# Framebuffer und Sicherheit

## mrsteven

Hallo!

Ich hab ein paar Fragen wg. Framebuffer:

1) Was bewirkt es genau, wenn ich aus /dev/fb/0 lese, bzw. da rein schreibe?

2) Warum ändert X den Eigentümer dieses Gerätes auf den User, der X startet, obwohl ich X mit dem nvidia-Treiber benutze?

3) Macht das das System nicht unsicherer, weil so ein normaler User Zugriff auf die Grafikhardware erhält, und so z.B. die angezeigten Daten von root ausspionieren kann?

4) Wenn ja, wie kann man diese Sicherheitslücke schließen, und den Framebuffer trotzdem verwenden (schöne große Konsole)?

----------

## JensZ

Zu 1) damit schreibst du direkt in den RAM der Graka

Zu 2) damit der betreffende User das Device benutzen kann

Zu 3) soweit ich das sehen kannst du nicht mehr als ein Programm auf

einen Framebuffer device benutzen, und da die Rechte so geändert

werden das immer nur einer Zugriff hat, kann da nichts passieren.

----------

## mrsteven

zu 1) Ich find's halt nicht so toll, wenn man durch ein dd if=/dev/random of=/dev/fb0 den Bildschirm unleserlich machen kann.

zu 2) Warum braucht der User das? X läuft doch sowieso als root.

zu 3) Also können nicht gleichzeitig 2 Programme das Gerät benutzen, oder?

----------

## JensZ

Das ist halt Unix, mit einem dd if=/dev/random of=/dev/hda kannst du ja

auch deine Festplatte unleserlich machen, außerdem ist das Framebuffer

device normalerweise von der Console belegt, was passiert wenn X

gestartet wird weiß ich nicht, aber ich denke mal das der Frambuffer

treiber dann deaktiviert wird, ich kann mir nicht vorstellen das zwei

Treiber gleichzeitig die Graka nutzen können, dabei kann eigentlich

nichts vernünftiges bei rumkommen.

Es könnte sein das X nicht mehr als root läuft wenn man es über das

Framebuffer device betreibt, da dann ja kein direkter Hardware

zugriff mehr nötig ist, keine Ahnung ob das so ist, es würde aber Sinn

machen

Ja so hab ich das Verstanden.

----------

## mrsteven

Man kann die Festplatte aber nur als root überschreiben. Bei dd if=/dev/zero of=/dev/fb0 wird aber auch bei normalen Usern (auch unter X mit nvidia-Treibern) der Bildschrim schwarz.

----------

## JensZ

Also du willst in der Console den Framebuffer benutzen, und unter X

den Nvidiatreiber nehme ich mal an. Kannst du mal deine Config

posten, ich kann mir nicht vorstellen das X die device rechte ändert

wenn es das device gar nicht nutzt

----------

## mrsteven

 *JensZ wrote:*   

> Also du willst in der Console den Framebuffer benutzen, und unter X
> 
> den Nvidiatreiber nehme ich mal an. 

 

So ist es.

 *JensZ wrote:*   

> Kannst du mal deine Config
> 
> posten, ich kann mir nicht vorstellen das X die device rechte ändert
> 
> wenn es das device gar nicht nutzt.

 

Also gut, das teil ist aber lang:

```

# File generated by xf86config.

#

# Copyright (c) 1999 by The XFree86 Project, Inc.

#

# Permission is hereby granted, free of charge, to any person obtaining a

# copy of this software and associated documentation files (the "Software"),

# to deal in the Software without restriction, including without limitation

# the rights to use, copy, modify, merge, publish, distribute, sublicense,

# and/or sell copies of the Software, and to permit persons to whom the

# Software is furnished to do so, subject to the following conditions:

# 

# The above copyright notice and this permission notice shall be included in

# all copies or substantial portions of the Software.

# 

# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL

# THE XFREE86 PROJECT BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,

# WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF

# OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

# SOFTWARE.

# 

# Except as contained in this notice, the name of the XFree86 Project shall

# not be used in advertising or otherwise to promote the sale, use or other

# dealings in this Software without prior written authorization from the

# XFree86 Project.

#

# **********************************************************************

# Refer to the XF86Config(4/5) man page for details about the format of 

# this file.

# **********************************************************************

# **********************************************************************

# Module section -- this  section  is used to specify

# which dynamically loadable modules to load.

# **********************************************************************

#

Section "Module"

# This loads the DBE extension module.

    Load        "dbe"     # Double buffer extension

# This loads the miscellaneous extensions module, and disables

# initialisation of the XFree86-DGA extension within that module.

    SubSection  "extmod"

      Option    "omit xfree86-dga"   # don't initialise the DGA extension

    EndSubSection

# This loads the Type1 and FreeType font modules

    Load        "type1"

    Load        "speedo"

#    Load        "freetype"

#    Load        "xtt"

# This loads the GLX module

    Load       "glx"

# This loads the DRI module

#    Load       "dri"

EndSection

# **********************************************************************

# Files section.  This allows default font and rgb paths to be set

# **********************************************************************

Section "Files"

# The location of the RGB database.  Note, this is the name of the

# file minus the extension (like ".txt" or ".db").  There is normally

# no need to change the default.

    RgbPath   "/usr/X11R6/lib/X11/rgb"

# Multiple FontPath entries are allowed (which are concatenated together),

# as well as specifying multiple comma-separated entries in one FontPath

# command (or a combination of both methods)

# 

# If you don't have a floating point coprocessor and emacs, Mosaic or other

# programs take long to start up, try moving the Type1 and Speedo directory

# to the end of this list (or comment them out).

# 

    FontPath   "/usr/X11R6/lib/X11/fonts/local/"

    FontPath   "/usr/X11R6/lib/X11/fonts/misc/"

    FontPath   "/usr/X11R6/lib/X11/fonts/75dpi/:unscaled"

    FontPath   "/usr/X11R6/lib/X11/fonts/100dpi/:unscaled"

    FontPath   "/usr/X11R6/lib/X11/fonts/Speedo/"

    FontPath   "/usr/X11R6/lib/X11/fonts/Type1/"

#    FontPath   "/usr/X11R6/lib/X11/fonts/TrueType/"

#    FontPath   "/usr/X11R6/lib/X11/fonts/freefont/"

    FontPath   "/usr/X11R6/lib/X11/fonts/75dpi/"

    FontPath   "/usr/X11R6/lib/X11/fonts/100dpi/"

# The module search path.  The default path is shown here.

#    ModulePath "/usr/X11R6/lib/modules"

EndSection

# **********************************************************************

# Server flags section.

# **********************************************************************

Section "ServerFlags"

# Uncomment this to cause a core dump at the spot where a signal is 

# received.  This may leave the console in an unusable state, but may

# provide a better stack trace in the core dump to aid in debugging

#    Option "NoTrapSignals"

# Uncomment this to disable the <Crtl><Alt><Fn> VT switch sequence

# (where n is 1 through 12).  This allows clients to receive these key

# events.

#    Option "DontVTSwitch"

# Uncomment this to disable the <Crtl><Alt><BS> server abort sequence

# This allows clients to receive this key event.

#    Option "DontZap"

# Uncomment this to disable the <Crtl><Alt><KP_+>/<KP_-> mode switching

# sequences.  This allows clients to receive these key events.

#    Option "Dont Zoom"

# Uncomment this to disable tuning with the xvidtune client. With

# it the client can still run and fetch card and monitor attributes,

# but it will not be allowed to change them. If it tries it will

# receive a protocol error.

#    Option "DisableVidModeExtension"

# Uncomment this to enable the use of a non-local xvidtune client. 

#    Option "AllowNonLocalXvidtune"

# Uncomment this to disable dynamically modifying the input device

# (mouse and keyboard) settings. 

#    Option "DisableModInDev"

# Uncomment this to enable the use of a non-local client to

# change the keyboard or mouse settings (currently only xset).

#    Option "AllowNonLocalModInDev"

EndSection

# **********************************************************************

# Input devices

# **********************************************************************

# **********************************************************************

# Core keyboard's InputDevice section

# **********************************************************************

Section "InputDevice"

    Identifier   "Keyboard1"

    Driver   "Keyboard"

# For most OSs the protocol can be omitted (it defaults to "Standard").

# When using XQUEUE (only for SVR3 and SVR4, but not Solaris),

# uncomment the following line.

#    Option     "Protocol"      "Xqueue"

    Option "AutoRepeat" "500 30"

# Specify which keyboard LEDs can be user-controlled (eg, with xset(1))

#    Option   "Xleds"      "1 2 3"

#    Option "LeftAlt"     "Meta"

#    Option "RightAlt"    "ModeShift"

# To customise the XKB settings to suit your keyboard, modify the

# lines below (which are the defaults).  For example, for a non-U.S.

# keyboard, you will probably want to use:

#    Option "XkbModel"    "pc102"

# If you have a US Microsoft Natural keyboard, you can use:

#    Option "XkbModel"    "microsoft"

#

# Then to change the language, change the Layout setting.

# For example, a german layout can be obtained with:

#    Option "XkbLayout"   "de"

# or:

#    Option "XkbLayout"   "de"

#    Option "XkbVariant"  "nodeadkeys"

#

# If you'd like to switch the positions of your capslock and

# control keys, use:

#    Option "XkbOptions"  "ctrl:swapcaps"

# These are the default XKB settings for XFree86

#    Option "XkbRules"    "xfree86"

#    Option "XkbModel"    "pc101"

#    Option "XkbLayout"   "us"

#    Option "XkbVariant"  ""

#    Option "XkbOptions"  ""

#    Option "XkbDisable"

    Option "XkbRules"   "xfree86"

    Option "XkbModel"   "pc105"

    Option "XkbLayout"   "de"

EndSection

# **********************************************************************

# Core Pointer's InputDevice section

# **********************************************************************

Section "InputDevice"

# Identifier and driver

    Identifier   "Mouse1"

    Driver   "mouse"

    Option "Protocol"    "Auto"

    Option "Device"      "/dev/mouse"

    Option "ZAxisMapping"       "4 5"

# Mouse-speed setting for PS/2 mouse.

#    Option "Resolution"   "256"

# When using XQUEUE, comment out the above two lines, and uncomment

# the following line.

#    Option "Protocol"   "Xqueue"

# Baudrate and SampleRate are only for some Logitech mice. In

# almost every case these lines should be omitted.

#    Option "BaudRate"   "9600"

#    Option "SampleRate"   "150"

# Emulate3Buttons is an option for 2-button Microsoft mice

# Emulate3Timeout is the timeout in milliseconds (default is 50ms)

#    Option "Emulate3Buttons"

#    Option "Emulate3Timeout"    "50"

# ChordMiddle is an option for some 3-button Logitech mice

#    Option "ChordMiddle"

EndSection

# **********************************************************************

# Other input device sections 

# this is optional and is required only if you

# are using extended input devices.  This is for example only.  Refer

# to the XF86Config man page for a description of the options.

# **********************************************************************

#

# Section "InputDevice" 

#    Identifier  "Mouse2"

#    Driver      "mouse"

#    Option      "Protocol"      "MouseMan"

#    Option      "Device"        "/dev/mouse2"

# EndSection

#

# Section "InputDevice"

#    Identifier "spaceball"

#    Driver     "magellan"

#    Option     "Device"        "/dev/cua0"

# EndSection

#

# Section "InputDevice"

#    Identifier "spaceball2"

#    Driver     "spaceorb"

#    Option     "Device"        "/dev/cua0"

# EndSection

#

# Section "InputDevice"

#    Identifier "touchscreen0"

#    Driver     "microtouch"

#    Option     "Device"        "/dev/ttyS0"

#    Option     "MinX"          "1412"

#    Option     "MaxX"          "15184"

#    Option     "MinY"          "15372"

#    Option     "MaxY"          "1230"

#    Option     "ScreenNumber"  "0"

#    Option     "ReportingMode" "Scaled"

#    Option     "ButtonNumber"  "1"

#    Option     "SendCoreEvents"

# EndSection

#

# Section "InputDevice"

#    Identifier "touchscreen1"

#    Driver     "elo2300"

#    Option     "Device"        "/dev/ttyS0"

#    Option     "MinX"          "231"

#    Option     "MaxX"          "3868"

#    Option     "MinY"          "3858"

#    Option     "MaxY"          "272"

#    Option     "ScreenNumber"  "0"

#    Option     "ReportingMode" "Scaled"

#    Option     "ButtonThreshold"       "17"

#    Option     "ButtonNumber"  "1"

#    Option     "SendCoreEvents"

# EndSection

# **********************************************************************

# Monitor section

# **********************************************************************

# Any number of monitor sections may be present

Section "Monitor"

    Identifier  "Highscreen MS 1795PII"

# HorizSync is in kHz unless units are specified.

# HorizSync may be a comma separated list of discrete values, or a

# comma separated list of ranges of values.

# NOTE: THE VALUES HERE ARE EXAMPLES ONLY.  REFER TO YOUR MONITOR'S

# USER MANUAL FOR THE CORRECT NUMBERS.

    HorizSync   30-86

#    HorizSync   30-64         # multisync

#    HorizSync   31.5, 35.2    # multiple fixed sync frequencies

#    HorizSync   15-25, 30-50  # multiple ranges of sync frequencies

# VertRefresh is in Hz unless units are specified.

# VertRefresh may be a comma separated list of discrete values, or a

# comma separated list of ranges of values.

# NOTE: THE VALUES HERE ARE EXAMPLES ONLY.  REFER TO YOUR MONITOR'S

# USER MANUAL FOR THE CORRECT NUMBERS.

    VertRefresh 50-150

EndSection

# **********************************************************************

# Graphics device section

# **********************************************************************

# Any number of graphics device sections may be present

# Standard VGA Device:

#Section "Device"

#    Identifier   "Standard VGA"

#    VendorName   "Unknown"

#    BoardName   "Unknown"

# The chipset line is optional in most cases.  It can be used to override

# the driver's chipset detection, and should not normally be specified.

#    Chipset   "generic"

# The Driver line must be present.  When using run-time loadable driver

# modules, this line instructs the server to load the specified driver

# module.  Even when not using loadable driver modules, this line

# indicates which driver should interpret the information in this section.

#    Driver     "vga"

# The BusID line is used to specify which of possibly multiple devices

# this section is intended for.  When this line isn't present, a device

# section can only match up with the primary video device.  For PCI

# devices a line like the following could be used.  This line should not

# normally be included unless there is more than one video device

# intalled.

#    BusID      "PCI:0:10:0"

#    VideoRam   256

#    Clocks   25.2 28.3

#EndSection

# Device configured by xf86config:

Section "Device"

    Identifier  "GeForce 2MX 32MB"

    Driver      "nv"

    #VideoRam    32768

    # Insert Clocks lines here if appropriate

EndSection

# **********************************************************************

# Screen sections

# **********************************************************************

# Any number of screen sections may be present.  Each describes

# the configuration of a single screen.  A single specific screen section

# may be specified from the X server command line with the "-screen"

# option.

Section "Screen"

    Identifier  "Screen 1"

    Device      "GeForce 2MX 32MB"

    Monitor     "Highscreen MS 1795PII"

    DefaultDepth 24

    Subsection "Display"

        Depth       8

        Modes       "1024x768" "800x600" "640x480"

        ViewPort    0 0

    EndSubsection

    Subsection "Display"

        Depth       16

        Modes       "1024x768" "800x600" "640x480"

        ViewPort    0 0

    EndSubsection

    Subsection "Display"

        Depth       24

        Modes       "1024x768" "800x600" "640x480"

        ViewPort    0 0

    EndSubsection

EndSection

# **********************************************************************

# ServerLayout sections.

# **********************************************************************

# Any number of ServerLayout sections may be present.  Each describes

# the way multiple screens are organised.  A specific ServerLayout

# section may be specified from the X server command line with the

# "-layout" option.  In the absence of this, the first section is used.

# When now ServerLayout section is present, the first Screen section

# is used alone.

Section "ServerLayout"

# The Identifier line must be present

    Identifier  "Simple Layout"

# Each Screen line specifies a Screen section name, and optionally

# the relative position of other screens.  The four names after

# primary screen name are the screens to the top, bottom, left and right

# of the primary screen.  In this example, screen 2 is located to the

# right of screen 1.

    Screen "Screen 1"

# Each InputDevice line specifies an InputDevice section name and

# optionally some options to specify the way the device is to be

# used.  Those options include "CorePointer", "CoreKeyboard" and

# "SendCoreEvents".

    InputDevice "Mouse1" "CorePointer"

    InputDevice "Keyboard1" "CoreKeyboard"

EndSection

# Section "DRI"

#    Mode 0666

# EndSection

```

----------

## JensZ

wie startest du X über den XDM oder per startx von der console?

----------

## mrsteven

startx

----------

## JensZ

Hmm da würd ich mal auf den Mailing listen von XFree gehen, das

kann eigentlich nicht richtig sein, würdest du den Framebuffer auch unter

X nutzen wär das ja in ordnung, aber so...

----------

## mrsteven

Hmm, weil ich den Framebuffer sowieso nur für meine große Konsole brauche, kann ich ja eigentlich das device löschen. Wie macht man das bei devfs, ohne das das Teil gleich wieder erscheint?

----------

