lkml.org 
[lkml]   [2017]   [Oct]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH v4 13/14] platform/x86: dell-smbios-wmi: introduce userspace interface
    On Wed,  4 Oct 2017 17:48:39 -0500
    Mario Limonciello <mario.limonciello@dell.com> wrote:

    > This userspace character device will be used to perform SMBIOS calls
    > from any applications.
    >
    > It provides an ioctl that will allow passing the 32k WMI calling
    > interface buffer between userspace and kernel space.

    What is your security model for firing 32K of random crap at the BIOS ?
    Do you fuzz test the BIOS interface ?

    How do we know that between now and the end of the universe every call is
    safe to execute as any random user without upsetting other users on the
    same PC ?

    Right now this patch is scary. U've fuzzed tested BIOS firmware in thepast
    and it almost universally ended up in reaching for the power cord because
    PC firmware is usually closed and usually crap.

    In addition you are assuming that every function you ever provide via
    that ioctl has the same securiy model. So if one of them should only be
    usable by the user logged in on the console the system would have to
    enforce that for all. If you have two conflicting security policies we'd
    have to make it root only and owned by a daemon. If a BIOS turns out to
    have a hole then we have to make it CAP_SYS_RAWIO.

    /dev/dorandomvendorspecificshit is not an API and not a security policy.

    Alan

    \
     
     \ /
      Last update: 2017-10-05 16:00    [W:3.236 / U:0.060 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site