From: matan@svgalib.org
Date: Wed 10 Jan 2001 - 09:03:30 IST
On Tue, 9 Jan 2001, Mihai Moise wrote:
> I have some questions about the svgalib_helper module. Does it allow
> user processes access to the VGA registers, and if so doesn't it
> create a security hole?
Yes, it does. If we want to be able to use all features of a card, then
either the user space needs access to it, or the kernel driver needs to
support all cards, with all features. There is no project that is even
close to that, and I am certainly not going to try by myself.
> If the module only allowed acces to the VGA card's memory, could user
> processes still burn the screen using I/O mapped registers?
The screen burning is less than an issue with modern (last 4 years or so)
monitors, since those monitors protect themselves from non supported
frequencies. The problem is that you can probably convince the card (if it
has dma master support) to write anything to any address in memory, which
means you can get root privileges (not easy, and dependent on the card, as
well as many other factors, but can be done).
Even if the card is not a dma master, you can probably have it lock the
PCI bus for you, thus hanging the computer.
The conclusion: don't have the /dev/svgalib_helper node world accessible.
If the machine might have un trusted users. Make it owned by a group
graphics (or svgalib, or whatever), and make svgalib program sgid to that
group (or add users that you trust to that group).
--
Matan Ziv-Av matan@svgalib.org
------------------------------------------------------------------
Unsubscribe: To: listbot@svgalib.org
Body: unsubscribe linux-svgalib
This archive was generated by hypermail 2.1.4 : Wed 21 Jan 2004 - 22:10:23 IST