Re: Hotplug, 1394, and security

[Jody McIntyre <scjody@modernduck.com>]

On Tue, Nov 29, 2005 at 01:08:03AM +0100, Stefan Richter wrote:

> What about naming it "streams" then?

OK.

> >Sure, but as far as I know, non-root processes do not need any access to
> >other PCs on the bus.
> 
> This means furthermore that only privileged users (e.g. root) should be 
> allowed to add unit directories to the local configROM, or generally to 
> manipulate the ROM.

I don't see how one follows from the other, but yes, that was my
intent.  Anything other than "streams", "arm", and async traffic will be
/dev/raw1394-only (or typically, root-only.)  If it's necessary to add
more types of packets to the list, we can certainly do that.

> OTOH the problem with phys DMA should rather be solved in the driver 
> stack which enables phys DMA.

I agree.  Unfortunately it's impossible to solve for everyone.  Most
sbp2 users will want it enabled, but security-conscious people will want
it off.  I don't know what a sane default is (so let's stick with what
we've got.. in any case, that's beyond the scope of this discussion.

Cheers,
Jody


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_idv37&alloc_id\x16865&op=click
_______________________________________________
Linux-hotplug-devel mailing list  http://linux-hotplug.sourceforge.net
Linux-hotplug-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel