Date: Sun, 21 Jan 2001 21:52:25 +0100 From: Thomas Moestl <tmoestl@gmx.net> To: freebsd-security@freebsd.org Subject: aperture driver for FreeBSD Message-ID: <20010121215225.A2033@crow.dom2ip.de>
next in thread | raw e-mail | index | archive | help
Hi, as I have mentioned some time ago on this list, I have been porting then XFree86/OpenBSD aperture "driver" to FreeBSD. For those who do not know, the OpenBSD aperture driver enables running X even when the securelevel is raised by allowing access to the memory range from 0xa0000 to 0xfffff (via /dev/mem) and to all io ports (via i386_iopl). I have extended the concept to allow a list of io and memory regions for which access is allowed. These regions are settable via a machdep sysctl (the implementation is currently only for the i386 arch, but should be relatively easy to port). Another sysctl knob is used to turn the aperture driver on and off, and set the mode. There are currently two modes defined, one gives access to the io regions as defined in the respective sysctl when a process opens /dev/io (using the io permission bitmap), and the second will give full port access (using IOPL). The second mode is needed because some XFree86 drivers use cli and sti (ugh!), but it is obviously less secure. A great disadvantage of the first mode is that processes will just get a SIGBUS when trying to acess a forbidden port (even when it has opened /dev/io, which should guarantee full io privileges). This is admittedly unclean; the relevant applications should be changed to use i386_set_ioperm (which was modified to allow access to the specified port ranges even when securelevel is raised, provided that the aperture driver was enabled via the respective sysctl). This change is apparently very non-trivial for X. Unfortunately, it is also not easy to figure out the port ranges X wants to access for a specified driver; using only the detected io range for the card (plus maybe some static additions) will not work for at least some drivers. The patch is at http://www.tu-bs.de/~y0015675/aperture.diff , and a little additional info can be found at http://www.tu-bs.de/~y0015675/README.aperture Any comments? Any chance that this can go in someday? - thomas To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010121215225.A2033>