* Re: [S390] mm: add devmem_is_allowed() for STRICT_DEVMEM checking [not found] <201011162359.oAGNx3UN011130@hera.kernel.org> @ 2010-11-17 18:03 ` Dave Jones 2010-11-18 8:58 ` Martin Schwidefsky 0 siblings, 1 reply; 2+ messages in thread From: Dave Jones @ 2010-11-17 18:03 UTC (permalink / raw) To: Linux Kernel Mailing List; +Cc: brueckner, schwidefsky On Tue, Nov 16, 2010 at 11:59:03PM +0000, Linux Kernel wrote: > Gitweb: http://git.kernel.org/linus/ec6743bb06510c7b629603ce35713d6ae9273579 > Commit: ec6743bb06510c7b629603ce35713d6ae9273579 > Parent: ca768b663131ca644689fcadc9ca092dcc96a758 > Author: Hendrik Brueckner <brueckner@linux.vnet.ibm.com> > AuthorDate: Wed Nov 10 10:05:55 2010 +0100 > Committer: Martin Schwidefsky <sky@mschwide.boeblingen.de.ibm.com> > CommitDate: Wed Nov 10 10:05:54 2010 +0100 > > [S390] mm: add devmem_is_allowed() for STRICT_DEVMEM checking > > Provide the devmem_is_allowed() routine to restrict access to > kernel memory from userspace. > Set the CONFIG_STRICT_DEVMEM config option to switch on checking. > > Signed-off-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com> > Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> [snip add kconfig] ... > +static inline int devmem_is_allowed(unsigned long pfn) > +{ > + return 0; > +} So you add the config option that promises security, but then you always allow the access. This seems pointless ? Why bother having the option at all? Dave ^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [S390] mm: add devmem_is_allowed() for STRICT_DEVMEM checking 2010-11-17 18:03 ` [S390] mm: add devmem_is_allowed() for STRICT_DEVMEM checking Dave Jones @ 2010-11-18 8:58 ` Martin Schwidefsky 0 siblings, 0 replies; 2+ messages in thread From: Martin Schwidefsky @ 2010-11-18 8:58 UTC (permalink / raw) To: Dave Jones; +Cc: Linux Kernel Mailing List, brueckner On Wed, 17 Nov 2010 13:03:21 -0500 Dave Jones <davej@redhat.com> wrote: > On Tue, Nov 16, 2010 at 11:59:03PM +0000, Linux Kernel wrote: > > Gitweb: http://git.kernel.org/linus/ec6743bb06510c7b629603ce35713d6ae9273579 > > Commit: ec6743bb06510c7b629603ce35713d6ae9273579 > > Parent: ca768b663131ca644689fcadc9ca092dcc96a758 > > Author: Hendrik Brueckner <brueckner@linux.vnet.ibm.com> > > AuthorDate: Wed Nov 10 10:05:55 2010 +0100 > > Committer: Martin Schwidefsky <sky@mschwide.boeblingen.de.ibm.com> > > CommitDate: Wed Nov 10 10:05:54 2010 +0100 > > > > [S390] mm: add devmem_is_allowed() for STRICT_DEVMEM checking > > > > Provide the devmem_is_allowed() routine to restrict access to > > kernel memory from userspace. > > Set the CONFIG_STRICT_DEVMEM config option to switch on checking. > > > > Signed-off-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com> > > Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> > > [snip add kconfig] > > ... > > > +static inline int devmem_is_allowed(unsigned long pfn) > > +{ > > + return 0; > > +} > > So you add the config option that promises security, but then you always > allow the access. This seems pointless ? Why bother having the option at all? It is the other way around, access is always disallowed. So it is very secure, access via /dev/mem is disabled if STRICT_DEVMEM=y. -- blue skies, Martin. "Reality continues to ruin my life." - Calvin. ^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2010-11-18 8:58 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <201011162359.oAGNx3UN011130@hera.kernel.org>
2010-11-17 18:03 ` [S390] mm: add devmem_is_allowed() for STRICT_DEVMEM checking Dave Jones
2010-11-18 8:58 ` Martin Schwidefsky
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox