diff mbox series

[v2,04/57,X] Revert "x86: Lock down IO port access when module security is enabled"

Message ID 20200619165010.645925-5-seth.forshee@canonical.com
State New
Headers show
Series Lockdown updates | expand

Commit Message

Seth Forshee June 19, 2020, 4:49 p.m. UTC 
BugLink: https://bugs.launchpad.net/bugs/1884159

This reverts commit cc223b88b8e59fca362b426b0cccfe580fd8a68e to backport
an updated version.

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
---
 arch/x86/kernel/ioport.c | 5 ++---
 drivers/char/mem.c       | 4 ----
 2 files changed, 2 insertions(+), 7 deletions(-)
diff mbox series

Patch

diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c
index ab8372443efb..589b3193f102 100644
--- a/arch/x86/kernel/ioport.c
+++ b/arch/x86/kernel/ioport.c
@@ -15,7 +15,6 @@ 
 #include <linux/thread_info.h>
 #include <linux/syscalls.h>
 #include <linux/bitmap.h>
-#include <linux/module.h>
 #include <asm/syscalls.h>
 
 /*
@@ -29,7 +28,7 @@  asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
 
 	if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
 		return -EINVAL;
-	if (turn_on && (!capable(CAP_SYS_RAWIO) || secure_modules()))
+	if (turn_on && !capable(CAP_SYS_RAWIO))
 		return -EPERM;
 
 	/*
@@ -109,7 +108,7 @@  SYSCALL_DEFINE1(iopl, unsigned int, level)
 		return -EINVAL;
 	/* Trying to gain more privileges? */
 	if (level > old) {
-		if (!capable(CAP_SYS_RAWIO) || secure_modules())
+		if (!capable(CAP_SYS_RAWIO))
 			return -EPERM;
 	}
 	regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) |
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 76997a645da8..6ebe2b86d8eb 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -27,7 +27,6 @@ 
 #include <linux/export.h>
 #include <linux/io.h>
 #include <linux/uio.h>
-#include <linux/module.h>
 
 #include <linux/uaccess.h>
 
@@ -622,9 +621,6 @@  static ssize_t write_port(struct file *file, const char __user *buf,
 	unsigned long i = *ppos;
 	const char __user *tmp = buf;
 
-	if (secure_modules())
-		return -EPERM;
-
 	if (!access_ok(VERIFY_READ, buf, count))
 		return -EFAULT;
 	while (count-- > 0 && i < 65536) {