Re: [PATCH 01/39] Annotate module params that specify hardware parameters (eg. ioport)

From	David Howells <dhowells@redhat.com>
Newsgroups	linux.kernel
Subject	Re: [PATCH 01/39] Annotate module params that specify hardware parameters (eg. ioport)
Date	2016-12-01 17:10 +0100
Message-ID	<sJC5P-6gw-29@gated-at.bofh.it> (permalink)
References	<sJB9L-5sv-5@gated-at.bofh.it> <sJyEV-3Or-7@gated-at.bofh.it> <sJyEV-3Or-25@gated-at.bofh.it> <sJB9L-5sv-5@gated-at.bofh.it>
Organization	Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903

Show all headers | View raw

Greg KH <gregkh@linuxfoundation.org> wrote:

> Also, I think Alan's comment about it the last time it came up was more like
> a "look at all of the other ways you could do bad things to hardware!"
> comment, not a "you need to also do this thing too!" type of request.

Alan said:

	You need to filter or lock down kernel module options because a lot of
	modules let you set the I/O port or similar (eg mmio) which means you
	can hack the entire machine with say the 8250 driver just by using it
	with an mmio of the right location to patch the secure state to zero
	just by getting the ability to write to the modules conf file.

I'm not entirely sure how one would do it, but Alan seems to think it can be
done.

> First off, this "secure boot support" massive patchset has not gone
> anywhere yet, so why do this now?

To continue quoting Alan:

	Without that at least fixed I don't see the point in merging
	this. Either we don't do it (which given the level of security the
	current Linux kernel provides, and also all the golden key messups
	from elsewhere might be the honest approach), or at least try and do
	the job right.

Alan also said this:

	It is - so pushing something with known trivial holes isn't a useful
	way to do this. The module parameter hole needs to be addressed before
	this is fit for upstream.

So you and Alan present something of a conflict of ordering: for Alan, I have
to fix the module parameter hole first; for you, I have to do the secure boot
support first.

> So, what are you really trying to "block" here?  The ability for someone
> to set an i/o port value?  why?  Why does it matter what root sets for
> an irq?  For a dma buffer?  For anything else?  What is preventing this
> going to "secure" somehow?

I'll grant that prohibiting the changing of irq settings or dma channel
settings may not actually be necessary.  However, annotation module parameters
to indicate hardware resource configuration seems potentially useful in its
own right - and lets the policy be decided later.

Setting ioports and iomem might allow you to get a driver for one piece of
hardware to do something nasty with an unrelated piece of hardware.  I really
need Alan to weigh in on this.

David

Thread

[PATCH 00/39] Annotate hw config module params for future lockdown David Howells <dhowells@redhat.com> - 2016-12-01 13:30 +0100
  [PATCH 01/39] Annotate module params that specify hardware  parameters (eg. ioport) David Howells <dhowells@redhat.com> - 2016-12-01 13:30 +0100
    Re: [PATCH 01/39] Annotate module params that specify hardware  parameters (eg. ioport) Greg KH <gregkh@linuxfoundation.org> - 2016-12-01 16:10 +0100
      Re: [PATCH 01/39] Annotate module params that specify hardware parameters (eg. ioport) David Howells <dhowells@redhat.com> - 2016-12-01 17:10 +0100
        Re: [PATCH 01/39] Annotate module params that specify hardware  parameters (eg. ioport) One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> - 2016-12-05 22:20 +0100
          Re: [PATCH 01/39] Annotate module params that specify hardware  parameters (eg. ioport) Greg KH <gregkh@linuxfoundation.org> - 2016-12-06 08:20 +0100
            Re: [PATCH 01/39] Annotate module params that specify hardware parameters (eg. ioport) David Howells <dhowells@redhat.com> - 2016-12-06 11:50 +0100
              Re: [PATCH 01/39] Annotate module params that specify hardware  parameters (eg. ioport) Greg KH <gregkh@linuxfoundation.org> - 2016-12-06 12:00 +0100
      Re: [PATCH 01/39] Annotate module params that specify hardware  parameters (eg. ioport) Matthew Garrett <mjg59@srcf.ucam.org> - 2016-12-02 04:50 +0100
        Re: [PATCH 01/39] Annotate module params that specify hardware  parameters (eg. ioport) Greg KH <gregkh@linuxfoundation.org> - 2016-12-02 08:00 +0100
          Re: [PATCH 01/39] Annotate module params that specify hardware  parameters (eg. ioport) Matthew Garrett <mjg59@srcf.ucam.org> - 2016-12-02 08:20 +0100
            Re: [PATCH 01/39] Annotate module params that specify hardware  parameters (eg. ioport) One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> - 2016-12-05 22:30 +0100
          Re: [PATCH 01/39] Annotate module params that specify hardware parameters (eg. ioport) David Howells <dhowells@redhat.com> - 2016-12-02 16:00 +0100
            Re: [PATCH 01/39] Annotate module params that specify hardware  parameters (eg. ioport) Greg KH <gregkh@linuxfoundation.org> - 2016-12-05 16:50 +0100
              Re: [PATCH 01/39] Annotate module params that specify hardware parameters (eg. ioport) David Howells <dhowells@redhat.com> - 2016-12-06 12:00 +0100
  [PATCH 20/39] Annotate hardware config module parameters in  drivers/net/hamradio/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
  [PATCH 34/39] Annotate hardware config module parameters in  drivers/watchdog/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
    Re: [PATCH 34/39] Annotate hardware config module parameters in  drivers/watchdog/ Guenter Roeck <linux@roeck-us.net> - 2016-12-01 14:00 +0100
  [PATCH 03/39] Annotate hardware config module parameters in  drivers/char/ipmi/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
    Re: [PATCH 03/39] Annotate hardware config module parameters in  drivers/char/ipmi/ Corey Minyard <minyard@acm.org> - 2016-12-01 14:20 +0100
  [PATCH 05/39] Annotate hardware config module parameters in  drivers/char/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
  [PATCH 28/39] Annotate hardware config module parameters in  drivers/staging/i4l/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
  [PATCH 07/39] Annotate hardware config module parameters in  drivers/cpufreq/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
    Re: [PATCH 07/39] Annotate hardware config module parameters in drivers/cpufreq/ "Rafael J. Wysocki" <rafael@kernel.org> - 2016-12-01 15:10 +0100
      Re: [PATCH 07/39] Annotate hardware config module parameters in drivers/cpufreq/ David Howells <dhowells@redhat.com> - 2016-12-01 15:20 +0100
        Re: [PATCH 07/39] Annotate hardware config module parameters in drivers/cpufreq/ "Rafael J. Wysocki" <rjw@rjwysocki.net> - 2016-12-01 15:30 +0100
  [PATCH 39/39] Annotate hardware config module parameters in  sound/pci/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
  [PATCH 35/39] Annotate hardware config module parameters in  fs/pstore/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
  [PATCH 11/39] Annotate hardware config module parameters in  drivers/input/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
    Re: [PATCH 11/39] Annotate hardware config module parameters in  drivers/input/ Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2016-12-03 20:00 +0100
  [PATCH 21/39] Annotate hardware config module parameters in  drivers/net/irda/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
  [PATCH 31/39] Annotate hardware config module parameters in  drivers/staging/vme/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
  [PATCH 33/39] Annotate hardware config module parameters in  drivers/video/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
  [PATCH 04/39] Annotate hardware config module parameters in  drivers/char/mwave/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
  [PATCH 38/39] Annotate hardware config module parameters in  sound/oss/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
  [PATCH 06/39] Annotate hardware config module parameters in  drivers/clocksource/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
  [PATCH 12/39] Annotate hardware config module parameters in  drivers/isdn/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
  [PATCH 23/39] Annotate hardware config module parameters in  drivers/net/wireless/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
    Re: [PATCH 23/39] Annotate hardware config module parameters in drivers/net/wireless/ Kalle Valo <kvalo@codeaurora.org> - 2016-12-02 06:10 +0100
      Re: [PATCH 23/39] Annotate hardware config module parameters in drivers/net/wireless/ David Howells <dhowells@redhat.com> - 2016-12-07 14:50 +0100
  [PATCH 29/39] Annotate hardware config module parameters in  drivers/staging/media/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
    Re: [PATCH 29/39] Annotate hardware config module parameters in  drivers/staging/media/ Mauro Carvalho Chehab <mchehab@s-opensource.com> - 2016-12-01 16:00 +0100
      Re: [PATCH 29/39] Annotate hardware config module parameters in drivers/staging/media/ David Howells <dhowells@redhat.com> - 2016-12-01 16:10 +0100
        Re: [PATCH 29/39] Annotate hardware config module parameters in  drivers/staging/media/ Mauro Carvalho Chehab <mchehab@s-opensource.com> - 2016-12-01 16:20 +0100
  [PATCH 09/39] Annotate hardware config module parameters in  drivers/i2c/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
    Re: [PATCH 09/39] Annotate hardware config module parameters in  drivers/i2c/ Jean Delvare <jdelvare@suse.de> - 2016-12-01 14:50 +0100
      Re: [PATCH 09/39] Annotate hardware config module parameters in drivers/i2c/ David Howells <dhowells@redhat.com> - 2016-12-01 15:20 +0100
        Re: [PATCH 09/39] Annotate hardware config module parameters in  drivers/i2c/ Jean Delvare <jdelvare@suse.de> - 2016-12-01 17:10 +0100
        Re: [PATCH 09/39] Annotate hardware config module parameters in  drivers/i2c/ One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> - 2016-12-05 22:20 +0100
  [PATCH 19/39] Annotate hardware config module parameters in  drivers/net/ethernet/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
  [PATCH 18/39] Annotate hardware config module parameters in  drivers/net/can/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
    Re: [PATCH 18/39] Annotate hardware config module parameters in  drivers/net/can/ Marc Kleine-Budde <mkl@pengutronix.de> - 2016-12-01 14:10 +0100
  [PATCH 25/39] Annotate hardware config module parameters in  drivers/pci/hotplug/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
    Re: [PATCH 25/39] Annotate hardware config module parameters in  drivers/pci/hotplug/ Bjorn Helgaas <helgaas@kernel.org> - 2016-12-07 19:40 +0100
  [PATCH 27/39] Annotate hardware config module parameters in  drivers/scsi/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
    Re: [PATCH 27/39] Annotate hardware config module parameters in  drivers/scsi/ Finn Thain <fthain@telegraphics.com.au> - 2016-12-01 23:10 +0100
  [PATCH 26/39] Annotate hardware config module parameters in  drivers/pcmcia/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
  [PATCH 08/39] Annotate hardware config module parameters in  drivers/gpio/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
    Re: [PATCH 08/39] Annotate hardware config module parameters in  drivers/gpio/ William Breathitt Gray <vilhelm.gray@gmail.com> - 2016-12-01 14:50 +0100
    Re: [PATCH 08/39] Annotate hardware config module parameters in drivers/gpio/ Linus Walleij <linus.walleij@linaro.org> - 2016-12-02 14:00 +0100
  [PATCH 32/39] Annotate hardware config module parameters in  drivers/tty/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
    Re: [PATCH 32/39] Annotate hardware config module parameters in  drivers/tty/ Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-01 16:10 +0100
  [PATCH 13/39] Annotate hardware config module parameters in  drivers/media/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
  [PATCH 36/39] Annotate hardware config module parameters in  sound/drivers/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
  [PATCH 17/39] Annotate hardware config module parameters in  drivers/net/arcnet/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
  [PATCH 24/39] Annotate hardware config module parameters in  drivers/parport/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
  [PATCH 15/39] Annotate hardware config module parameters in  drivers/mmc/host/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
  [PATCH 02/39] Annotate hardware config module parameters in  arch/x86/mm/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
  [PATCH 16/39] Annotate hardware config module parameters in  drivers/net/appletalk/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
  [PATCH 37/39] Annotate hardware config module parameters in  sound/isa/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
  [PATCH 30/39] Annotate hardware config module parameters in  drivers/staging/speakup/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
  [PATCH 22/39] Annotate hardware config module parameters in  drivers/net/wan/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
  [PATCH 10/39] Annotate hardware config module parameters in  drivers/iio/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100
    Re: [PATCH 10/39] Annotate hardware config module parameters in  drivers/iio/ William Breathitt Gray <vilhelm.gray@gmail.com> - 2016-12-01 15:00 +0100
      Re: [PATCH 10/39] Annotate hardware config module parameters in  drivers/iio/ Jonathan Cameron <jic23@kernel.org> - 2016-12-03 15:40 +0100
        Re: [PATCH 10/39] Annotate hardware config module parameters in drivers/iio/ David Howells <dhowells@redhat.com> - 2016-12-07 14:50 +0100
  [PATCH 14/39] Annotate hardware config module parameters in  drivers/misc/ David Howells <dhowells@redhat.com> - 2016-12-01 13:40 +0100

csiph-web