[PATCH] CPU online file permission

[PATCH] CPU online file permission

[Ulrich Drepper]

Is there a reason why the "online" file in the subdirectories for the CPUs
in /sys/devices/system isn't world-readable?  I cannot imagine it to be
security relevant especially now that a getcpu() syscall can be used to
determine what CPUa  thread runs on.

The file is useful to correctly implement the sysconf() function to return
the number of online CPUs.  In the presence of hotplug we currently cannot
provide this information.  The patch below should to it.


Signed-off-by: Ulrich Drepper <drepper@redhat.com>

--- drivers/base/cpu.c	2007-02-20 12:01:31.000000000 -0800
+++ drivers/base/cpu.c-new	2007-07-29 17:52:58.000000000 -0700
@@ -53,7 +53,7 @@
 		ret = count;
 	return ret;
 }
-static SYSDEV_ATTR(online, 0600, show_online, store_online);
+static SYSDEV_ATTR(online, 0644, show_online, store_online);
 
 static void __devinit register_cpu_control(struct cpu *cpu)
 {

Re: [PATCH] CPU online file permission

[Andrew Morton]

On Sun, 29 Jul 2007 20:56:46 -0400
Ulrich Drepper <drepper@redhat.com> wrote:

> Is there a reason why the "online" file in the subdirectories for the CPUs
> in /sys/devices/system isn't world-readable?

No sane one which I can think of.  It seems that it originally sprang forth
from Rusty's keyboard in that form.

>  I cannot imagine it to be
> security relevant especially now that a getcpu() syscall can be used to
> determine what CPUa  thread runs on.
> 
> The file is useful to correctly implement the sysconf() function to return
> the number of online CPUs.  In the presence of hotplug we currently cannot
> provide this information.  The patch below should to it.
> 
> 
> Signed-off-by: Ulrich Drepper <drepper@redhat.com>
> 
> --- drivers/base/cpu.c	2007-02-20 12:01:31.000000000 -0800
> +++ drivers/base/cpu.c-new	2007-07-29 17:52:58.000000000 -0700
> @@ -53,7 +53,7 @@
>  		ret = count;
>  	return ret;
>  }
> -static SYSDEV_ATTR(online, 0600, show_online, store_online);
> +static SYSDEV_ATTR(online, 0644, show_online, store_online);
>  
>  static void __devinit register_cpu_control(struct cpu *cpu)
>  {

I'll pass this by the -stable guys too - I assume we'd like it fixed in
2.6.22 (or earlier) as well..

Re: [PATCH] CPU online file permission

[Rusty Russell]

On Mon, 2007-07-30 at 16:57 -0700, Andrew Morton wrote:
> On Sun, 29 Jul 2007 20:56:46 -0400
> Ulrich Drepper <drepper@redhat.com> wrote:
> 
> > Is there a reason why the "online" file in the subdirectories for the CPUs
> > in /sys/devices/system isn't world-readable?
> 
> No sane one which I can think of.  It seems that it originally sprang forth
> from Rusty's keyboard in that form.

Hmm, that seems possible but unlikely.  My original version used proc,
after all.

But either way, fix is good.

Rusty.