On Wed, Apr 5, 2017 at 11:16 PM, David Howells <dhowells@xxxxxxxxxx> wrote: > From: Matthew Garrett <matthew.garrett@xxxxxxxxxx> > > We have no way of validating what all of the Asus WMI methods do on a given > machine - and there's a risk that some will allow hardware state to be > manipulated in such a way that arbitrary code can be executed in the > kernel, circumventing module loading restrictions. Prevent that if the > kernel is locked down. > + if (kernel_is_locked_down()) > + return -EPERM; It looks a bit fragile when responsility of whatever reasons kernel can't serve become a driver burden. Can we fix this in debugfs framework instead? > + > err = asus_wmi_get_devstate(asus, asus->debug.dev_id, &retval); > > if (err < 0) > @@ -1916,6 +1919,9 @@ static int show_devs(struct seq_file *m, void *data) > int err; > u32 retval = -1; > > + if (kernel_is_locked_down()) > + return -EPERM; > + > err = asus_wmi_set_devstate(asus->debug.dev_id, asus->debug.ctrl_param, > &retval); > > @@ -1940,6 +1946,9 @@ static int show_call(struct seq_file *m, void *data) > union acpi_object *obj; > acpi_status status; > > + if (kernel_is_locked_down()) > + return -EPERM; > + > status = wmi_evaluate_method(ASUS_WMI_MGMT_GUID, > 1, asus->debug.method_id, > &input, &output); > -- With Best Regards, Andy Shevchenko -- To unsubscribe from this list: send the line "unsubscribe linux-efi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
