|author||Henrique de Moraes Holschuh <email@example.com>||2010-02-25 22:22:22 -0300|
|committer||Henrique de Moraes Holschuh <firstname.lastname@example.org>||2010-02-25 22:22:22 -0300|
thinkpad-acpi: lock down video output state access
Given the right combination of ThinkPad and X.org, just reading the video output control state is enough to hard-crash X.org. Until the day I somehow find out a model or BIOS cut date to not provide this feature to ThinkPads that can do video switching through X RandR, change permissions so that only processes with CAP_SYS_ADMIN can access any sort of video output control state. This bug could be considered a local DoS I suppose, as it allows any non-privledged local user to cause some versions of X.org to hard-crash some ThinkPads. Reported-by: Jidanni <email@example.com> Signed-off-by: Henrique de Moraes Holschuh <firstname.lastname@example.org> Cc: email@example.com
Diffstat (limited to 'Documentation/laptops')
1 files changed, 4 insertions, 0 deletions
diff --git a/Documentation/laptops/thinkpad-acpi.txt b/Documentation/laptops/thinkpad-acpi.txt
index 75afa1229fd7..39c0a09d0105 100644
@@ -650,6 +650,10 @@ LCD, CRT or DVI (if available). The following commands are available:
echo expand_toggle > /proc/acpi/ibm/video
echo video_switch > /proc/acpi/ibm/video
+NOTE: Access to this feature is restricted to processes owning the
+CAP_SYS_ADMIN capability for safety reasons, as it can interact badly
+enough with some versions of X.org to crash it.
Each video output device can be enabled or disabled individually.
Reading /proc/acpi/ibm/video shows the status of each device.