linux-kernel - Re: [PATCH 06/12] platform/x86: dell-wmi-smbios: Add a sysfs interface for SMBIOS tokens

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHp75Vd-mwn5O696XM7_F5-HMc2iztxibqQA0D4vOrMQO+WQRg@mail.gmail.com>
Date:   Mon, 25 Sep 2017 20:04:21 +0300
From:   Andy Shevchenko <andy.shevchenko@...il.com>
To:     Pali Rohár <pali.rohar@...il.com>
Cc:     Mario Limonciello <mario.limonciello@...l.com>,
        "dvhart@...radead.org" <dvhart@...radead.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Platform Driver <platform-driver-x86@...r.kernel.org>,
        quasisec@...gle.com
Subject: Re: [PATCH 06/12] platform/x86: dell-wmi-smbios: Add a sysfs
 interface for SMBIOS tokens

On Mon, Sep 25, 2017 at 7:23 PM, Pali Rohár <pali.rohar@...il.com> wrote:
> On Thursday 21 September 2017 08:57:11 Mario Limonciello wrote:
>> Currently userspace tools can access system tokens via the dcdbas
>> kernel module and a SMI call that will cause the platform to execute
>> SMM code.
>>
>> With a goal in mind of deprecating the dcdbas kernel module a different
>> method for accessing these tokens from userspace needs to be created.
>>
>> This is intentionally marked to only be readable as root as it can
>> contain sensitive information about the platform's configuration.
>
> Darren, Andy, any comments? I'm not quite sure if such API is suitable
> for long term in kernel.

I would try to avoid sysfs interfaces for some particular devices.
Besides we are creating a character device. Would it be suitable there?

> Basically tokens are list of tuples <id, location, value> with
> possibility to active them, right?
>
> Does not kernel have some better API for it?

I think the best what kernel may provide is a CSV-like format with or
without title line and different delimiter (TAB/space/etc).

>
> Also, keep in mind security aspect of tokens. They represent e.g. boot
> order priority or enable/disable some machine peripheral.

For IOCTLs we may use capabilities.
In sysfs case we may zero output based on capabilities or some other factors.

-- 
With Best Regards,
Andy Shevchenko