Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751866AbdGEJzg (ORCPT ); Wed, 5 Jul 2017 05:55:36 -0400 Received: from mail-qk0-f194.google.com ([209.85.220.194]:34053 "EHLO mail-qk0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750841AbdGEJzf (ORCPT ); Wed, 5 Jul 2017 05:55:35 -0400 MIME-Version: 1.0 In-Reply-To: <20170629111950.8872-1-mika.westerberg@linux.intel.com> References: <20170629111950.8872-1-mika.westerberg@linux.intel.com> From: Andreas Noever Date: Wed, 5 Jul 2017 19:55:14 +1000 Message-ID: Subject: Re: [PATCH] thunderbolt: Correct access permissions for active NVM contents To: Mika Westerberg Cc: Greg Kroah-Hartman , Michael Jamet , Yehezkel Bernat , "linux-kernel@vger.kernel.org" Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1960 Lines: 57 On Thu, Jun 29, 2017 at 9:19 PM, Mika Westerberg wrote: > Firmware upgrade tools that decide which NVM image should be uploaded to > the Thunderbolt controller need to access active parts of the NVM even > if they are not run as root. The information in active NVM is not > considered security critical so we can use the default permissions set > by the NVMem framework. > > Writing the NVM image is still left as root only operation. > > While there mark the active NVM as read-only in the filesystem. > > Reported-by: Yehezkel Bernat > Signed-off-by: Mika Westerberg Sorry for the late reply (I'm on vacation :P). Signed-off-by: Andreas Noever > --- > Hi, > > This applies on top of my Thunderbolt patches in Greg's char-misc-next > branch. > > Thanks. > > drivers/thunderbolt/switch.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c > index ab3e8f410444..40219a706309 100644 > --- a/drivers/thunderbolt/switch.c > +++ b/drivers/thunderbolt/switch.c > @@ -281,9 +281,11 @@ static struct nvmem_device *register_nvmem(struct tb_switch *sw, int id, > if (active) { > config.name = "nvm_active"; > config.reg_read = tb_switch_nvm_read; > + config.read_only = true; > } else { > config.name = "nvm_non_active"; > config.reg_write = tb_switch_nvm_write; > + config.root_only = true; > } > > config.id = id; > @@ -292,7 +294,6 @@ static struct nvmem_device *register_nvmem(struct tb_switch *sw, int id, > config.size = size; > config.dev = &sw->dev; > config.owner = THIS_MODULE; > - config.root_only = true; > config.priv = sw; > > return nvmem_register(&config); > -- > 2.11.0 >