From patchwork Tue Nov 10 21:03:57 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Donghai Qiao X-Patchwork-Id: 323842 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-14.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 187F4C55ABD for ; Tue, 10 Nov 2020 21:04:15 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id BDB23206B2 for ; Tue, 10 Nov 2020 21:04:14 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="EoKFN2l1" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731813AbgKJVEN (ORCPT ); Tue, 10 Nov 2020 16:04:13 -0500 Received: from us-smtp-delivery-124.mimecast.com ([63.128.21.124]:34259 "EHLO us-smtp-delivery-124.mimecast.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731740AbgKJVEN (ORCPT ); Tue, 10 Nov 2020 16:04:13 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1605042252; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:in-reply-to:in-reply-to:references:references; bh=nN7K9eYovR5ebtstOMyH2NZBS19myu7p1oiAq7B3xQY=; b=EoKFN2l1T+8czxmqtJsWBD8a1ZVBpTdKnAhFqxl4Gek/zn3uC9LtepS+SuQ54oCXpdbofG /D4iw9lPCGwqLUtjENaiPDvfBqWsWCJ5SP12fC+nwFM2ZwwXdgWeNZ0+s2nDuoFrvX/hbz WE+iuSpwS72x+/TZobDVABO7vdaNJ/w= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-506-h3paRzQ8NjqG-E6WSXrKGA-1; Tue, 10 Nov 2020 16:04:10 -0500 X-MC-Unique: h3paRzQ8NjqG-E6WSXrKGA-1 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 75D3710866B3; Tue, 10 Nov 2020 21:04:09 +0000 (UTC) Received: from dqiao.bos.com (ovpn-118-191.rdu2.redhat.com [10.10.118.191]) by smtp.corp.redhat.com (Postfix) with ESMTP id F20975C1D0; Tue, 10 Nov 2020 21:04:08 +0000 (UTC) From: Donghai Qiao To: rhkernel-list@redhat.com Cc: Donghai Qiao , Len Brown , stable@vger.kernel.org Subject: [RHEL7.9 BZ1844300 CVE-2020-8694 v5 2/2] powercap: restrict energy meter to root access Date: Tue, 10 Nov 2020 16:03:57 -0500 Message-Id: <20201110210357.14388-2-dqiao@redhat.com> In-Reply-To: <20201110210357.14388-1-dqiao@redhat.com> References: <20201110210357.14388-1-dqiao@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1844300 Upstream status: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=949dd0104c496fa7c14991a23c03c62e44637e71 Build info: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=32573686 CVE: CVE-2020-8694 author Len Brown 2020-11-10 13:00:00 -0800 committer Len Brown 2020-11-10 11:40:57 -0500 commit 949dd0104c496fa7c14991a23c03c62e44637e71 (patch) tree a90cbfb8ceb195e7160105a272122f97bab99980 parent 3d7772ea5602b88c7c7f0a50d512171a2eed6659 (diff) download linux-949dd0104c496fa7c14991a23c03c62e44637e71.tar.gz powercap: restrict energy meter to root access Remove non-privileged user access to power data contained in /sys/class/powercap/intel-rapl*/*/energy_uj Non-privileged users currently have read access to power data and can use this data to form a security attack. Some privileged drivers/applications need read access to this data, but don't expose it to non-privileged users. For example, thermald uses this data to ensure that power management works correctly. Thus removing non-privileged access is preferred over completely disabling this power reporting capability with CONFIG_INTEL_RAPL=n. Fixes: 95677a9a3847 ("PowerCap: Fix mode for energy counter") Signed-off-by: Len Brown Cc: stable@vger.kernel.org Signed-off-by: Donghai Qiao --- drivers/powercap/powercap_sys.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c index 05ddf8be64a..db69be2892a 100644 --- a/drivers/powercap/powercap_sys.c +++ b/drivers/powercap/powercap_sys.c @@ -379,9 +379,9 @@ static void create_power_zone_common_attributes( &dev_attr_max_energy_range_uj.attr; if (power_zone->ops->get_energy_uj) { if (power_zone->ops->reset_energy_uj) - dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUGO; + dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUSR; else - dev_attr_energy_uj.attr.mode = S_IRUGO; + dev_attr_energy_uj.attr.mode = S_IRUSR; power_zone->zone_dev_attrs[count++] = &dev_attr_energy_uj.attr; }