From 1d54cf2b973a6265789b382b7d305771321b9b57 Mon Sep 17 00:00:00 2001 From: "sukadev@linux.vnet.ibm.com" Date: Tue, 30 Aug 2011 09:19:17 +0000 Subject: powerpc: Implement CONFIG_STRICT_DEVMEM As described in the help text in the patch, this token restricts general access to /dev/mem as a way of increasing the security. Specifically, access to exclusive IOMEM and kernel RAM is denied unless CONFIG_STRICT_DEVMEM is set to 'n'. Implement the 'devmem_is_allowed()' interface for Powerpc. It will be called from range_is_allowed() when userpsace attempts to access /dev/mem. This patch is based on an earlier patch from Steve Best and with input from Paul Mackerras and Scott Wood. [BenH] Fixed a typo or two and removed the generic change which should be submitted as a separate patch Signed-off-by: Sukadev Bhattiprolu Signed-off-by: Benjamin Herrenschmidt --- arch/powerpc/Kconfig.debug | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'arch/powerpc/Kconfig.debug') diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug index 1b8a9c905cf7..4ccb2a009f74 100644 --- a/arch/powerpc/Kconfig.debug +++ b/arch/powerpc/Kconfig.debug @@ -336,4 +336,16 @@ config PPC_EARLY_DEBUG_CPM_ADDR platform probing is done, all platforms selected must share the same address. +config STRICT_DEVMEM + def_bool y + prompt "Filter access to /dev/mem" + help + This option restricts access to /dev/mem. If this option is + disabled, you allow userspace access to all memory, including + kernel and userspace memory. Accidental memory access is likely + to be disastrous. + Memory access is required for experts who want to debug the kernel. + + If you are unsure, say Y. + endmenu -- cgit v1.2.3