diff options
| author | Arjan van de Ven <arjan@linux.intel.com> | 2008-04-24 23:40:47 +0200 |
|---|---|---|
| committer | Ingo Molnar <mingo@elte.hu> | 2008-04-24 23:40:47 +0200 |
| commit | ae531c26c5c2a28ca1b35a75b39b3b256850f2c8 (patch) | |
| tree | e4c2f3ec25bdb0e2e5f7f15f79a60c3175f03718 /include | |
| parent | Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/vir... (diff) | |
| download | linux-ae531c26c5c2a28ca1b35a75b39b3b256850f2c8.tar.xz linux-ae531c26c5c2a28ca1b35a75b39b3b256850f2c8.zip | |
x86: introduce /dev/mem restrictions with a config option
This patch introduces a restriction on /dev/mem: Only non-memory can be
read or written unless the newly introduced config option is set.
The X server needs access to /dev/mem for the PCI space, but it doesn't need
access to memory; both the file permissions and SELinux permissions of /dev/mem
just make X effectively super-super powerful. With the exception of the
BIOS area, there's just no valid app that uses /dev/mem on actual memory.
Other popular users of /dev/mem are rootkits and the like.
(note: mmap access of memory via /dev/mem was already not allowed since
a really long time)
People who want to use /dev/mem for kernel debugging can enable the config
option.
The restrictions of this patch have been in the Fedora and RHEL kernels for
at least 4 years without any problems.
Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Diffstat (limited to 'include')
| -rw-r--r-- | include/asm-x86/page.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/include/asm-x86/page.h b/include/asm-x86/page.h index 6724a4bc6b7a..b381f4a5a0bd 100644 --- a/include/asm-x86/page.h +++ b/include/asm-x86/page.h @@ -47,6 +47,7 @@ #ifndef __ASSEMBLY__ extern int page_is_ram(unsigned long pagenr); +extern int devmem_is_allowed(unsigned long pagenr); extern unsigned long max_pfn_mapped; |