linux-kernel - [PATCH] fbdev/udlfb: Remove world-writability from EDID attribute

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20241215-udlfb-perms-v1-1-2d1f8c96b1ab@weissschuh.net>
Date: Sun, 15 Dec 2024 16:15:21 +0100
From: Thomas Weißschuh <linux@...ssschuh.net>
To: Bernie Thompson <bernie@...gable.com>, Helge Deller <deller@....de>, 
 Greg Kroah-Hartman <gregkh@...e.de>
Cc: linux-fbdev@...r.kernel.org, dri-devel@...ts.freedesktop.org, 
 linux-kernel@...r.kernel.org, stable@...r.kernel.org, 
 Thomas Weißschuh <linux@...ssschuh.net>
Subject: [PATCH] fbdev/udlfb: Remove world-writability from EDID attribute

It should not be possible for every user to override the EDID.
Limit it to the system administrator.

Fixes: 8ef8cc4fca4a ("staging: udlfb: support for writing backup EDID to sysfs file")
Cc: stable@...r.kernel.org
Signed-off-by: Thomas Weißschuh <linux@...ssschuh.net>
---
The EDID passed through sysfs is only used as a fallback if the hardware
does not provide one. To me it still feels incorrect to have this
world-writable.
---
 drivers/video/fbdev/udlfb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
index 71ac9e36f67c68aa7a54dce32323047a2a9a48bf..391bdb71197549caa839d862f0ce7456dc7bf9ec 100644
--- a/drivers/video/fbdev/udlfb.c
+++ b/drivers/video/fbdev/udlfb.c
@@ -1480,7 +1480,7 @@ static ssize_t metrics_reset_store(struct device *fbdev,
 
 static const struct bin_attribute edid_attr = {
 	.attr.name = "edid",
-	.attr.mode = 0666,
+	.attr.mode = 0644,
 	.size = EDID_LENGTH,
 	.read = edid_show,
 	.write = edid_store

---
base-commit: 2d8308bf5b67dff50262d8a9260a50113b3628c6
change-id: 20241215-udlfb-perms-bb6ed270facf

Best regards,
-- 
Thomas Weißschuh <linux@...ssschuh.net>