Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   zhanglin <zhang.lin16@zte.com.cn>
To:     dan.j.williams@intel.com
Cc:     akpm@linux-foundation.org, jgg@ziepe.ca, mingo@kernel.org,
        dave.hansen@linux.intel.com, namit@vmware.com, bp@suse.de,
        christophe.leroy@c-s.fr, rdunlap@infradead.org, osalvador@suse.de,
        richardw.yang@linux.intel.com, linux-kernel@vger.kernel.org,
        xue.zhihong@zte.com.cn, wang.yi59@zte.com.cn,
        jiang.xuexin@zte.com.cn, zhanglin <zhang.lin16@zte.com.cn>
Subject: [PATCH] kernel: Restrict permissions of /proc/iomem.
Date:   Fri, 25 Oct 2019 16:56:41 +0800
Message-Id: <1571993801-12665-1-git-send-email-zhang.lin16@zte.com.cn>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

The permissions of /proc/iomem currently are -r--r--r--. Everyone can
see its content. As iomem contains information about the physical memory
content of the device, restrict the information only to root.

Signed-off-by: zhanglin <zhang.lin16@zte.com.cn>
---
 kernel/resource.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/resource.c b/kernel/resource.c
index 30e1bc6..844456e 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -139,7 +139,8 @@ static int __init ioresources_init(void)
 {
 	proc_create_seq_data("ioports", 0, NULL, &resource_op,
 			&ioport_resource);
-	proc_create_seq_data("iomem", 0, NULL, &resource_op, &iomem_resource);
+	proc_create_seq_data("iomem", S_IRUSR, NULL, &resource_op,
+			&iomem_resource);
 	return 0;
 }
 __initcall(ioresources_init);
-- 
2.15.2