[PATCH 1/2] staging: comedi: Restrict COMEDI_DEVCONFIG when the kernel is locked down
flat view
STALE2587d
From: Ben Hutchings <hidden>
Date: 2019-08-30 15:45:53
Subsystem:
lockdown security module, security subsystem, staging subsystem, the rest · Maintainers:
Nicolas Bouchinet, Xiu Jianfeng, Paul Moore, James Morris, "Serge E. Hallyn", Greg Kroah-Hartman, Linus Torvalds
The COMEDI_DEVCONFIG ioctl can be used to configure I/O addresses and other hardware settings for non plug-and-play devices such as ISA cards. This should be disabled to preserve the kernel's integrity when it is locked down. Signed-off-by: Ben Hutchings <redacted> Cc: Matthew Garrett <redacted> Cc: David Howells <dhowells@redhat.com> Cc: Ian Abbott <abbotti@mev.co.uk> Cc: H Hartley Sweeten <hsweeten@visionengravers.com> --- drivers/staging/comedi/comedi_fops.c | 6 ++++++ include/linux/security.h | 1 + security/lockdown/lockdown.c | 1 + 3 files changed, 8 insertions(+)
diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
index f6d1287c7b83..fdf030e53035 100644
--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c@@ -27,6 +27,7 @@ #include <linux/io.h> #include <linux/uaccess.h> +#include <linux/security.h> #include "comedi_internal.h"
@@ -813,11 +814,16 @@ static int do_devconfig_ioctl(struct comedi_device *dev, struct comedi_devconfig __user *arg) { struct comedi_devconfig it; + int ret; lockdep_assert_held(&dev->mutex); if (!capable(CAP_SYS_ADMIN)) return -EPERM; + ret = security_locked_down(LOCKDOWN_COMEDI_DEVCONFIG); + if (ret) + return ret; + if (!arg) { if (is_device_busy(dev)) return -EBUSY;
diff --git a/include/linux/security.h b/include/linux/security.h
index 429f9f03372b..b16365dccfc5 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h@@ -113,6 +113,7 @@ enum lockdown_reason { LOCKDOWN_ACPI_TABLES, LOCKDOWN_PCMCIA_CIS, LOCKDOWN_TIOCSSERIAL, + LOCKDOWN_COMEDI_DEVCONFIG, LOCKDOWN_MODULE_PARAMETERS, LOCKDOWN_MMIOTRACE, LOCKDOWN_DEBUGFS,
diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
index 0068cec77c05..971bb99b9051 100644
--- a/security/lockdown/lockdown.c
+++ b/security/lockdown/lockdown.c@@ -28,6 +28,7 @@ static char *lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = { [LOCKDOWN_ACPI_TABLES] = "modifying ACPI tables", [LOCKDOWN_PCMCIA_CIS] = "direct PCMCIA CIS storage", [LOCKDOWN_TIOCSSERIAL] = "reconfiguration of serial port IO", + [LOCKDOWN_COMEDI_DEVCONFIG] = "reconfiguration of Comedi legacy device", [LOCKDOWN_MODULE_PARAMETERS] = "unsafe module parameters", [LOCKDOWN_MMIOTRACE] = "unsafe mmio", [LOCKDOWN_DEBUGFS] = "debugfs access",
Attachments
- signature.asc [application/pgp-signature] 833 bytes