Re: [PATCH] kernel: Restrict permissions of /proc/iomem.

[Dave Hansen]

On 10/25/19 1:56 AM, zhanglin wrote:
> The permissions of /proc/iomem currently are -r--r--r--. Everyone can
> see its content. As iomem contains information about the physical memory
> content of the device, restrict the information only to root.

For me, running as non-root on 5.4.0-rc4, I see:

$ cat /proc/iomem
00000000-00000000 : Reserved
00000000-00000000 : System RAM
00000000-00000000 : Reserved
00000000-00000000 : PCI Bus 0000:00
00000000-00000000 : Video ROM
00000000-00000000 : pnp 00:00
00000000-00000000 : pnp 00:00
00000000-00000000 : pnp 00:00

All 0's since kernel/resource.c::r_show() does:

        if (file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN)) {
                start = r->start;
                end = r->end;
        } else {
                start = end = 0;
        }

Are you just looking at the file as root and assuming that users see the
same thing since they have read permissions?