linux-kernel - RE: [PATCH 06/12] platform/x86: dell-wmi-smbios: Add a sysfs interface for SMBIOS tokens

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 25 Sep 2017 17:31:05 +0000
From:   <Mario.Limonciello@...l.com>
To:     <andy.shevchenko@...il.com>, <pali.rohar@...il.com>
CC:     <dvhart@...radead.org>, <linux-kernel@...r.kernel.org>,
        <platform-driver-x86@...r.kernel.org>, <quasisec@...gle.com>
Subject: RE: [PATCH 06/12] platform/x86: dell-wmi-smbios: Add a sysfs
 interface for SMBIOS tokens

> -----Original Message-----
> From: Andy Shevchenko [mailto:andy.shevchenko@...il.com]
> Sent: Monday, September 25, 2017 1:04 PM
> To: Pali Rohár <pali.rohar@...il.com>
> Cc: Limonciello, Mario <Mario_Limonciello@...l.com>; dvhart@...radead.org;
> LKML <linux-kernel@...r.kernel.org>; Platform Driver <platform-driver-
> x86@...r.kernel.org>; quasisec@...gle.com
> Subject: Re: [PATCH 06/12] platform/x86: dell-wmi-smbios: Add a sysfs interface
> for SMBIOS tokens
> 
> On Mon, Sep 25, 2017 at 7:23 PM, Pali Rohár <pali.rohar@...il.com> wrote:
> > On Thursday 21 September 2017 08:57:11 Mario Limonciello wrote:
> >> Currently userspace tools can access system tokens via the dcdbas
> >> kernel module and a SMI call that will cause the platform to execute
> >> SMM code.
> >>
> >> With a goal in mind of deprecating the dcdbas kernel module a different
> >> method for accessing these tokens from userspace needs to be created.
> >>
> >> This is intentionally marked to only be readable as root as it can
> >> contain sensitive information about the platform's configuration.
> >
> > Darren, Andy, any comments? I'm not quite sure if such API is suitable
> > for long term in kernel.
> 
> I would try to avoid sysfs interfaces for some particular devices.
> Besides we are creating a character device. Would it be suitable there?

If the character device having 2 different ioctls for different needs is
acceptable I'm happy to adjust the series to do this instead.

> 
> > Basically tokens are list of tuples <id, location, value> with
> > possibility to active them, right?
> >

I didn't add a way to activate them through this, it was only for
reading purpose.  Activating them should be possible through the
SMBIOS calling interface though.

> > Does not kernel have some better API for it?
> 
> I think the best what kernel may provide is a CSV-like format with or
> without title line and different delimiter (TAB/space/etc).
> 
> >
> > Also, keep in mind security aspect of tokens. They represent e.g. boot
> > order priority or enable/disable some machine peripheral.
> 
> For IOCTLs we may use capabilities.
> In sysfs case we may zero output based on capabilities or some other factors.
> 

Can you recommend what capabilities you would prefer to see this based upon?