Date: Wed, 30 Nov 2016 14:41:05 +0000
From: One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk>
To: David Howells <dhowells@redhat.com>
Cc: minyard@acm.org, keyrings@vger.kernel.org, matthew.garrett@nebula.com,
        linux-security-module@vger.kernel.org, linux-efi@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs
 and dma changed
Message-ID: <20161130144105.2b6be4fe@lxorguk.ukuu.org.uk>
In-Reply-To: <6973.1480428211@warthog.procyon.org.uk>
References: <2cd73312-c074-1367-6daa-710d11ac68f1@acm.org>
        <a4642e43-4598-96ca-c25a-2bd844631a47@acm.org>
        <20161116222731.563fb85e@lxorguk.ukuu.org.uk>
        <147933283664.19316.12454053022687659937.stgit@warthog.procyon.org.uk>
        <26173.1479769852@warthog.procyon.org.uk>
        <10164.1480378260@warthog.procyon.org.uk>
        <6973.1480428211@warthog.procyon.org.uk>
Organization: Intel Corporation
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 770
Lines: 25

On Tue, 29 Nov 2016 14:03:31 +0000
David Howells <dhowells@redhat.com> wrote:

> How about the attached?  Obviously it need extending to other drivers.
> 
> I thought that if I'm changing the module_param annotations anyway then it's
> probably worth bunging in an extra parameter that notes what the parameter
> modifies (ioport, iomem, etc.) for future reference, even if we don't store
> it.


With a security hat on the security best practice and long standing
accepted rule is that you whitelist rather than blacklist, so there ought
to be a 

module_param_safe_array()
etc

to mark parameters that are safe, not the reverse.


That debate aside I think the patch is exactly what is needed for this,
and is probably useful for more general hardening as well.

Alan