summaryrefslogtreecommitdiff
path: root/arch/powerpc/Kconfig.debug
diff options
context:
space:
mode:
authorsukadev@linux.vnet.ibm.com <sukadev@linux.vnet.ibm.com>2011-08-30 13:19:17 +0400
committerBenjamin Herrenschmidt <benh@kernel.crashing.org>2011-11-28 04:42:08 +0400
commit1d54cf2b973a6265789b382b7d305771321b9b57 (patch)
tree8103c4c2accf96fd40cb1fb32ee9797aa97d17ed /arch/powerpc/Kconfig.debug
parent56368797d6c2d093bb0e7a7e5fe7b267274b6c58 (diff)
downloadlinux-1d54cf2b973a6265789b382b7d305771321b9b57.tar.xz
powerpc: Implement CONFIG_STRICT_DEVMEM
As described in the help text in the patch, this token restricts general access to /dev/mem as a way of increasing the security. Specifically, access to exclusive IOMEM and kernel RAM is denied unless CONFIG_STRICT_DEVMEM is set to 'n'. Implement the 'devmem_is_allowed()' interface for Powerpc. It will be called from range_is_allowed() when userpsace attempts to access /dev/mem. This patch is based on an earlier patch from Steve Best and with input from Paul Mackerras and Scott Wood. [BenH] Fixed a typo or two and removed the generic change which should be submitted as a separate patch Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Diffstat (limited to 'arch/powerpc/Kconfig.debug')
-rw-r--r--arch/powerpc/Kconfig.debug12
1 files changed, 12 insertions, 0 deletions
diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug
index 1b8a9c905cf7..4ccb2a009f74 100644
--- a/arch/powerpc/Kconfig.debug
+++ b/arch/powerpc/Kconfig.debug
@@ -336,4 +336,16 @@ config PPC_EARLY_DEBUG_CPM_ADDR
platform probing is done, all platforms selected must
share the same address.
+config STRICT_DEVMEM
+ def_bool y
+ prompt "Filter access to /dev/mem"
+ help
+ This option restricts access to /dev/mem. If this option is
+ disabled, you allow userspace access to all memory, including
+ kernel and userspace memory. Accidental memory access is likely
+ to be disastrous.
+ Memory access is required for experts who want to debug the kernel.
+
+ If you are unsure, say Y.
+
endmenu