-
Mario Limonciello authored
When a userspace interface is introduced to dell-smbios filtering support will be used to make sure that userspace doesn't make calls deemed unsafe or that can cause the kernel drivers to get out of sync. A blacklist is provided for the following: - Items that are in use by other kernel drivers - Items that are deemed unsafe (diagnostics, write-once, etc) - Any items in the blacklist will be rejected. Following that a whitelist is provided as follows: - Each item has an associated capability. If a userspace interface accesses this item, that capability will be tested to filter the request. - If the process provides CAP_SYS_RAWIO the whitelist will be overridden. When an item is not in the blacklist, or whitelist and the process is run with insufficient capabilities the call will be rejected. Signed-off-by: Mario Limonciello <mario.limonciello@dell.com> Reviewed-by: Edward O'Callaghan <quasisec@google.com> Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
1f8543a5