linux-kernel - [RFC 0/2] Split out firmware upgrade from CAP_SYS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20210723005941.111198-1-dlunev@chromium.org>
Date:   Fri, 23 Jul 2021 10:59:41 +1000
From:   Daniil Lunev <dlunev@...omium.org>
To:     kbusch@...nel.org
Cc:     Mario.limonciello@....com, axboe@...com, campello@...gle.com,
        hch@....de, hughsient@...il.com, jorgelo@...omium.org,
        linux-kernel@...r.kernel.org, linux-nvme@...ts.infradead.org,
        sagi@...mberg.me
Subject: [RFC 0/2] Split out firmware upgrade from CAP_SYS_ADMIN

Signal boost on this thread for we are interested in a mechanism like that to
avoid running firmware updater with root privileges. We are looking into using
the mechanism to be able to update NVMe and SATA devices from a user with
limited permissions, and to tighten the security for eMMC device, which
currently require only RAW_IO capability to perform a firmware upgrade.