This is an automated email from the ASF dual-hosted git repository.
acassis pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
The following commit(s) were added to refs/heads/master by this push:
new a30bbfee6bc drivers/: Multiple Drivers Are Registered With World
Writable Part 3
a30bbfee6bc is described below
commit a30bbfee6bc2d28878874dc68c3e9ee54ddd8768
Author: Catalin Visinescu <[email protected]>
AuthorDate: Wed Jul 15 18:15:18 2026 -0400
drivers/: Multiple Drivers Are Registered With World Writable Part 3
Summary
Permissions (Part 3)
Description:
In kernel builds, any unprivileged process running on the NuttX device can
open /dev/efuse and attempt to read/write fuse content. Reading the fuses
may provide valuable information to an attacker controlling the user
process.
The write operation, in extreme cases where the fuse blocks are not locked,
may brick the device.
DISCLAIMER: I tried to be strict with the settings, better to relax them
later if it's needed.
This is part of https://github.com/apache/nuttx/issues/19410
Impact
See https://github.com/apache/nuttx/issues/19410
Testing
Compiles ok.
Signed-off-by: Catalin Visinescu <[email protected]>
---
drivers/misc/goldfish_pipe.c | 2 +-
drivers/misc/rpmsgblk.c | 2 +-
drivers/mmcsd/mmcsd_sdio.c | 2 +-
drivers/mtd/dhara.c | 2 +-
drivers/mtd/nvblk.c | 2 +-
drivers/pipes/pipe.c | 2 +-
drivers/sensors/ina3221.c | 2 +-
drivers/serial/uart_hostfs.c | 2 +-
drivers/usbdev/usbdev_fs.c | 2 +-
drivers/video/max7456.c | 4 ++--
drivers/virtio/virtio-blk.c | 2 +-
11 files changed, 12 insertions(+), 12 deletions(-)
diff --git a/drivers/misc/goldfish_pipe.c b/drivers/misc/goldfish_pipe.c
index d9003e27936..a5319dda2b1 100644
--- a/drivers/misc/goldfish_pipe.c
+++ b/drivers/misc/goldfish_pipe.c
@@ -681,7 +681,7 @@ int goldfish_pipe_register(FAR void *base, int irq)
/* Register the pipe device */
return register_driver("/dev/goldfish_pipe",
- &g_goldfish_pipe_fops, 0666, dev);
+ &g_goldfish_pipe_fops, 0600, dev);
out:
kmm_free(dev);
diff --git a/drivers/misc/rpmsgblk.c b/drivers/misc/rpmsgblk.c
index a19c1d31513..c64b8917727 100644
--- a/drivers/misc/rpmsgblk.c
+++ b/drivers/misc/rpmsgblk.c
@@ -1307,7 +1307,7 @@ int rpmsgblk_register(FAR const char *remotecpu, FAR
const char *remotepath,
localpath = remotepath;
}
- ret = register_blockdriver(localpath, &dev->blk, 0750, dev);
+ ret = register_blockdriver(localpath, &dev->blk, 0600, dev);
if (ret < 0)
{
ferr("ERROR: register driver failed, ret=%d\n", ret);
diff --git a/drivers/mmcsd/mmcsd_sdio.c b/drivers/mmcsd/mmcsd_sdio.c
index a767dce7fee..4f0db8cd154 100644
--- a/drivers/mmcsd/mmcsd_sdio.c
+++ b/drivers/mmcsd/mmcsd_sdio.c
@@ -4407,7 +4407,7 @@ static int mmcsd_probe(FAR struct mmcsd_state_s *priv)
{
snprintf(devname, sizeof(devname), "/dev/mmcsd%d%s",
priv->minor, g_partname[i]);
- register_blockdriver(devname, &g_bops, 0660,
+ register_blockdriver(devname, &g_bops, 0600,
&priv->part[i]);
}
}
diff --git a/drivers/mtd/dhara.c b/drivers/mtd/dhara.c
index 837a50e01e1..075cac7d4ff 100644
--- a/drivers/mtd/dhara.c
+++ b/drivers/mtd/dhara.c
@@ -754,7 +754,7 @@ int dhara_initialize_by_path(FAR const char *path,
* DHARA_MTDBLOCK device structure
*/
- ret = register_blockdriver(path, &g_dhara_bops, 0660, dev);
+ ret = register_blockdriver(path, &g_dhara_bops, 0600, dev);
if (ret < 0)
{
ferr("register_blockdriver failed: %d\n", ret);
diff --git a/drivers/mtd/nvblk.c b/drivers/mtd/nvblk.c
index 541cfb0297b..16e68e348e4 100644
--- a/drivers/mtd/nvblk.c
+++ b/drivers/mtd/nvblk.c
@@ -542,7 +542,7 @@ int nvblk_initialize(FAR const char *path,
* NVBLK_MTDBLOCK device structure
*/
- ret = register_blockdriver(path, &g_nvblk_bops, 0660, dev);
+ ret = register_blockdriver(path, &g_nvblk_bops, 0600, dev);
if (ret < 0)
{
ferr("register_blockdriver failed: %d\n", ret);
diff --git a/drivers/pipes/pipe.c b/drivers/pipes/pipe.c
index 0dc7b14e704..7ea926d007b 100644
--- a/drivers/pipes/pipe.c
+++ b/drivers/pipes/pipe.c
@@ -149,7 +149,7 @@ static int pipe_register(size_t bufsize, int flags,
/* Register the pipe device */
- ret = register_pipedriver(devname, &g_pipe_fops, 0666, (FAR void *)dev);
+ ret = register_pipedriver(devname, &g_pipe_fops, 0600, (FAR void *)dev);
if (ret != 0)
{
pipecommon_freedev(dev);
diff --git a/drivers/sensors/ina3221.c b/drivers/sensors/ina3221.c
index 3920ac4fe9b..5f1673a0e20 100644
--- a/drivers/sensors/ina3221.c
+++ b/drivers/sensors/ina3221.c
@@ -393,7 +393,7 @@ int ina3221_register(FAR const char *devpath, FAR struct
i2c_master_s *i2c,
/* Register the character driver */
- ret = register_driver(devpath, &g_ina3221fops, 0666, priv);
+ ret = register_driver(devpath, &g_ina3221fops, 0600, priv);
if (ret < 0)
{
snerr("ERROR: Failed to register driver: %d\n", ret);
diff --git a/drivers/serial/uart_hostfs.c b/drivers/serial/uart_hostfs.c
index 9d4864ce181..db949a7e915 100644
--- a/drivers/serial/uart_hostfs.c
+++ b/drivers/serial/uart_hostfs.c
@@ -131,7 +131,7 @@ static int uart_hostfs_setup(FAR struct uart_dev_s *dev)
FAR struct uart_hostfs_priv_s *priv = dev->priv;
priv->fd = host_open(CONFIG_UART_HOSTFS_DEVPATH, O_RDWR | O_NONBLOCK,
- 0666);
+ 0600);
return priv->fd;
}
diff --git a/drivers/usbdev/usbdev_fs.c b/drivers/usbdev/usbdev_fs.c
index fdc1a890ff1..1bc886fd257 100644
--- a/drivers/usbdev/usbdev_fs.c
+++ b/drivers/usbdev/usbdev_fs.c
@@ -1244,7 +1244,7 @@ static void usbdev_fs_register_driver(FAR void *arg)
{
snprintf(devname, sizeof(devname), "%s/ep%d",
devinfo->name, i);
- ret = register_driver(devname, &g_usbdev_fs_fops, 0666, &fs->eps[i]);
+ ret = register_driver(devname, &g_usbdev_fs_fops, 0600, &fs->eps[i]);
if (ret < 0)
{
uerr("Failed to register driver:%s, ret:%d\n", devname, ret);
diff --git a/drivers/video/max7456.c b/drivers/video/max7456.c
index 5e882249770..646dd6cda2c 100644
--- a/drivers/video/max7456.c
+++ b/drivers/video/max7456.c
@@ -1662,7 +1662,7 @@ int max7456_register(FAR const char *path, FAR struct
mx7_config_s *config)
for (n = 0; ret >= 0 && n < NODE_MAP_LEN; n++)
{
- ret = add_interface(path, node_map[n].path, &g_mx7_fops, 0666, dev);
+ ret = add_interface(path, node_map[n].path, &g_mx7_fops, 0600, dev);
}
#if defined(DEBUG)
@@ -1675,7 +1675,7 @@ int max7456_register(FAR const char *path, FAR struct
mx7_config_s *config)
for (n = 0; ret >= 0 && n < REG_NAME_MAP_LEN; n++)
{
ret = add_interface(path, reg_name_map[n].path, &g_mx7_debug_fops,
- 0666, dev);
+ 0600, dev);
}
#endif
diff --git a/drivers/virtio/virtio-blk.c b/drivers/virtio/virtio-blk.c
index aa13e02edf8..e68728c35d6 100644
--- a/drivers/virtio/virtio-blk.c
+++ b/drivers/virtio/virtio-blk.c
@@ -596,7 +596,7 @@ static int virtio_blk_probe(FAR struct virtio_device *vdev)
/* Register block driver */
snprintf(priv->name, NAME_MAX, "/dev/virtblk%d", g_virtio_blk_idx);
- ret = register_blockdriver(priv->name, &g_virtio_blk_bops, 0660, priv);
+ ret = register_blockdriver(priv->name, &g_virtio_blk_bops, 0600, priv);
if (ret < 0)
{
vrterr("Register block driver failed, ret=%d\n", ret);
