linux-kernel - Re: [PATCH v1 1/3] nvmem: Add support for write-only instances

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 25 Feb 2020 17:43:43 +0200
From:   Mika Westerberg <mika.westerberg@...ux.intel.com>
To:     Nicholas Johnson <nicholas.johnson-opensource@...look.com.au>
Cc:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Srinivas Kandagatla <srinivas.kandagatla@...aro.org>
Subject: Re: [PATCH v1 1/3] nvmem: Add support for write-only instances

On Tue, Feb 25, 2020 at 03:30:22PM +0000, Nicholas Johnson wrote:
> > Actually I think maybe we make this one only writeable by root, in other
> > words it would always require ->root_only to be set.
> There is a world-accessible rw entry already, which would, if anything, 
> be even more dangerous than a world writable entry. However, there could 
> be a hypothetical use case. I agree it is unlikely to be required, but 
> who knows?

You mean 0644 entry? That should be fine as it is not writable by anyone
else than the owner (root in this case).

> Based on your statement that no sysfs should ever be world-writable, 
> should I be trying to remove the world-accessible rw as well?

No I don't think it is necesary. Just let's not add attributes that
anyone can write without good reasoning ;-)