aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/firewire
diff options
context:
space:
mode:
authorStefan Richter <stefanr@s5r6.in-berlin.de>2009-03-10 16:00:23 -0400
committerStefan Richter <stefanr@s5r6.in-berlin.de>2009-03-24 15:56:50 -0400
commitde487da8ca5839d057e1f4b57ee3f387e180b800 (patch)
tree92003bce782f3f1bf49183637d6dac6367c19dd0 /drivers/firewire
parentc8a25900f35e575938c791507894c036c0f2ca7d (diff)
firewire: cdev: secure add_descriptor ioctl
The access permissions and ownership or ACL of /dev/fw* character device files will typically be set based on the device type of the respective nodes, as obtained by firewire-core from descriptors in the device's configuration ROM. An example policy is to deny write permission by default but grant write permission to files of AV/C video and audio devices and IIDC video devices. The FW_CDEV_IOC_ADD_DESCRIPTOR ioctl could be used to partly subvert such a policy: Find a device file with relaxed permissions, use the ioctl to add a descriptor with AV/C marker to the local node's ROM, thus gain access to the local node's character device file. (This is only possible if there are udev scripts installed which actively relax permissions for known device types and if there is a device of such a type connected.) Accessibility of the local node's device file is relevant to host security if the host contains two or more IEEE 1394 link layer controllers which are plugged into a single bus. Therefore change the ABI to deny FW_CDEV_IOC_ADD_DESCRIPTOR if the file belongs to a remote node. (This change has no impact on known implementers of the ABI: None of them uses the ioctl yet.) Also clarify the documentation: The ioctl affects all local nodes, not just one local node. Cc: stable@kernel.org Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Diffstat (limited to 'drivers/firewire')
-rw-r--r--drivers/firewire/fw-cdev.c8
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/firewire/fw-cdev.c b/drivers/firewire/fw-cdev.c
index 2784f91896db..160cb27e120c 100644
--- a/drivers/firewire/fw-cdev.c
+++ b/drivers/firewire/fw-cdev.c
@@ -742,9 +742,17 @@ static void release_descriptor(struct client *client,
742static int ioctl_add_descriptor(struct client *client, void *buffer) 742static int ioctl_add_descriptor(struct client *client, void *buffer)
743{ 743{
744 struct fw_cdev_add_descriptor *request = buffer; 744 struct fw_cdev_add_descriptor *request = buffer;
745 struct fw_card *card = client->device->card;
745 struct descriptor_resource *r; 746 struct descriptor_resource *r;
746 int ret; 747 int ret;
747 748
749 /* Access policy: Allow this ioctl only on local nodes' device files. */
750 spin_lock_irq(&card->lock);
751 ret = client->device->node_id != card->local_node->node_id;
752 spin_unlock_irq(&card->lock);
753 if (ret)
754 return -ENOSYS;
755
748 if (request->length > 256) 756 if (request->length > 256)
749 return -EINVAL; 757 return -EINVAL;
750 758