On Sun, Feb 13, 2011 at 07:22, Dave Young <hidave.darkstar at gmail.com> wrote: > Finally I bisected it, results: > 47970b1b2aa64464bc0a9543e86361a622ae7c03 is first bad commit > commit 47970b1b2aa64464bc0a9543e86361a622ae7c03 > Author: Chris Wright <chrisw at sous-sol.org> > Date: ? Thu Feb 10 15:58:56 2011 -0800 > > ? ?pci: use security_capable() when checking capablities during config space > read > > ? ?Eric Paris noted that commit de139a3 ("pci: check caps from sysfs file > ? ?open to read device dependent config space") caused the capability check > ? ?to bypass security modules and potentially auditing. ?Rectify this by > ? ?calling security_capable() when checking the open file's capabilities > ? ?for config space reads. > > ? ?Reported-by: Eric Paris <eparis at redhat.com> > ? ?Signed-off-by: Chris Wright <chrisw at sous-sol.org> > ? ?Signed-off-by: James Morris <jmorris at namei.org> >
Actually, even reading the PCI capabilities fails with lspci reporting "Capabilities: <access denied>" if run as root. "libpciaccess" should have handled this situation, but still it looks like a regression and it breaks existing systems.