diff options
| author | Arjan van de Ven <arjan@linux.intel.com> | 2008-04-25 01:40:47 +0400 |
|---|---|---|
| committer | Ingo Molnar <mingo@elte.hu> | 2008-04-25 01:40:47 +0400 |
| commit | ae531c26c5c2a28ca1b35a75b39b3b256850f2c8 (patch) | |
| tree | e4c2f3ec25bdb0e2e5f7f15f79a60c3175f03718 /arch/x86/Kconfig.debug | |
| parent | 94bc891b00e40cbec375feb4568780af183fd7f4 (diff) | |
| download | linux-ae531c26c5c2a28ca1b35a75b39b3b256850f2c8.tar.xz | |
x86: introduce /dev/mem restrictions with a config option
This patch introduces a restriction on /dev/mem: Only non-memory can be
read or written unless the newly introduced config option is set.
The X server needs access to /dev/mem for the PCI space, but it doesn't need
access to memory; both the file permissions and SELinux permissions of /dev/mem
just make X effectively super-super powerful. With the exception of the
BIOS area, there's just no valid app that uses /dev/mem on actual memory.
Other popular users of /dev/mem are rootkits and the like.
(note: mmap access of memory via /dev/mem was already not allowed since
a really long time)
People who want to use /dev/mem for kernel debugging can enable the config
option.
The restrictions of this patch have been in the Fedora and RHEL kernels for
at least 4 years without any problems.
Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Diffstat (limited to 'arch/x86/Kconfig.debug')
| -rw-r--r-- | arch/x86/Kconfig.debug | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug index 610aaecc19f8..0c1890c41279 100644 --- a/arch/x86/Kconfig.debug +++ b/arch/x86/Kconfig.debug @@ -5,6 +5,18 @@ config TRACE_IRQFLAGS_SUPPORT source "lib/Kconfig.debug" +config NONPROMISC_DEVMEM + bool "Disable promiscuous /dev/mem" + default y + help + The /dev/mem file by default only allows userspace access to PCI + space and the BIOS code and data regions. This is sufficient for + dosemu and X and all common users of /dev/mem. With this config + option, you allow userspace access to all of memory, including + kernel and userspace memory. Accidental access to this is + obviously disasterous, but specific access can be used by people + debugging the kernel. + config EARLY_PRINTK bool "Early printk" if EMBEDDED default y |