linux-kernel - Re: [PATCH V40 12/29] x86: Lock down IO port access when the kernel is locked down

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220105064827.GA30988@srcf.ucam.org>
Date:   Wed, 5 Jan 2022 06:48:27 +0000
From:   Matthew Garrett <mjg59@...f.ucam.org>
To:     Kai-Heng Feng <kai.heng.feng@...onical.com>
Cc:     Matthew Garrett <matthewgarrett@...gle.com>, jmorris@...ei.org,
        linux-security-module@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-api@...r.kernel.org,
        Matthew Garrett <mjg59@...gle.com>,
        David Howells <dhowells@...hat.com>,
        Kees Cook <keescook@...omium.org>, x86@...nel.org
Subject: Re: [PATCH V40 12/29] x86: Lock down IO port access when the kernel
 is locked down

On Wed, Jan 05, 2022 at 02:25:41PM +0800, Kai-Heng Feng wrote:

> This patch breaks ioperm() usage from userspace programs with CAP_SYS_RAWIO cap.
> 
> I wonder if it's possible to revert this commit?

When lockdown is enabled, or under all circumstances? It's expected to 
be blocked when lockdown is enabled - allowing userland to use port IO 
would potentially allow reconfiguration of PCI devices in ways that 
could alter kernel behaviour in ways relevant to security, which is what 
lockdown aims to prevent. What's being broken by this?