On Sun, Feb 13, 2011 at 07:22, Dave Young hidave.darkstar@gmail.com wrote:
Finally I bisected it, results: 47970b1b2aa64464bc0a9543e86361a622ae7c03 is first bad commit commit 47970b1b2aa64464bc0a9543e86361a622ae7c03 Author: Chris Wright chrisw@sous-sol.org Date: Thu Feb 10 15:58:56 2011 -0800
pci: use security_capable() when checking capablities during config space read
Eric Paris noted that commit de139a3 ("pci: check caps from sysfs file open to read device dependent config space") caused the capability check to bypass security modules and potentially auditing. Rectify this by calling security_capable() when checking the open file's capabilities for config space reads.
Reported-by: Eric Paris eparis@redhat.com Signed-off-by: Chris Wright chrisw@sous-sol.org Signed-off-by: James Morris jmorris@namei.org
Actually, even reading the PCI capabilities fails with lspci reporting "Capabilities: <access denied>" if run as root. "libpciaccess" should have handled this situation, but still it looks like a regression and it breaks existing systems.