World writeable MUX

World writeable MUX

[Felipe Balbi]

[-- Attachment #1: Type: text/plain, Size: 672 bytes --]

Hi Tony,

I saw a few patches floating around regarding world writeable sysfs
files and decided to grep around arch/arm/*omap* to try and see if we
were safe. Turns out anyone can change MUX entries via the debugfs
interface:

static void __init omap_mux_dbg_create_entry(
				struct omap_mux_partition *partition,
				struct dentry *mux_dbg_dir)
{
	struct omap_mux_entry *e;

	list_for_each_entry(e, &partition->muxmodes, node) {
		struct omap_mux *m = &e->mux;

		(void)debugfs_create_file(m->muxnames[0], S_IWUGO, mux_dbg_dir,
					  m, &omap_mux_dbg_signal_fops);
	}
}

is that really expected ? I guess not, attached there's a small patch to
fix that one.

-- 
balbi

[-- Attachment #2: 0001-arm-omap2-fix-a-world-writeable-debugfs-file.diff --]
[-- Type: text/x-diff, Size: 942 bytes --]

>From d3e0b6d3ddd82b1f9ab0299105cb8bf29d142ac4 Mon Sep 17 00:00:00 2001
From: Felipe Balbi <balbi@ti.com>
Date: Fri, 4 Feb 2011 14:42:16 +0200
Subject: [PATCH] arm: omap2: fix a world writeable debugfs file
Organization: Texas Instruments\n

don't allow anyone to fiddle with the mux settings.

Signed-off-by: Felipe Balbi <balbi@ti.com>
---
 arch/arm/mach-omap2/mux.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c
index fae49d1..2727e58 100644
--- a/arch/arm/mach-omap2/mux.c
+++ b/arch/arm/mach-omap2/mux.c
@@ -605,7 +605,7 @@ static void __init omap_mux_dbg_create_entry(
 	list_for_each_entry(e, &partition->muxmodes, node) {
 		struct omap_mux *m = &e->mux;
 
-		(void)debugfs_create_file(m->muxnames[0], S_IWUGO, mux_dbg_dir,
+		(void)debugfs_create_file(m->muxnames[0], S_IWUSR, mux_dbg_dir,
 					  m, &omap_mux_dbg_signal_fops);
 	}
 }
-- 
1.7.4.rc2

Re: World writeable MUX

[Tony Lindgren]

* Felipe Balbi <balbi@ti.com> [110204 04:42]:
> Hi Tony,
> 
> I saw a few patches floating around regarding world writeable sysfs
> files and decided to grep around arch/arm/*omap* to try and see if we
> were safe. Turns out anyone can change MUX entries via the debugfs
> interface:
> 
> static void __init omap_mux_dbg_create_entry(
> 				struct omap_mux_partition *partition,
> 				struct dentry *mux_dbg_dir)
> {
> 	struct omap_mux_entry *e;
> 
> 	list_for_each_entry(e, &partition->muxmodes, node) {
> 		struct omap_mux *m = &e->mux;
> 
> 		(void)debugfs_create_file(m->muxnames[0], S_IWUGO, mux_dbg_dir,
> 					  m, &omap_mux_dbg_signal_fops);
> 	}
> }
> 
> is that really expected ? I guess not, attached there's a small patch to
> fix that one.

Heh, no it should not be like that, thanks will queue as a fix.

Tony