Received: by 2002:ac0:bc90:0:0:0:0:0 with SMTP id a16csp4655722img; Tue, 26 Mar 2019 13:57:55 -0700 (PDT) X-Google-Smtp-Source: APXvYqy+oIbbch5+eB6N03+4QXXn6tyK6Vs57Zm2niZdzwoOVieSA7WBsJO5OkZglzQofq7MVHSg X-Received: by 2002:a17:902:a81:: with SMTP id 1mr33247312plp.308.1553633875007; Tue, 26 Mar 2019 13:57:55 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553633874; cv=none; d=google.com; s=arc-20160816; b=y3RxtbIU43wvEYVL8ZcHsz+RhRvlMSf2hM/+R80g8YoTWdPJjKl3TJ2U5Ffkf6agCv Sa9cMmUOf/Y1QhAQ5OZ54NpoJKrdh0fQz4qBIHK8JvKpYC/QTJoKr802UosgShXimUzU ni4Xzuprik1BIDazVKx31+2eV1pAvT/hgnCDJmeuQ0m6QXV3+rHm31WF9kziAsqEZlov /csZcZuU+LtuuNbetMG6uPHvLofIj4qMfTZFCcxuQBauH4FUd4QicxvFOEijJLrTXqAe e3hFMxKdU5qwFhV7K4jJSCa5VJjN91wjOtx0/0DBQRGH9qxqWV+reHpu/nrFSRdcK826 AeYQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=kUDZ2zUOC1VjYDB54pnTJgDj1F27tKtH5SJ0qn/GMnA=; b=YurYgM3DSV02R3EWujX9HL5DrPpMsL/EhngqrIh6H+ZbqR1Lpxnry3uADVtbxh43Jl epVyEFqcN1Evnrpq863f4vEjVedrKPx1sjj1PnJLVoIJB+MeeQQ4TzOKFsUi99UriQCE Qoc7V/vFwDu2cD53KmsPi5mHFbWzjS6j/HobM8PFITqvt0W1/KhOOuaj+BiTbycHILqT 4FVLqce9vK0Dv8JcVIXGrlrMmL8m65ui3DN52WAiRtjQCFT3+JZyMveawjhDumXbYA/p JUtcW/YfvaawZSmzY4aIsexXM9zNsQWB4NnjgkeN84+h2ySDHSUOPIcR5/3AsMHXYQnb 3DXg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=2EdBUk8D; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id z8si13092023pgh.82.2019.03.26.13.57.39; Tue, 26 Mar 2019 13:57:54 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=2EdBUk8D; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732781AbfCZU5D (ORCPT + 99 others); Tue, 26 Mar 2019 16:57:03 -0400 Received: from mail.kernel.org ([198.145.29.99]:35590 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731994AbfCZU5D (ORCPT ); Tue, 26 Mar 2019 16:57:03 -0400 Received: from mail-wr1-f54.google.com (mail-wr1-f54.google.com [209.85.221.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 0CBC12146F for ; Tue, 26 Mar 2019 20:57:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553633822; bh=kUDZ2zUOC1VjYDB54pnTJgDj1F27tKtH5SJ0qn/GMnA=; h=References:In-Reply-To:From:Date:Subject:To:Cc:From; b=2EdBUk8D0jHd3PSSLdJs+9AMkbAwSohmSx7F/2BXsS97m3kdqI3KlZ79ifK4r1Zqy QHOEetiWWZi4hGeSuMZFG2XoR5e4HOkd7ms7m2lN1N1VBnR9rBxNQ7Aoa/1koyepAg kndCgahWO6SWucZtREJoBNhwFsRz687u4mK2Kb6U= Received: by mail-wr1-f54.google.com with SMTP id o1so15990140wrs.13 for ; Tue, 26 Mar 2019 13:57:01 -0700 (PDT) X-Gm-Message-State: APjAAAW+CRS7eJieqxPY0UCpuoEBG9KCwnLBA5OspJYRvK0AG0IyF3cS dpCiIaoVi20s1cFnGk0DZr9gbk0jY0OLMOhZ9TohTQ== X-Received: by 2002:a5d:4710:: with SMTP id y16mr20043765wrq.176.1553633820586; Tue, 26 Mar 2019 13:57:00 -0700 (PDT) MIME-Version: 1.0 References: <20190326182742.16950-1-matthewgarrett@google.com> <20190326182742.16950-12-matthewgarrett@google.com> In-Reply-To: <20190326182742.16950-12-matthewgarrett@google.com> From: Andy Lutomirski Date: Tue, 26 Mar 2019 13:56:49 -0700 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [PATCH V31 11/25] x86: Lock down IO port access when the kernel is locked down To: Matthew Garrett Cc: James Morris , LSM List , LKML , David Howells , Linux API , Andrew Lutomirski , Matthew Garrett , Matthew Garrett , X86 ML Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Mar 26, 2019 at 11:28 AM Matthew Garrett wrote: > > From: Matthew Garrett > > IO port access would permit users to gain access to PCI configuration > registers, which in turn (on a lot of hardware) give access to MMIO > register space. This would potentially permit root to trigger arbitrary > DMA, so lock it down by default. > > This also implicitly locks down the KDADDIO, KDDELIO, KDENABIO and > KDDISABIO console ioctls. > Reviewed-by: Andy Lutomirski