[PATCH] make /dev/kmem a config option

[PATCH] make /dev/kmem a config option

[Arjan van de Ven]

Subject: [PATCH] make /dev/kmem a config option
From: Arjan van de Ven <arjan@linux.intel.com>

This patch makes /dev/kmem a config option; /dev/kmem is VERY rarely
used, and when used, it's generally for no good (rootkits tend to be
the most common users). With this config option, users have the
choice to disable /dev/kmem, saving some size as well.

A patch to disable /dev/kmem has been in the Fedora and RHEL kernels for
4+ years now without any known problems or legit users of /dev/kmem.

Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
---
 drivers/char/Kconfig |    8 ++++++++
 drivers/char/mem.c   |   12 ++++++++++++
 2 files changed, 20 insertions(+), 0 deletions(-)

diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 4666295..7716af0 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -80,6 +80,14 @@ config VT_HW_CONSOLE_BINDING
 	 information. For framebuffer console users, please refer to
 	 <file:Documentation/fb/fbcon.txt>.
 
+config DEV_KMEM
+	bool "/dev/kmem virtual device support"
+	help
+	  Say Y here if you want to support the /dev/kmem device. The
+	  /dev/kmem device is rarely used, but can be used for certain
+	  kind of kernel debugging operations.
+	  When in doubt, say "N".
+
 config SERIAL_NONSTANDARD
 	bool "Non-standard serial port support"
 	depends on HAS_IOMEM
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 3745e6b..49c5fac 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -323,6 +323,7 @@ static int mmap_mem(struct file * file, struct vm_area_struct * vma)
 	return 0;
 }
 
+#ifdef CONFIG_DEVKMEM
 static int mmap_kmem(struct file * file, struct vm_area_struct * vma)
 {
 	unsigned long pfn;
@@ -343,6 +344,7 @@ static int mmap_kmem(struct file * file, struct vm_area_struct * vma)
 	vma->vm_pgoff = pfn;
 	return mmap_mem(file, vma);
 }
+#endif
 
 #ifdef CONFIG_CRASH_DUMP
 /*
@@ -381,6 +383,7 @@ static ssize_t read_oldmem(struct file *file, char __user *buf,
 extern long vread(char *buf, char *addr, unsigned long count);
 extern long vwrite(char *buf, char *addr, unsigned long count);
 
+#ifdef CONFIG_DEVKMEM
 /*
  * This function reads the *virtual* memory as seen by the kernel.
  */
@@ -585,6 +588,11 @@ static ssize_t write_kmem(struct file * file, const char __user * buf,
  	*ppos = p;
  	return virtr + wrote;
 }
+#else
+#define read_kmem NULL
+#define write_kmem NULL
+#define mmap_kmem NULL
+#endif
 
 #ifdef CONFIG_DEVPORT
 static ssize_t read_port(struct file * file, char __user * buf,
@@ -848,11 +856,13 @@ static int memory_open(struct inode * inode, struct file * filp)
 			filp->f_mapping->backing_dev_info =
 				&directly_mappable_cdev_bdi;
 			break;
+#ifdef CONFIG_DEVKMEM
 		case 2:
 			filp->f_op = &kmem_fops;
 			filp->f_mapping->backing_dev_info =
 				&directly_mappable_cdev_bdi;
 			break;
+#endif
 		case 3:
 			filp->f_op = &null_fops;
 			break;
@@ -901,7 +911,9 @@ static const struct {
 	const struct file_operations	*fops;
 } devlist[] = { /* list of minor devices */
 	{1, "mem",     S_IRUSR | S_IWUSR | S_IRGRP, &mem_fops},
+#ifdef CONFIG_DEVKMEM
 	{2, "kmem",    S_IRUSR | S_IWUSR | S_IRGRP, &kmem_fops},
+#endif
 	{3, "null",    S_IRUGO | S_IWUGO,           &null_fops},
 #ifdef CONFIG_DEVPORT
 	{4, "port",    S_IRUSR | S_IWUSR | S_IRGRP, &port_fops},
-- 
1.5.3.4



-- 
If you want to reach me at my work email, use arjan@linux.intel.com
For development, discussion and tips for power savings, 
visit http://www.lesswatts.org

Re: [PATCH] make /dev/kmem a config option

[Jan Engelhardt]

On Feb 10 2008 15:55, Arjan van de Ven wrote:
>+#ifdef CONFIG_DEVKMEM
> /*
>  * This function reads the *virtual* memory as seen by the kernel.
>  */
>@@ -585,6 +588,11 @@ static ssize_t write_kmem(struct file * file, const char __user * buf,
>  	*ppos = p;
>  	return virtr + wrote;
> }
>+#else
>+#define read_kmem NULL
>+#define write_kmem NULL
>+#define mmap_kmem NULL
>+#endif

Is the #else case needed? All kmem_fops uses seem #ifdef'ed out anyway,
except kmem_fops itself. In other words,

+#ifdef CONFIG_DEVKMEM
 static const struct file_operations kmem_fops = {
 ...
 }
+#endif

and do away with the three defines. No? :)

Re: [PATCH] make /dev/kmem a config option

[Arjan van de Ven]

On Mon, 11 Feb 2008 01:13:09 +0100 (CET)
Jan Engelhardt <jengelh@computergmbh.de> wrote:

> 
> On Feb 10 2008 15:55, Arjan van de Ven wrote:
> >+#ifdef CONFIG_DEVKMEM
> > /*
> >  * This function reads the *virtual* memory as seen by the kernel.
> >  */
> >@@ -585,6 +588,11 @@ static ssize_t write_kmem(struct file * file,
> >const char __user * buf,
> >  	*ppos = p;
> >  	return virtr + wrote;
> > }
> >+#else
> >+#define read_kmem NULL
> >+#define write_kmem NULL
> >+#define mmap_kmem NULL
> >+#endif
> 
> Is the #else case needed? All kmem_fops uses seem #ifdef'ed out
> anyway, except kmem_fops itself. In other words,
> 
> +#ifdef CONFIG_DEVKMEM
>  static const struct file_operations kmem_fops = {
>  ...
>  }
> +#endif
> 
> and do away with the three defines. No? :)

hmm I tried that first, and didn't work
but that wasn't on the final version of the patch so let me try again..


-- 
If you want to reach me at my work email, use arjan@linux.intel.com
For development, discussion and tips for power savings, 
visit http://www.lesswatts.org

Re: [PATCH] make /dev/kmem a config option

[Arjan van de Ven]

On Mon, 11 Feb 2008 01:13:09 +0100 (CET)
Jan Engelhardt <jengelh@computergmbh.de> wrote:

> 
> On Feb 10 2008 15:55, Arjan van de Ven wrote:
> >+#ifdef CONFIG_DEVKMEM
> > /*
> >  * This function reads the *virtual* memory as seen by the kernel.
> >  */
> >@@ -585,6 +588,11 @@ static ssize_t write_kmem(struct file * file,
> >const char __user * buf,
> >  	*ppos = p;
> >  	return virtr + wrote;
> > }
> >+#else
> >+#define read_kmem NULL
> >+#define write_kmem NULL
> >+#define mmap_kmem NULL
> >+#endif
> 
> Is the #else case needed? All kmem_fops uses seem #ifdef'ed out
> anyway, except kmem_fops itself. In other words,
> 
> +#ifdef CONFIG_DEVKMEM
>  static const struct file_operations kmem_fops = {
>  ...
>  }
> +#endif
> 
> and do away with the three defines. No? :)

yup you're right; updated patch below

---

Subject: [PATCH] make /dev/kmem a config option
From: Arjan van de Ven <arjan@linux.intel.com>

This patch makes /dev/kmem a config option; /dev/kmem is VERY rarely
used, and when used, it's generally for no good (rootkits tend to be
the most common users). With this config option, users have the
choice to disable /dev/kmem, saving some size as well.

A patch to disable /dev/kmem has been in the Fedora and RHEL kernels for
4+ years now without any known problems or legit users of /dev/kmem.

Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
---
 drivers/char/Kconfig |    8 ++++++++
 drivers/char/mem.c   |   10 ++++++++++
 2 files changed, 18 insertions(+)

Index: linux.trees.git/drivers/char/Kconfig
===================================================================
--- linux.trees.git.orig/drivers/char/Kconfig
+++ linux.trees.git/drivers/char/Kconfig
@@ -80,6 +80,14 @@ config VT_HW_CONSOLE_BINDING
 	 information. For framebuffer console users, please refer to
 	 <file:Documentation/fb/fbcon.txt>.
 
+config DEV_KMEM
+	bool "/dev/kmem virtual device support"
+	help
+	  Say Y here if you want to support the /dev/kmem device. The
+	  /dev/kmem device is rarely used, but can be used for certain
+	  kind of kernel debugging operations.
+	  When in doubt, say "N".
+
 config SERIAL_NONSTANDARD
 	bool "Non-standard serial port support"
 	depends on HAS_IOMEM
Index: linux.trees.git/drivers/char/mem.c
===================================================================
--- linux.trees.git.orig/drivers/char/mem.c
+++ linux.trees.git/drivers/char/mem.c
@@ -295,6 +295,7 @@ static int mmap_mem(struct file * file, 
 	return 0;
 }
 
+#ifdef CONFIG_DEVKMEM
 static int mmap_kmem(struct file * file, struct vm_area_struct * vma)
 {
 	unsigned long pfn;
@@ -315,6 +316,7 @@ static int mmap_kmem(struct file * file,
 	vma->vm_pgoff = pfn;
 	return mmap_mem(file, vma);
 }
+#endif
 
 #ifdef CONFIG_CRASH_DUMP
 /*
@@ -353,6 +355,7 @@ static ssize_t read_oldmem(struct file *
 extern long vread(char *buf, char *addr, unsigned long count);
 extern long vwrite(char *buf, char *addr, unsigned long count);
 
+#ifdef CONFIG_DEVKMEM
 /*
  * This function reads the *virtual* memory as seen by the kernel.
  */
@@ -557,6 +560,7 @@ static ssize_t write_kmem(struct file * 
  	*ppos = p;
  	return virtr + wrote;
 }
+#endif
 
 #ifdef CONFIG_DEVPORT
 static ssize_t read_port(struct file * file, char __user * buf,
@@ -734,6 +738,7 @@ static const struct file_operations mem_
 	.get_unmapped_area = get_unmapped_area_mem,
 };
 
+#ifdef CONFIG_DEVKMEM
 static const struct file_operations kmem_fops = {
 	.llseek		= memory_lseek,
 	.read		= read_kmem,
@@ -742,6 +747,7 @@ static const struct file_operations kmem
 	.open		= open_kmem,
 	.get_unmapped_area = get_unmapped_area_mem,
 };
+#endif
 
 static const struct file_operations null_fops = {
 	.llseek		= null_lseek,
@@ -820,11 +826,13 @@ static int memory_open(struct inode * in
 			filp->f_mapping->backing_dev_info =
 				&directly_mappable_cdev_bdi;
 			break;
+#ifdef CONFIG_DEVKMEM
 		case 2:
 			filp->f_op = &kmem_fops;
 			filp->f_mapping->backing_dev_info =
 				&directly_mappable_cdev_bdi;
 			break;
+#endif
 		case 3:
 			filp->f_op = &null_fops;
 			break;
@@ -873,7 +881,9 @@ static const struct {
 	const struct file_operations	*fops;
 } devlist[] = { /* list of minor devices */
 	{1, "mem",     S_IRUSR | S_IWUSR | S_IRGRP, &mem_fops},
+#ifdef CONFIG_DEVKMEM
 	{2, "kmem",    S_IRUSR | S_IWUSR | S_IRGRP, &kmem_fops},
+#endif
 	{3, "null",    S_IRUGO | S_IWUGO,           &null_fops},
 #ifdef CONFIG_DEVPORT
 	{4, "port",    S_IRUSR | S_IWUSR | S_IRGRP, &port_fops},



-- 
If you want to reach me at my work email, use arjan@linux.intel.com
For development, discussion and tips for power savings, 
visit http://www.lesswatts.org

Re: [PATCH] make /dev/kmem a config option

[Andrew Morton]

On Sun, 10 Feb 2008 17:05:09 -0800
Arjan van de Ven <arjan@infradead.org> wrote:

> Subject: [PATCH] make /dev/kmem a config option
> From: Arjan van de Ven <arjan@linux.intel.com>
> 
> This patch makes /dev/kmem a config option; /dev/kmem is VERY rarely
> used, and when used, it's generally for no good (rootkits tend to be
> the most common users). With this config option, users have the
> choice to disable /dev/kmem, saving some size as well.
> 
> A patch to disable /dev/kmem has been in the Fedora and RHEL kernels for
> 4+ years now without any known problems or legit users of /dev/kmem.
> 

I question the testedness of this.

> +config DEV_KMEM
> ...
> +#ifdef CONFIG_DEVKMEM
>

Re: [PATCH] make /dev/kmem a config option

[Arjan van de Ven]

On Mon, 11 Feb 2008 14:38:04 -0800
Andrew Morton <akpm@linux-foundation.org> wrote:

> On Sun, 10 Feb 2008 17:05:09 -0800
> Arjan van de Ven <arjan@infradead.org> wrote:
> 
> > Subject: [PATCH] make /dev/kmem a config option
> > From: Arjan van de Ven <arjan@linux.intel.com>
> > 
> > This patch makes /dev/kmem a config option; /dev/kmem is VERY rarely
> > used, and when used, it's generally for no good (rootkits tend to be
> > the most common users). With this config option, users have the
> > choice to disable /dev/kmem, saving some size as well.
> > 
> > A patch to disable /dev/kmem has been in the Fedora and RHEL
> > kernels for 4+ years now without any known problems or legit users
> > of /dev/kmem.
> > 
> 
> I question the testedness of this.
> 
> > +config DEV_KMEM
> > ...
> > +#ifdef CONFIG_DEVKMEM

it works great in hiding /dev/kmem ;)
And since nothing uses that I didn't notice the other case.

Updated patch below

From: Arjan van de Ven <arjan@linux.intel.com>
Subject: [PATCH] make /dev/kmem a config option

This patch makes /dev/kmem a config option; /dev/kmem is VERY rarely
used, and when used, it's generally for no good (rootkits tend to be
the most common users). With this config option, users have the
choice to disable /dev/kmem, saving some size as well.

A patch to disable /dev/kmem has been in the Fedora and RHEL kernels for
4+ years now without any known problems or legit users of /dev/kmem.

Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
---
 drivers/char/Kconfig |    8 ++++++++
 drivers/char/mem.c   |   10 ++++++++++
 2 files changed, 18 insertions(+)

Index: linux.trees.git/drivers/char/Kconfig
===================================================================
--- linux.trees.git.orig/drivers/char/Kconfig
+++ linux.trees.git/drivers/char/Kconfig
@@ -80,6 +80,14 @@ config VT_HW_CONSOLE_BINDING
 	 information. For framebuffer console users, please refer to
 	 <file:Documentation/fb/fbcon.txt>.
 
+config DEVKMEM
+	bool "/dev/kmem virtual device support"
+	help
+	  Say Y here if you want to support the /dev/kmem device. The
+	  /dev/kmem device is rarely used, but can be used for certain
+	  kind of kernel debugging operations.
+	  When in doubt, say "N".
+
 config SERIAL_NONSTANDARD
 	bool "Non-standard serial port support"
 	depends on HAS_IOMEM
Index: linux.trees.git/drivers/char/mem.c
===================================================================
--- linux.trees.git.orig/drivers/char/mem.c
+++ linux.trees.git/drivers/char/mem.c
@@ -295,6 +295,7 @@ static int mmap_mem(struct file * file, 
 	return 0;
 }
 
+#ifdef CONFIG_DEVKMEM
 static int mmap_kmem(struct file * file, struct vm_area_struct * vma)
 {
 	unsigned long pfn;
@@ -315,6 +316,7 @@ static int mmap_kmem(struct file * file,
 	vma->vm_pgoff = pfn;
 	return mmap_mem(file, vma);
 }
+#endif
 
 #ifdef CONFIG_CRASH_DUMP
 /*
@@ -353,6 +355,7 @@ static ssize_t read_oldmem(struct file *
 extern long vread(char *buf, char *addr, unsigned long count);
 extern long vwrite(char *buf, char *addr, unsigned long count);
 
+#ifdef CONFIG_DEVKMEM
 /*
  * This function reads the *virtual* memory as seen by the kernel.
  */
@@ -557,6 +560,7 @@ static ssize_t write_kmem(struct file * 
  	*ppos = p;
  	return virtr + wrote;
 }
+#endif
 
 #ifdef CONFIG_DEVPORT
 static ssize_t read_port(struct file * file, char __user * buf,
@@ -734,6 +738,7 @@ static const struct file_operations mem_
 	.get_unmapped_area = get_unmapped_area_mem,
 };
 
+#ifdef CONFIG_DEVKMEM
 static const struct file_operations kmem_fops = {
 	.llseek		= memory_lseek,
 	.read		= read_kmem,
@@ -742,6 +747,7 @@ static const struct file_operations kmem
 	.open		= open_kmem,
 	.get_unmapped_area = get_unmapped_area_mem,
 };
+#endif
 
 static const struct file_operations null_fops = {
 	.llseek		= null_lseek,
@@ -820,11 +826,13 @@ static int memory_open(struct inode * in
 			filp->f_mapping->backing_dev_info =
 				&directly_mappable_cdev_bdi;
 			break;
+#ifdef CONFIG_DEVKMEM
 		case 2:
 			filp->f_op = &kmem_fops;
 			filp->f_mapping->backing_dev_info =
 				&directly_mappable_cdev_bdi;
 			break;
+#endif
 		case 3:
 			filp->f_op = &null_fops;
 			break;
@@ -873,7 +881,9 @@ static const struct {
 	const struct file_operations	*fops;
 } devlist[] = { /* list of minor devices */
 	{1, "mem",     S_IRUSR | S_IWUSR | S_IRGRP, &mem_fops},
+#ifdef CONFIG_DEVKMEM
 	{2, "kmem",    S_IRUSR | S_IWUSR | S_IRGRP, &kmem_fops},
+#endif
 	{3, "null",    S_IRUGO | S_IWUGO,           &null_fops},
 #ifdef CONFIG_DEVPORT
 	{4, "port",    S_IRUSR | S_IWUSR | S_IRGRP, &port_fops},


-- 
If you want to reach me at my work email, use arjan@linux.intel.com
For development, discussion and tips for power savings, 
visit http://www.lesswatts.org

Re: [PATCH] make /dev/kmem a config option

[Andrew Morton]

On Mon, 11 Feb 2008 20:03:29 -0800 Arjan van de Ven <arjan@infradead.org> wrote:

> +config DEVKMEM
> +	bool "/dev/kmem virtual device support"
> +	help
> +	  Say Y here if you want to support the /dev/kmem device. The
> +	  /dev/kmem device is rarely used, but can be used for certain
> +	  kind of kernel debugging operations.
> +	  When in doubt, say "N".

I think this should be `default y'.  So that we don't cause /dev/kmem to
magically disappear for `make oldconfig' users.

Re: [PATCH] make /dev/kmem a config option

[Arjan van de Ven]

On Mon, 11 Feb 2008 20:59:14 -0800
Andrew Morton <akpm@linux-foundation.org> wrote:

> On Mon, 11 Feb 2008 20:03:29 -0800 Arjan van de Ven
> <arjan@infradead.org> wrote:
> 
> > +config DEVKMEM
> > +	bool "/dev/kmem virtual device support"
> > +	help
> > +	  Say Y here if you want to support the /dev/kmem device.
> > The
> > +	  /dev/kmem device is rarely used, but can be used for
> > certain
> > +	  kind of kernel debugging operations.
> > +	  When in doubt, say "N".
> 
> I think this should be `default y'.  So that we don't cause /dev/kmem
> to magically disappear for `make oldconfig' users.

that's a matter of taste; nothing uses/needs it and I think people are better
off without it (by default), but if you insist I can't object to that too much
either.


-- 
If you want to reach me at my work email, use arjan@linux.intel.com
For development, discussion and tips for power savings, 
visit http://www.lesswatts.org