summaryrefslogtreecommitdiffstats
path: root/arch/x86/Kconfig.debug
diff options
context:
space:
mode:
authorArjan van de Ven <arjan@linux.intel.com>2008-04-24 23:40:47 +0200
committerIngo Molnar <mingo@elte.hu>2008-04-24 23:40:47 +0200
commitae531c26c5c2a28ca1b35a75b39b3b256850f2c8 (patch)
treee4c2f3ec25bdb0e2e5f7f15f79a60c3175f03718 /arch/x86/Kconfig.debug
parent94bc891b00e40cbec375feb4568780af183fd7f4 (diff)
downloadop-kernel-dev-ae531c26c5c2a28ca1b35a75b39b3b256850f2c8.zip
op-kernel-dev-ae531c26c5c2a28ca1b35a75b39b3b256850f2c8.tar.gz
x86: introduce /dev/mem restrictions with a config option
This patch introduces a restriction on /dev/mem: Only non-memory can be read or written unless the newly introduced config option is set. The X server needs access to /dev/mem for the PCI space, but it doesn't need access to memory; both the file permissions and SELinux permissions of /dev/mem just make X effectively super-super powerful. With the exception of the BIOS area, there's just no valid app that uses /dev/mem on actual memory. Other popular users of /dev/mem are rootkits and the like. (note: mmap access of memory via /dev/mem was already not allowed since a really long time) People who want to use /dev/mem for kernel debugging can enable the config option. The restrictions of this patch have been in the Fedora and RHEL kernels for at least 4 years without any problems. Signed-off-by: Arjan van de Ven <arjan@linux.intel.com> Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Diffstat (limited to 'arch/x86/Kconfig.debug')
-rw-r--r--arch/x86/Kconfig.debug12
1 files changed, 12 insertions, 0 deletions
diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
index 610aaec..0c1890c 100644
--- a/arch/x86/Kconfig.debug
+++ b/arch/x86/Kconfig.debug
@@ -5,6 +5,18 @@ config TRACE_IRQFLAGS_SUPPORT
source "lib/Kconfig.debug"
+config NONPROMISC_DEVMEM
+ bool "Disable promiscuous /dev/mem"
+ default y
+ help
+ The /dev/mem file by default only allows userspace access to PCI
+ space and the BIOS code and data regions. This is sufficient for
+ dosemu and X and all common users of /dev/mem. With this config
+ option, you allow userspace access to all of memory, including
+ kernel and userspace memory. Accidental access to this is
+ obviously disasterous, but specific access can be used by people
+ debugging the kernel.
+
config EARLY_PRINTK
bool "Early printk" if EMBEDDED
default y
OpenPOWER on IntegriCloud