Klemens Nanni <[email protected]> wrote:
> On Sun, Jan 19, 2020 at 11:50:01AM -0700, Theo de Raadt wrote:
> > Your text seems somewhat backwards, because if you can't open it, it
> > doesn't matter if it is read-only, it is read-not.
> It starts with what holds true unconditionally: the fact that you cannot
> write; then it describes an additional case that has another condition
> to it.
>
> Is this version better?
1 Secure mode
- default mode when system is multi-user
- securelevel may no longer be lowered except by init
- /dev/mem and /dev/kmem cannot be opened
- raw disk devices of mounted file systems are read-only
...
The list is "what is blocked". Changing this to a complicated set of
conditions regarding unrelated conditions makes this difficult to read.
The test is:
switch (minor(dev)) {
case 0:
case 1:
if (securelevel <= 0 || allowkmem)
break;
return (EPERM);
Maybe
/dev/mem and /dev/kmem cannot be opened (unless permitted by sysctl(8)
kern.allowkmem)
Your text about read-only must be incorrect. That is decided by the
permission of the nodes in the filesystem, not by securelevel or
kern.allowkmem.... the idea is you can't open it, so you can't read/write/map.
> Index: share/man/man7/securelevel.7
> ===================================================================
> RCS file: /cvs/src/share/man/man7/securelevel.7,v
> retrieving revision 1.31
> diff -u -p -r1.31 securelevel.7
> --- share/man/man7/securelevel.7 21 Aug 2019 20:44:09 -0000 1.31
> +++ share/man/man7/securelevel.7 19 Jan 2020 20:40:30 -0000
> @@ -66,7 +66,10 @@ securelevel may no longer be lowered exc
> .Pa /dev/mem
> and
> .Pa /dev/kmem
> -cannot be opened
> +can only be opened if the
> +.Va kern.allowkmem
> +.Xr sysctl 8
> +variable is set, both are read-only
> .It
> raw disk devices of mounted file systems are read-only
> .It
