From: Alan Cox <alan@lxorguk.ukuu.org.uk>
To: Thomas Renninger <trenn@suse.de>
Cc: Len Brown <lenb@kernel.org>,
hpa@zytor.com, initramfs@vger.kernel.org, robert.moore@intel.com,
linux-kernel@vger.kernel.org, linux-acpi@vger.kernel.org,
yinghai@kernel.org, eric.piel@tremplin-utc.net, vojcek@tlen.pl
Subject: Re: [PATCH 2/2] ACPI: Override arbitrary ACPI tables via initrd for debugging
Date: Mon, 24 Sep 2012 10:21:59 +0100 [thread overview]
Message-ID: <20120924102159.346d0735@pyramind.ukuu.org.uk> (raw)
In-Reply-To: <201209240840.29342.trenn@suse.de>
> The issue is/was, that root can inject code at runtime which is then
> executed in kernel environment.
Yes there are lots of other ways to do this too. The constraint we use
for it is CAP_SYS_RAWIO. With that capability you can totally do raw
hardware access and the like so requiring it for runtime ACPI updating
and execution is consistent with the security model.
> Afaik there are "security" provisions or say setups, which do
> hide modprobe/insmod and do not allow root to load any kernel drivers
> or similar.
To do this you have to revoke CAP_SYS_RAWIO.
Alan
next prev parent reply other threads:[~2012-09-24 9:17 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-09-21 13:28 Early cpio decoder and ACPI table override via initrd making use of it Thomas Renninger
2012-09-21 13:28 ` [PATCH 1/2] lib: Add early cpio decoder Thomas Renninger
2012-09-21 13:28 ` [PATCH 2/2] ACPI: Override arbitrary ACPI tables via initrd for debugging Thomas Renninger
2012-09-21 20:56 ` Yinghai Lu
2012-09-25 14:17 ` Thomas Renninger
2012-09-22 15:16 ` Len Brown
2012-09-23 1:17 ` Thomas Renninger
2012-09-23 4:25 ` Len Brown
2012-09-24 6:40 ` Thomas Renninger
2012-09-24 9:21 ` Alan Cox [this message]
2012-09-25 15:25 ` [PATCH] ACPI: Only allow users with CAP_SYS_RAWIO rights to overwrite ACPI funcs at runtime Thomas Renninger
2012-09-24 18:26 ` [PATCH 2/2] ACPI: Override arbitrary ACPI tables via initrd for debugging Matthew Garrett
2012-09-24 20:27 ` H. Peter Anvin
-- strict thread matches above, loose matches on Subject: below --
2012-08-30 9:29 Early cpio decoder and ACPI table override via initrd making use of it Thomas Renninger
2012-08-30 9:29 ` [PATCH 2/2] ACPI: Override arbitrary ACPI tables via initrd for debugging Thomas Renninger
2012-08-30 9:34 ` Thomas Renninger
2012-07-18 10:36 Early initrd file overwrite and ACPI table override making use of it Thomas Renninger
2012-07-18 10:36 ` [PATCH 2/2] ACPI: Override arbitrary ACPI tables via initrd for debugging Thomas Renninger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120924102159.346d0735@pyramind.ukuu.org.uk \
--to=alan@lxorguk.ukuu.org.uk \
--cc=eric.piel@tremplin-utc.net \
--cc=hpa@zytor.com \
--cc=initramfs@vger.kernel.org \
--cc=lenb@kernel.org \
--cc=linux-acpi@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=robert.moore@intel.com \
--cc=trenn@suse.de \
--cc=vojcek@tlen.pl \
--cc=yinghai@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®