acpi: create CONFIG item for debugfs custom_method

PATCH Applied Kees Cook 3 participants 6 messages Feb 22, 2011 – May 29, 2011 ACPI

Share & tools

Kees Cook

author

2011-02-22 19:33 UTC #0 lore raw

PATCH 1/1 acpi: create CONFIG item for debugfs custom_method

Since /sys/kernel/debug/acpi/custom_method can be used to write arbitrary kernel memory (http://jon.oberheide.org/files/american-sign-language.c),
it should be able to be left out of the kernel for system owners that want to be as defensive as possible to potential attacks, even from the root user. See as examples: CONFIG_DEVKMEM, CONFIG_STRICT_DEVMEM, and /proc/sys/kernel/modules_disabled.

Signed-off-by Kees Cook <[email protected]>

---
 drivers/acpi/Kconfig   |   10 ++++++++++
 drivers/acpi/debugfs.c |    2 ++
 2 files changed, 12 insertions(+), 0 deletions(-)

drivers/acpi/Kconfig +10 -0

index 2aa042a..726b7ea 100644
@@ -381,6 +381,16 @@ config ACPI_HED
 	  which is used to report some hardware errors notified via
 	  SCI, mainly the corrected errors.
 
+config ACPI_DEBUG_CUSTOM_METHOD
+	bool "Debugging: Custom Method Insertion"
+	depends on DEBUG_FS
+	default n
+	help
+	  This creates the debugfs interface file "acpi/custom_method"
+	  used for loading custom ACPI methods. Note that this allows
+	  arbitrary kernel memory writing by the root user and is not
+	  recommended for normal systems.
+
 source "drivers/acpi/apei/Kconfig"
 
 endif	# ACPI

drivers/acpi/debugfs.c +2 -0

index 5df67f1..0240b15 100644
@@ -20,6 +20,7 @@ module_param_named(aml_debug_output, acpi_gbl_enable_aml_debug_object,
 MODULE_PARM_DESC(aml_debug_output,
 		 "To enable/disable the ACPI Debug Object output.");
 
+#ifdef CONFIG_ACPI_DEBUG_CUSTOM_METHOD
 /* /sys/kernel/debug/acpi/custom_method */
 
 static ssize_t cm_write(struct file *file, const char __user * user_buf,

@@ -92,3 +93,4 @@ err:
 		debugfs_remove(acpi_dir);
 	return -EINVAL;
 }
+#endif

Signature · 5 lines

1.7.2.3

-- 
Kees Cook
Ubuntu Security Team

Kees Cook

author

2011-04-13 00:21 UTC #1 lore raw

Hi,

Any news on this? I think it's a no-brainer to let this be CONFIG-able.

Thanks!

-Kees

Quoted 57 lines · Kees Cook

Signed-off-by Kees Cook <[email protected]>

---
 drivers/acpi/Kconfig   |   10 ++++++++++
 drivers/acpi/debugfs.c |    2 ++
 2 files changed, 12 insertions(+), 0 deletions(-)

drivers/acpi/Kconfig +10 -0

index 2aa042a..726b7ea 100644
@@ -381,6 +381,16 @@ config ACPI_HED
 	  which is used to report some hardware errors notified via
 	  SCI, mainly the corrected errors.
 
+config ACPI_DEBUG_CUSTOM_METHOD
+	bool "Debugging: Custom Method Insertion"
+	depends on DEBUG_FS
+	default n
+	help
+	  This creates the debugfs interface file "acpi/custom_method"
+	  used for loading custom ACPI methods. Note that this allows
+	  arbitrary kernel memory writing by the root user and is not
+	  recommended for normal systems.
+
 source "drivers/acpi/apei/Kconfig"
 
 endif	# ACPI

drivers/acpi/debugfs.c +2 -0

index 5df67f1..0240b15 100644
@@ -20,6 +20,7 @@ module_param_named(aml_debug_output, acpi_gbl_enable_aml_debug_object,
 MODULE_PARM_DESC(aml_debug_output,
 		 "To enable/disable the ACPI Debug Object output.");
 
+#ifdef CONFIG_ACPI_DEBUG_CUSTOM_METHOD
 /* /sys/kernel/debug/acpi/custom_method */
 
 static ssize_t cm_write(struct file *file, const char __user * user_buf,

@@ -92,3 +93,4 @@ err:
 		debugfs_remove(acpi_dir);
 	return -EINVAL;
 }
+#endif

Signature · 5 lines

1.7.2.3

-- 
Kees Cook
Ubuntu Security Team

Signature · 2 lines

Kees Cook
Ubuntu Security Team

Kees Cook

author

2011-05-28 04:19 UTC #2 lore raw

PATCH 1/1 acpi: create CONFIG item for debugfs custom_method

In reply to Kees Cook

Signed-off-by Kees Cook <[email protected]>

---
Third time sending this, no response...
https://lkml.org/lkml/2011/2/22/369

 drivers/acpi/Kconfig   |   10 ++++++++++
 drivers/acpi/debugfs.c |    2 ++
 2 files changed, 12 insertions(+), 0 deletions(-)

drivers/acpi/Kconfig +10 -0

index 2aa042a..726b7ea 100644
@@ -381,6 +381,16 @@ config ACPI_HED
 	  which is used to report some hardware errors notified via
 	  SCI, mainly the corrected errors.
 
+config ACPI_DEBUG_CUSTOM_METHOD
+	bool "Debugging: Custom Method Insertion"
+	depends on DEBUG_FS
+	default n
+	help
+	  This creates the debugfs interface file "acpi/custom_method"
+	  used for loading custom ACPI methods. Note that this allows
+	  arbitrary kernel memory writing by the root user and is not
+	  recommended for normal systems.
+
 source "drivers/acpi/apei/Kconfig"
 
 endif	# ACPI

drivers/acpi/debugfs.c +2 -0

index 5df67f1..0240b15 100644
@@ -20,6 +20,7 @@ module_param_named(aml_debug_output, acpi_gbl_enable_aml_debug_object,
 MODULE_PARM_DESC(aml_debug_output,
 		 "To enable/disable the ACPI Debug Object output.");
 
+#ifdef CONFIG_ACPI_DEBUG_CUSTOM_METHOD
 /* /sys/kernel/debug/acpi/custom_method */
 
 static ssize_t cm_write(struct file *file, const char __user * user_buf,

@@ -92,3 +93,4 @@ err:
 		debugfs_remove(acpi_dir);
 	return -EINVAL;
 }
+#endif

Signature · 5 lines

1.7.2.3

-- 
Kees Cook
Ubuntu Security Team

Rafael J. Wysocki

2011-05-28 09:02 UTC #3 lore raw

Quoted 6 lines · Kees Cook

Since /sys/kernel/debug/acpi/custom_method can be used to write arbitrary kernel memory (http://jon.oberheide.org/files/american-sign-language.c),
it should be able to be left out of the kernel for system owners that want to be as defensive as possible to potential attacks, even from the root user. See as examples: CONFIG_DEVKMEM, CONFIG_STRICT_DEVMEM, and /proc/sys/kernel/modules_disabled.

I believe Thomas Renninger sent patches to address this issue too.

Thanks,
Rafael

Quoted 48 lines

Signed-off-by Kees Cook <[email protected]>

---
Third time sending this, no response...
https://lkml.org/lkml/2011/2/22/369

 drivers/acpi/Kconfig   |   10 ++++++++++
 drivers/acpi/debugfs.c |    2 ++
 2 files changed, 12 insertions(+), 0 deletions(-)

drivers/acpi/Kconfig +10 -0

index 2aa042a..726b7ea 100644
@@ -381,6 +381,16 @@ config ACPI_HED
 	  which is used to report some hardware errors notified via
 	  SCI, mainly the corrected errors.
 
+config ACPI_DEBUG_CUSTOM_METHOD
+	bool "Debugging: Custom Method Insertion"
+	depends on DEBUG_FS
+	default n
+	help
+	  This creates the debugfs interface file "acpi/custom_method"
+	  used for loading custom ACPI methods. Note that this allows
+	  arbitrary kernel memory writing by the root user and is not
+	  recommended for normal systems.
+
 source "drivers/acpi/apei/Kconfig"
 
 endif	# ACPI

drivers/acpi/debugfs.c +2 -0

index 5df67f1..0240b15 100644
@@ -20,6 +20,7 @@ module_param_named(aml_debug_output, acpi_gbl_enable_aml_debug_object,
 MODULE_PARM_DESC(aml_debug_output,
 		 "To enable/disable the ACPI Debug Object output.");
 
+#ifdef CONFIG_ACPI_DEBUG_CUSTOM_METHOD
 /* /sys/kernel/debug/acpi/custom_method */
 
 static ssize_t cm_write(struct file *file, const char __user * user_buf,

@@ -92,3 +93,4 @@ err:
 		debugfs_remove(acpi_dir);
 	return -EINVAL;
 }
+#endif

Len Brown

reviewer Applied

2011-05-29 05:40 UTC #4 lore raw

In reply to Kees Cook

applied

thanks,
Len Brown, Intel Open Source Technology Center

Len Brown

reviewer

2011-05-29 05:51 UTC #5 lore raw

Quoted 1 line

applied

un-applied - forgot I had Thomas' version already pending.

Quoted 2 lines

thanks,
Len Brown, Intel Open Source Technology Center