs7-signature" (2967 bytes)