Re: [PATCH] acpi: create CONFIG item for debugfs custom_method

[Kees Cook <kees.cook@canonical.com>]

Hi,

Any news on this? I think it's a no-brainer to let this be CONFIG-able.

Thanks!

-Kees

On Tue, Feb 22, 2011 at 11:32:50AM -0800, Kees Cook wrote:
> Since /sys/kernel/debug/acpi/custom_method can be used to write arbitrary
> kernel memory (http://jon.oberheide.org/files/american-sign-language.c),
> it should be able to be left out of the kernel for system owners that
> want to be as defensive as possible to potential attacks, even from the
> root user. See as examples: CONFIG_DEVKMEM, CONFIG_STRICT_DEVMEM, and
> /proc/sys/kernel/modules_disabled.
> 
> Signed-off-by: Kees Cook <kees.cook@canonical.com>
> ---
>  drivers/acpi/Kconfig   |   10 ++++++++++
>  drivers/acpi/debugfs.c |    2 ++
>  2 files changed, 12 insertions(+), 0 deletions(-)
> 
> diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
> index 2aa042a..726b7ea 100644
> --- a/drivers/acpi/Kconfig
> +++ b/drivers/acpi/Kconfig
> @@ -381,6 +381,16 @@ config ACPI_HED
>  	  which is used to report some hardware errors notified via
>  	  SCI, mainly the corrected errors.
>  
> +config ACPI_DEBUG_CUSTOM_METHOD
> +	bool "Debugging: Custom Method Insertion"
> +	depends on DEBUG_FS
> +	default n
> +	help
> +	  This creates the debugfs interface file "acpi/custom_method"
> +	  used for loading custom ACPI methods. Note that this allows
> +	  arbitrary kernel memory writing by the root user and is not
> +	  recommended for normal systems.
> +
>  source "drivers/acpi/apei/Kconfig"
>  
>  endif	# ACPI
> diff --git a/drivers/acpi/debugfs.c b/drivers/acpi/debugfs.c
> index 5df67f1..0240b15 100644
> --- a/drivers/acpi/debugfs.c
> +++ b/drivers/acpi/debugfs.c
> @@ -20,6 +20,7 @@ module_param_named(aml_debug_output, acpi_gbl_enable_aml_debug_object,
>  MODULE_PARM_DESC(aml_debug_output,
>  		 "To enable/disable the ACPI Debug Object output.");
>  
> +#ifdef CONFIG_ACPI_DEBUG_CUSTOM_METHOD
>  /* /sys/kernel/debug/acpi/custom_method */
>  
>  static ssize_t cm_write(struct file *file, const char __user * user_buf,
> @@ -92,3 +93,4 @@ err:
>  		debugfs_remove(acpi_dir);
>  	return -EINVAL;
>  }
> +#endif
> -- 
> 1.7.2.3
> 
> -- 
> Kees Cook
> Ubuntu Security Team
-- 
Kees Cook
Ubuntu Security Team