From owner-freebsd-questions Tue Oct 10 10:06:37 1995 Return-Path: owner-questions Received: (from root@localhost) by freefall.freebsd.org (8.6.12/8.6.6) id KAA25875 for questions-outgoing; Tue, 10 Oct 1995 10:06:37 -0700 Received: from halloran-eldar.lcs.mit.edu (halloran-eldar.lcs.mit.edu [18.26.0.159]) by freefall.freebsd.org (8.6.12/8.6.6) with SMTP id KAA25867 for ; Tue, 10 Oct 1995 10:06:32 -0700 Received: by halloran-eldar.lcs.mit.edu; (5.65/1.1.8.2/19Aug95-0530PM) id AA10186; Tue, 10 Oct 1995 13:06:24 -0400 Date: Tue, 10 Oct 1995 13:06:24 -0400 From: "Garrett A. Wollman" Message-Id: <9510101706.AA10186@halloran-eldar.lcs.mit.edu> To: "Justin T. Gibbs" Cc: Andrew Herdman , freebsd-questions@FreeBSD.org Subject: Re: A few questions In-Reply-To: <199510101700.KAA04725@aslan.cdrom.com> References: <9510101535.AA10002@halloran-eldar.lcs.mit.edu> <199510101700.KAA04725@aslan.cdrom.com> Sender: owner-questions@FreeBSD.org Precedence: bulk < said: > It be nice if you could still run X while in secure mode 1 (or perhaps we > should add an extra secure level so you could do this?) without having > all of /dev/mem R/W. The problem is that some devices out there need to have their framebuffers reprogrammed into some arbitrary, large range of memory (outside the I/O hole). Allowing access to an arbitrary range of memory is tantamount to allowing access to all memory, which is the source of the problem. The X server also creates problems by its need to do in/out instructions. /dev/io should not be openable in secure mode, either. I have a number of times suggested that the right thing to do is to add a special ``privileged'' flag to indicate to the system that a binary should be allowed to do this. (Obviously, it can only be turned on by root in single-user mode.) -GAWollman -- Garrett A. Wollman | Shashish is simple, it's discreet, it's brief. ... wollman@lcs.mit.edu | Shashish is the bonding of hearts in spite of distance. Opinions not those of| It is a bond more powerful than absence. We like people MIT, LCS, ANA, or NSA| who like Shashish. - Claude McKenzie + Florent Vollant