PCI: Lock down BAR access when the kernel is locked down

Browse source

Any hardware that can potentially generate DMA has to be locked down in
order to avoid it being possible for an attacker to modify kernel code,
allowing them to circumvent disabled module loading or module signing.
Default to paranoid - in future we can potentially relax this for
sufficiently IOMMU-isolated devices.

Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Matthew Garrett <mjg59@google.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
cc: linux-pci@vger.kernel.org
Signed-off-by: James Morris <jmorris@namei.org>

...

This commit is contained in:

Matthew Garrett 2019-08-19 17:17:47 -07:00 • committed by James Morris

parent 38bd94b8a1

commit eb627e1772

5 changed files with 33 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

16

drivers/pci/pci-sysfs.c

View file

14

drivers/pci/proc.c

View file

4

drivers/pci/syscall.c

View file

1

include/linux/security.h

View file

1

security/lockdown/lockdown.c

View file