Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs and dma changed

From	One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk>
Newsgroups	linux.kernel
Subject	Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs and dma changed
Date	2016-11-30 15:50 +0100
Message-ID	<sJemS-7mo-1@gated-at.bofh.it> (permalink)
References	(2 earlier) <sEgSm-rg-45@gated-at.bofh.it> <sEgfD-8mi-3@gated-at.bofh.it> <sG62u-7FV-19@gated-at.bofh.it> <sIEjn-IQ-7@gated-at.bofh.it> <sIRgB-12s-7@gated-at.bofh.it>
Organization	Intel Corporation

Show all headers | View raw

On Tue, 29 Nov 2016 14:03:31 +0000
David Howells <dhowells@redhat.com> wrote:

> How about the attached?  Obviously it need extending to other drivers.
> 
> I thought that if I'm changing the module_param annotations anyway then it's
> probably worth bunging in an extra parameter that notes what the parameter
> modifies (ioport, iomem, etc.) for future reference, even if we don't store
> it.


With a security hat on the security best practice and long standing
accepted rule is that you whitelist rather than blacklist, so there ought
to be a 

module_param_safe_array()
etc

to mark parameters that are safe, not the reverse.


That debate aside I think the patch is exactly what is needed for this,
and is probably useful for more general hardening as well.

Alan

Thread

Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs  and dma changed Corey Minyard <minyard@acm.org> - 2016-11-28 23:40 +0100
  Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs and dma changed David Howells <dhowells@redhat.com> - 2016-11-29 01:20 +0100
    Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs  and dma changed Corey Minyard <minyard@acm.org> - 2016-11-29 01:30 +0100
      Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs and dma changed David Howells <dhowells@redhat.com> - 2016-11-29 15:10 +0100
        Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs  and dma changed Corey Minyard <minyard@acm.org> - 2016-11-29 15:40 +0100
        Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs  and dma changed One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> - 2016-11-30 15:50 +0100
          Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs and dma changed David Howells <dhowells@redhat.com> - 2016-11-30 17:30 +0100
    Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs and dma changed David Howells <dhowells@redhat.com> - 2016-11-29 11:50 +0100

csiph-web