> I don't need to explain what protection STRICT_DEVMEM provides, just > because I didn't submit STRICT_DEVMEM. However: Which also doesn't explain what this turd is for. > Author: Arjan van de Ven <arjan@xxxxxxxxxxxxxxx> > Date: Thu Apr 24 23:40:47 2008 +0200 > > The X server needs access to /dev/mem for the PCI space, but it doesn't need > access to memory; both the file permissions and SELinux permissions of /dev/mem > just make X effectively super-super powerful. With the exception of the > BIOS area, there's just no valid app that uses /dev/mem on actual memory. Note that this statement directly conflicts with your debugging statement you need it switchable, and directly conflicts with the Red Hat crash memory access. So you are trying to support something with a changelog that demonstrates that what you are trying to make configurable is completely broken anyway The functionality provided by STRICT_DEVMEM is the same with it on or off - absolutely *nothing*. > So without that patch, a distributor needs to have two kernels: One > with SELinux and with /dev/mem protection and one without it. If I > remember correctly, you can turn off SELinux on the boot command line. You can turn it off at boot time, but if you intend not to use it then it is better (and measurably so with microbenchmark tools) to compile without it. Red Hat doesn't do the two kernels as the maintenance cost exceeds the gain for customers. Note however that compiling it out really does compile it *out* and the overhead is gone totally for the many embedded and other devices that don't use it. > But I never used it. At least I don't see -selinux and -noselinux > kernels in Redhat. It is Red Hat, two words and a trademark (sorry but our legal people insist we remind people who get it wrong). Also I don't actually care what Red Hat ship. The fact Red Hat (or any vendor) ship something doesn't make it a good idea. > However, with my patch you can make everything configurable. With > SELinux or Apparmor you can also protect the user from writing that > sysctl. Or from loading kernel modules that circumvent that protection. With your patch I get crap in the kernel I don't need. In every kernel including those on memory tight devices like wireless routers that don't need it. You are turd polishing, and what is needed is a shovel. Even if you want to turd polish there are cleaner solutions. A process with CAP_SYS_RAWIO can cheerfully bypass any restriction you try and place so you could rip out all the sysctl crap and just say that the /dev/mem restriction doesn't apply to a CAP_SYS_RAWIO process. It's still a turd but the change is a lot cleaner and one line long with no userspace semantics, paths and the like. There are proper ways to deal with X, modern video cards and modern security models. They involve using framebuffer mappings off the PCI device node itself and DRI. Alan -- Crash-utility mailing list Crash-utility@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/crash-utility
