From mboxrd@z Thu Jan 1 00:00:00 1970 From: Thomas Hellstrom Subject: Re: DRM security flaws and security levels. Date: Fri, 11 Apr 2014 23:15:15 +0200 Message-ID: <53485B63.1030305@vmware.com> References: <5347E32B.1080002@vmware.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from smtp-outbound-1.vmware.com (smtp-outbound-1.vmware.com [208.91.2.12]) by gabe.freedesktop.org (Postfix) with ESMTP id 5850F6EE37 for ; Fri, 11 Apr 2014 14:15:19 -0700 (PDT) In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: David Herrmann Cc: Thomas Hellstrom , "linux-kernel@vger.kernel.org" , "dri-devel@lists.freedesktop.org" List-Id: dri-devel@lists.freedesktop.org On 04/11/2014 10:31 PM, David Herrmann wrote: > Hi > > On Fri, Apr 11, 2014 at 2:42 PM, Thomas Hellstrom wrote: >> as was discussed a while ago, there are some serious security flaws with >> the current drm master model, that allows a >> user that had previous access or current access to an X server terminal >> to access the GPU memory of the active X server, without being >> authenticated to the X server and thereby also access other user's >> secret information > 1a) and 1b) are moot if you disallow primary-node access but require > clients to use render-nodes with dma-buf. There're no gem-names on > render-nodes so no way to access other buffers (assuming the GPU does > command-stream checking and/or VM). Disallowing primary node access will break older user-space drivers and non-root EGL clients. I'm not sure that's OK, even if the change is done from user-space. A simple gem fix would also do the trick. > > 2) There is no DRM-generic data other than buffers that is global. So > imho this is a driver-specific issue. > > So I cannot see why this is a DRM issue. The only leaks I see are > legacy interfaces and driver-specific interfaces. The first can be > disabled via chmod() for clients, and the second is something driver > authors should fix. Yeah, but some driver authors can't or won't fix the drivers w r t this, hence the security levels. Thanks, /Thomas > > Thanks > David > _______________________________________________ > dri-devel mailing list > dri-devel@lists.freedesktop.org > http://lists.freedesktop.org/mailman/listinfo/dri-devel