Gentoo Archives: gentoo-hardened

From: Dave Armstrong <dave0x01@×××××.com>
To: gentoo-hardened@l.g.o
Subject: Re: [gentoo-hardened] Current state of Xorg, KMS, and iopl/ioperm
Date: Sat, 09 Feb 2013 00:06:31
Message-Id: 511592DE.7050501@gmail.com
In Reply to: Re: [gentoo-hardened] Current state of Xorg, KMS, and iopl/ioperm by "Tóth Attila"
1 On 01/31/13 04:12, "Tóth Attila" wrote:
2 > I can confirm, that radeon KMS is running despite enabling this option.
3 > From now on I'll run X radeon KMS driver with this option enabled on two
4 > machines (server and notebook). I report back if something pops up.
5 > Interesting: Dw.
6 >
7
8 Glad to hear it. FWIW, I haven't noticed any loss of functionality in
9 any programs since disabling sys_ioperm/sys_iopl. I now have them
10 disabled even in non- hardened/gresecurity kernels as well.
11
12 The remainder of this message applies to the list as a whole:
13
14 I'm happy to report that the patch worked: the Intel integrated graphics
15 drivers now work with "privileged I/O" disabled as well.
16
17 In hopes that others might benefit as well, I filed a bug report at BGO:
18 https://bugs.gentoo.org/show_bug.cgi?id=456220
19
20 From there you can also download the patch as a single file (as opposed
21 to the 3-part series from mailing list to which I linked in my initial
22 post). I tested against x11-base/xorg-server-1.13.2.
23
24 Instead of failing, my Xorg log now emits the harmless message during
25 initiation: "xf86EnableIOPorts: failed to set IOPL for I/O (Function not
26 implemented)"
27
28 I don't know whether the Gentoo X maintainers will appreciate the
29 significance, so feel free to add comments if you think it's worthwhile.
30 Hopefully the changes will be merged upstream soon.
31
32
33 Dave