From 7d6e7889647417a13bfb0f9fb14cb9448ac27e2b Mon Sep 17 00:00:00 2001 From: Thadeu Lima de Souza Cascardo Date: Wed, 30 Sep 2020 21:29:16 -0300 Subject: [PATCH] powercap: make attributes only readable by root As power consumption can be used as a side-channel attack to get access to sensitive data, make access to powercap privileged by default. CVE-2020-8694 Signed-off-by: Thadeu Lima de Souza Cascardo Acked-by: Stefan Bader Acked-by: Marcelo Cerri Acked-by: Kleber Sacilotto de Souza Signed-off-by: Kleber Sacilotto de Souza --- drivers/powercap/powercap_sys.c | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c index f808c5fa9838c..ecce180a87777 100644 --- a/drivers/powercap/powercap_sys.c +++ b/drivers/powercap/powercap_sys.c @@ -224,46 +224,46 @@ static int seed_constraint_attributes(void) for (i = 0; i < MAX_CONSTRAINTS_PER_ZONE; ++i) { ret = create_constraint_attribute(i, "power_limit_uw", - S_IWUSR | S_IRUGO, + S_IWUSR | S_IRUSR, &constraint_attrs[i].power_limit_attr, show_constraint_power_limit_uw, store_constraint_power_limit_uw); if (ret) goto err_alloc; ret = create_constraint_attribute(i, "time_window_us", - S_IWUSR | S_IRUGO, + S_IWUSR | S_IRUSR, &constraint_attrs[i].time_window_attr, show_constraint_time_window_us, store_constraint_time_window_us); if (ret) goto err_alloc; - ret = create_constraint_attribute(i, "name", S_IRUGO, + ret = create_constraint_attribute(i, "name", S_IRUSR, &constraint_attrs[i].name_attr, show_constraint_name, NULL); if (ret) goto err_alloc; - ret = create_constraint_attribute(i, "max_power_uw", S_IRUGO, + ret = create_constraint_attribute(i, "max_power_uw", S_IRUSR, &constraint_attrs[i].max_power_attr, show_constraint_max_power_uw, NULL); if (ret) goto err_alloc; - ret = create_constraint_attribute(i, "min_power_uw", S_IRUGO, + ret = create_constraint_attribute(i, "min_power_uw", S_IRUSR, &constraint_attrs[i].min_power_attr, show_constraint_min_power_uw, NULL); if (ret) goto err_alloc; ret = create_constraint_attribute(i, "max_time_window_us", - S_IRUGO, + S_IRUSR, &constraint_attrs[i].max_time_window_attr, show_constraint_max_time_window_us, NULL); if (ret) goto err_alloc; ret = create_constraint_attribute(i, "min_time_window_us", - S_IRUGO, + S_IRUSR, &constraint_attrs[i].min_time_window_attr, show_constraint_min_time_window_us, NULL); @@ -362,23 +362,29 @@ static void create_power_zone_common_attributes( int count = 0; power_zone->zone_dev_attrs[count++] = &dev_attr_name.attr; - if (power_zone->ops->get_max_energy_range_uj) + if (power_zone->ops->get_max_energy_range_uj) { + dev_attr_max_energy_range_uj.attr.mode = S_IRUSR; power_zone->zone_dev_attrs[count++] = &dev_attr_max_energy_range_uj.attr; + } if (power_zone->ops->get_energy_uj) { if (power_zone->ops->reset_energy_uj) - dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUGO; + dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUSR; else - dev_attr_energy_uj.attr.mode = S_IRUGO; + dev_attr_energy_uj.attr.mode = S_IRUSR; power_zone->zone_dev_attrs[count++] = &dev_attr_energy_uj.attr; } - if (power_zone->ops->get_power_uw) + if (power_zone->ops->get_power_uw) { + dev_attr_power_uw.attr.mode = S_IRUSR; power_zone->zone_dev_attrs[count++] = &dev_attr_power_uw.attr; - if (power_zone->ops->get_max_power_range_uw) + } + if (power_zone->ops->get_max_power_range_uw) { + dev_attr_max_power_range_uw.attr.mode = S_IRUSR; power_zone->zone_dev_attrs[count++] = &dev_attr_max_power_range_uw.attr; + } power_zone->zone_dev_attrs[count] = NULL; power_zone->zone_attr_count = count; }