drivers/: Multiple Drivers Are Registered With World Writable - Part 2

Permissions (Part 2)

Description:

In kernel builds, any unprivileged process running on the NuttX
device can open /dev/efuse and attempt to read/write fuse content.
Reading the fuses may provide valuable information to an attacker
controlling the user process. The write operation, in extreme cases
where the fuse blocks are not locked, may brick the device.

DISCLAIMER: I tried to be strict with the settings, better to relax them
later if it's needed.

This is part of https://github.com/apache/nuttx/issues/19410

See https://github.com/apache/nuttx/issues/19410

Compiles ok.

Signed-off-by: Catalin Visinescu <catalin_visinescu@yahoo.com>

arch/xtensa/src/common/espressif/esp_dedic_gpio.c

@@ -684,7 +684,7 @@ struct file *esp_dedic_gpio_new_bundle(
   dedic_gpio_common[cpu].refs++;
 
   register_driver(config->path, &dedic_gpio_ops,
-                  0666, priv);
+                  0600, priv);
   return (struct file *)priv;
 }
 

arch/xtensa/src/common/espressif/esp_nxdiag.c

@@ -313,7 +313,7 @@ static ssize_t esp_nxdiag_read(struct file *filep,
 
 static int esp_nxdiag_register(void)
 {
-  return register_driver("/dev/nxdiag", &g_nxdiagops, 0440, NULL);
+  return register_driver("/dev/nxdiag", &g_nxdiagops, 0400, NULL);
 }
 
 /****************************************************************************

arch/xtensa/src/common/espressif/esp_temperature_sensor.c

@@ -415,7 +415,7 @@ static void esp_temp_sensor_register(struct esp_temp_priv_s *priv)
 {
 #ifndef CONFIG_ESPRESSIF_TEMP_UORB
   register_driver(CONFIG_ESPRESSIF_TEMP_PATH, &g_esp_temp_sensor_fops,
-                  0666, priv);
+                  0600, priv);
 #else
   priv->lower.type = SENSOR_TYPE_TEMPERATURE;
   sensor_register(&priv->lower, CONFIG_ESPRESSIF_TEMP_PATH_DEVNO);

boards/arm/cxd56xx/drivers/sensors/ak09912_scu.c

@@ -556,7 +556,7 @@ int ak09912_scu_register(const char *devpath, int minor,
   /* Register the character driver */
 
   snprintf(path, sizeof(path), "%s%d", devpath, minor);
-  ret = register_driver(path, &g_ak09912fops, 0660, priv);
+  ret = register_driver(path, &g_ak09912fops, 0640, priv);
   if (ret < 0)
     {
       snerr("Failed to register driver: %d\n", ret);

boards/arm/cxd56xx/drivers/sensors/bm1383glv_scu.c

@@ -541,7 +541,7 @@ int bm1383glv_register(const char *devpath, int minor,
   /* Register the character driver */
 
   snprintf(path, sizeof(path), "%s%d", devpath, minor);
-  ret = register_driver(path, &g_bm1383glvfops, 0660, priv);
+  ret = register_driver(path, &g_bm1383glvfops, 0640, priv);
   if (ret < 0)
     {
       snerr("Failed to register driver: %d\n", ret);

boards/arm/cxd56xx/drivers/sensors/bm1422gmv_scu.c

@@ -525,7 +525,7 @@ int bm1422gmv_register(const char *devpath, int minor,
   /* Register the character driver */
 
   snprintf(path, sizeof(path), "%s%d", devpath, minor);
-  ret = register_driver(path, &g_bm1422gmvfops, 0660, priv);
+  ret = register_driver(path, &g_bm1422gmvfops, 0640, priv);
   if (ret < 0)
     {
       snerr("Failed to register driver: %d\n", ret);

boards/arm/samv7/common/src/sam_progmem.c

@@ -79,7 +79,7 @@ static int sam_progmem_register_driver(int minor, struct mtd_dev_s *mtd,
 
   /* Register the MTD driver */
 
-  ret = register_mtddriver(devpath, mtd, 0755, NULL);
+  ret = register_mtddriver(devpath, mtd, 0750, NULL);
   if (ret < 0)
     {
       ferr("ERROR: register_mtddriver %s failed: %d\n", devpath, ret);

boards/arm/stm32l1/stm32ldiscovery/src/stm32_lcd.c

@@ -1584,7 +1584,7 @@ int stm32_slcd_initialize(void)
 
       /* Register the LCD device driver */
 
-      ret = register_driver("/dev/slcd0", &g_slcdops, 0644, &g_slcdstate);
+      ret = register_driver("/dev/slcd0", &g_slcdops, 0640, &g_slcdstate);
       g_slcdstate.initialized = true;
 
       /* Then clear the display */

boards/mips/pic32mx/pic32mx7mmb/src/pic32_touchscreen.c

@@ -1371,7 +1371,7 @@ int pic32mx_tsc_setup(int minor)
   snprintf(devname, sizeof(devname), DEV_FORMAT, minor);
   iinfo("Registering %s\n", devname);
 
-  ret = register_driver(devname, &g_tc_fops, 0660, priv);
+  ret = register_driver(devname, &g_tc_fops, 0640, priv);
   if (ret < 0)
     {
       ierr("ERROR: register_driver() failed: %d\n", ret);

boards/mips/pic32mx/sure-pic32mx/src/pic32mx_lcd1602.c

@@ -1076,7 +1076,7 @@ int up_lcd1602_initialize(void)
 
       /* Register the LCD device driver */
 
-      ret = register_driver("/dev/lcd1602", &g_lcdops, 0644, &g_lcd1602);
+      ret = register_driver("/dev/lcd1602", &g_lcdops, 0640, &g_lcd1602);
       g_lcd1602.initialized = true;
     }
 

drivers/coresight/coresight_etb.c

@@ -463,7 +463,7 @@ etb_register(FAR const struct coresight_desc_s *desc)
     }
 
   snprintf(pathname, sizeof(pathname), "/dev/%s", desc->name);
-  ret = register_driver(pathname, &g_etb_fops, 0444, etbdev);
+  ret = register_driver(pathname, &g_etb_fops, 0400, etbdev);
   if (ret < 0)
     {
       cserr("%s:driver register failed\n", desc->name);

drivers/coresight/coresight_tmc_etf.c

@@ -511,7 +511,7 @@ int tmc_etf_register(FAR struct coresight_tmc_dev_s * tmcdev,
         }
 
       snprintf(pathname, sizeof(pathname), "/dev/%s", desc->name);
-      ret = register_driver(pathname, &g_tmc_fops, 0444, tmcdev);
+      ret = register_driver(pathname, &g_tmc_fops, 0400, tmcdev);
       if (ret < 0)
         {
           cserr("%s:driver register failed\n", desc->name);

drivers/i3c/i3c_driver.c

@@ -384,7 +384,7 @@ int i3c_register(FAR struct i3c_master_controller *master, int bus)
   /* Create the character device name */
 
   snprintf(devname, sizeof(devname), DEVNAME_FMT, bus);
-  ret = register_driver(devname, &g_i3cdrvr_fops, 0666, priv);
+  ret = register_driver(devname, &g_i3cdrvr_fops, 0600, priv);
   if (ret < 0)
     {
       /* Free the device structure if we failed to create the character

drivers/input/ads7843e.c

@@ -1166,7 +1166,7 @@ int ads7843e_register(FAR struct spi_dev_s *spi,
   snprintf(devname, sizeof(devname), DEV_FORMAT, minor);
   iinfo("Registering %s\n", devname);
 
-  ret = register_driver(devname, &g_ads7843e_fops, 0666, priv);
+  ret = register_driver(devname, &g_ads7843e_fops, 0600, priv);
   if (ret < 0)
     {
       ierr("ERROR: register_driver() failed: %d\n", ret);

drivers/input/ajoystick.c

@@ -730,7 +730,7 @@ int ajoy_register(FAR const char *devname,
 
   /* And register the ajoystick driver */
 
-  ret = register_driver(devname, &g_ajoy_fops, 0666, priv);
+  ret = register_driver(devname, &g_ajoy_fops, 0600, priv);
   if (ret < 0)
     {
       ierr("ERROR: register_driver failed: %d\n", ret);

drivers/input/button_upper.c

@@ -810,7 +810,7 @@ int btn_register(FAR const char *devname,
 
   /* And register the button driver */
 
-  ret = register_driver(devname, &g_btn_fops, 0666, priv);
+  ret = register_driver(devname, &g_btn_fops, 0600, priv);
   if (ret < 0)
     {
       ierr("ERROR: register_driver failed: %d\n", ret);

drivers/input/cypress_mbr3108.c

@@ -1105,7 +1105,7 @@ cypress_mbr3108_register(FAR const char *devpath,
 
   nxmutex_init(&priv->devlock);
 
-  ret = register_driver(devpath, &g_mbr3108_fileops, 0666, priv);
+  ret = register_driver(devpath, &g_mbr3108_fileops, 0600, priv);
   if (ret < 0)
     {
       nxmutex_destroy(&priv->devlock);

drivers/input/djoystick.c

@@ -721,7 +721,7 @@ int djoy_register(FAR const char *devname,
 
   /* And register the djoystick driver */
 
-  ret = register_driver(devname, &g_djoy_fops, 0666, priv);
+  ret = register_driver(devname, &g_djoy_fops, 0600, priv);
   if (ret < 0)
     {
       ierr("ERROR: register_driver failed: %d\n", ret);

drivers/input/ff_upper.c

@@ -543,7 +543,7 @@ int ff_register(FAR struct ff_lowerhalf_s *lower, FAR const char *path,
   upper->effects     = (FAR struct ff_effect_s *)(upper + 1);
   nxmutex_init(&upper->lock);
 
-  ret = register_driver(path, &g_ff_fops, 0666, upper);
+  ret = register_driver(path, &g_ff_fops, 0600, upper);
   if (ret < 0)
     {
       nxmutex_destroy(&upper->lock);

drivers/input/gt9xx.c

@@ -931,7 +931,7 @@ int gt9xx_register(FAR const char *devpath,
 
   /* Register the Touch Input Driver */
 
-  ret = register_driver(devpath, &g_gt9xx_fileops, 0666, priv);
+  ret = register_driver(devpath, &g_gt9xx_fileops, 0600, priv);
   if (ret < 0)
     {
       nxmutex_destroy(&priv->devlock);

drivers/input/keyboard_upper.c

@@ -347,7 +347,7 @@ int keyboard_register(FAR struct keyboard_lowerhalf_s *lower,
   list_initialize(&upper->head);
   nxmutex_init(&upper->lock);
 
-  ret = register_driver(path, &g_keyboard_fops, 0666, upper);
+  ret = register_driver(path, &g_keyboard_fops, 0600, upper);
   if (ret < 0)
     {
       nxmutex_destroy(&upper->lock);

drivers/input/max11802.c

@@ -1200,7 +1200,7 @@ int max11802_register(FAR struct spi_dev_s *spi,
   snprintf(devname, sizeof(devname), DEV_FORMAT, minor);
   iinfo("Registering %s\n", devname);
 
-  ret = register_driver(devname, &g_max11802_fops, 0666, priv);
+  ret = register_driver(devname, &g_max11802_fops, 0600, priv);
   if (ret < 0)
     {
       ierr("ERROR: register_driver() failed: %d\n", ret);

drivers/input/mouse_upper.c

@@ -379,7 +379,7 @@ int mouse_register(FAR struct mouse_lowerhalf_s *lower,
   list_initialize(&upper->head);
   nxmutex_init(&upper->lock);
 
-  ret = register_driver(path, &g_mouse_fops, 0666, upper);
+  ret = register_driver(path, &g_mouse_fops, 0600, upper);
   if (ret < 0)
     {
       nxmutex_destroy(&upper->lock);

drivers/input/mxt.c

@@ -1883,7 +1883,7 @@ int mxt_register(FAR struct i2c_master_s *i2c,
   snprintf(devname, sizeof(devname), DEV_FORMAT, minor);
   iinfo("Registering %s\n", devname);
 
-  ret = register_driver(devname, &g_mxt_fops, 0666, priv);
+  ret = register_driver(devname, &g_mxt_fops, 0600, priv);
   if (ret < 0)
     {
       ierr("ERROR: register_driver() failed: %d\n", ret);

drivers/input/nunchuck.c

@@ -564,7 +564,7 @@ int nunchuck_register(FAR const char *devname, FAR struct i2c_master_s *i2c)
 
   /* And register the nunchuck driver */
 
-  ret = register_driver(devname, &g_nunchuck_fops, 0666, priv);
+  ret = register_driver(devname, &g_nunchuck_fops, 0600, priv);
   if (ret < 0)
     {
       ierr("ERROR: register_driver failed: %d\n", ret);

drivers/input/spq10kbd.c

@@ -1032,7 +1032,7 @@ int spq10kbd_register(FAR struct i2c_master_s *i2c,
 
   snprintf(kbddevname, sizeof(kbddevname), DEV_FORMAT, kbdminor);
   iinfo("Registering %s\n", kbddevname);
-  ret = register_driver(kbddevname, &g_hidkbd_fops, 0666, priv);
+  ret = register_driver(kbddevname, &g_hidkbd_fops, 0600, priv);
 
 #ifdef CONFIG_SPQ10KBD_DJOY
   iinfo("Registering %s\n", joydevname);

drivers/input/stmpe811_tsc.c

@@ -904,7 +904,7 @@ int stmpe811_register(STMPE811_HANDLE handle, int minor)
   /* Register the character driver */
 
   snprintf(devname, sizeof(devname), DEV_FORMAT, minor);
-  ret = register_driver(devname, &g_stmpe811fops, 0666, priv);
+  ret = register_driver(devname, &g_stmpe811fops, 0600, priv);
   if (ret < 0)
     {
       ierr("ERROR: Failed to register driver %s: %d\n", devname, ret);

drivers/input/touchscreen_upper.c

@@ -492,7 +492,7 @@ int touch_register(FAR struct touch_lowerhalf_s *lower,
   list_initialize(&upper->head);
   nxmutex_init(&upper->lock);
 
-  ret = register_driver(path, &g_touch_fops, 0666, upper);
+  ret = register_driver(path, &g_touch_fops, 0600, upper);
   if (ret < 0)
     {
       nxmutex_destroy(&upper->lock);

drivers/input/tsc2007.c

@@ -1247,7 +1247,7 @@ int tsc2007_register(FAR struct i2c_master_s *dev,
   snprintf(devname, sizeof(devname), DEV_FORMAT, minor);
   iinfo("Registering %s\n", devname);
 
-  ret = register_driver(devname, &g_tsc2007_fops, 0666, priv);
+  ret = register_driver(devname, &g_tsc2007_fops, 0600, priv);
   if (ret < 0)
     {
       ierr("ERROR: register_driver() failed: %d\n", ret);

drivers/ioexpander/gpio.c

@@ -791,7 +791,7 @@ int gpio_pin_register_byname(FAR struct gpio_dev_s *dev,
 
   gpioinfo("Registering %s\n", devname);
 
-  return register_driver(devname, &g_gpio_drvrops, 0666, dev);
+  return register_driver(devname, &g_gpio_drvrops, 0600, dev);
 }
 
 /****************************************************************************

drivers/ipcc/ipcc_register.c

@@ -167,7 +167,7 @@ int ipcc_register(FAR struct ipcc_lower_s *ipcc)
   /* Create the character device name */
 
   snprintf(devname, sizeof(devname), DEVNAME_FMT, ipcc->chan);
-  if ((ret = register_driver(devname, &g_ipcc_fops, 0666, priv)))
+  if ((ret = register_driver(devname, &g_ipcc_fops, 0600, priv)))
     {
       goto error;
     }

drivers/lcd/ft80x.c

@@ -1575,7 +1575,7 @@ int ft80x_register(FAR struct i2c_master_s *i2c,
 
   /* Register the FT80x character driver */
 
-  ret = register_driver(DEVNAME, &g_ft80x_fops, 0666, priv);
+  ret = register_driver(DEVNAME, &g_ft80x_fops, 0600, priv);
   if (ret < 0)
     {
       goto errout_with_interrupts;

drivers/lcd/ht16k33_14seg.c

@@ -1094,7 +1094,7 @@ int ht16k33_register(int devno, FAR struct i2c_master_s *i2c)
 
   /* Register the driver */
 
-  ret = register_driver(devname, &g_ht16k33fops, 0666, priv);
+  ret = register_driver(devname, &g_ht16k33fops, 0600, priv);
   if (ret < 0)
     {
       snerr("ERROR: Failed to register driver: %d\n", ret);

drivers/lcd/lcd_dev.c

@@ -443,7 +443,7 @@ int lcddev_register(int devno)
     }
 
   snprintf(devname, sizeof(devname), "/dev/lcd%i", devno);
-  ret = register_driver(devname, &g_lcddev_fops, 0666, priv);
+  ret = register_driver(devname, &g_lcddev_fops, 0600, priv);
   if (ret < 0)
     {
       goto err;

drivers/lcd/pcf8574_lcd_backpack.c

@@ -1632,7 +1632,7 @@ int pcf8574_lcd_backpack_register(FAR const char *devpath,
 
   /* Register the character driver */
 
-  ret = register_driver(devpath, &g_pcf8574_lcd_fops, 0666, priv);
+  ret = register_driver(devpath, &g_pcf8574_lcd_fops, 0600, priv);
   if (ret < 0)
     {
       lcdinfo("Failed to register driver: %d\n", ret);

drivers/lcd/st7032.c

@@ -1020,7 +1020,7 @@ int st7032_register(FAR const char *devpath, FAR struct i2c_master_s *i2c)
 
   /* Register the driver */
 
-  ret = register_driver(devpath, &g_st7032fops, 0666, priv);
+  ret = register_driver(devpath, &g_st7032fops, 0600, priv);
   if (ret < 0)
     {
       snerr("ERROR: Failed to register driver: %d\n", ret);

drivers/lcd/tda19988.c

@@ -1682,7 +1682,7 @@ TDA19988_HANDLE tda19988_register(FAR const char *devpath,
 
   /* Register the driver */
 
-  ret = register_driver(devpath, &g_tda19988_fops, 0666, NULL);
+  ret = register_driver(devpath, &g_tda19988_fops, 0600, NULL);
   if (ret < 0)
     {
       lcderr("ERROR: register_driver() failed: %d\n", ret);

drivers/leds/apa102.c

@@ -249,7 +249,7 @@ int apa102_register(FAR const char *devpath, FAR struct spi_dev_s *spi)
 
   /* Register the character driver */
 
-  ret = register_driver(devpath, &g_apa102fops, 0666, priv);
+  ret = register_driver(devpath, &g_apa102fops, 0600, priv);
   if (ret < 0)
     {
       snerr("ERROR: Failed to register driver: %d\n", ret);

drivers/leds/ktd2052.c

@@ -741,7 +741,7 @@ int ktd2052_register(FAR const char *devpath, FAR struct i2c_master_s *i2c,
 
   /* Register the character driver */
 
-  ret = register_driver(devpath, &g_ktd2052_fops, 0666, priv);
+  ret = register_driver(devpath, &g_ktd2052_fops, 0600, priv);
   if (ret < 0)
     {
       kmm_free(priv);

drivers/leds/lp503x.c

@@ -947,7 +947,7 @@ int lp503x_register(const char *devpath, struct i2c_master_s *i2c,
 
   /* Register the character driver */
 
-  ret = register_driver(devpath, &g_lp503x_fileops, 0222, priv);
+  ret = register_driver(devpath, &g_lp503x_fileops, 0200, priv);
   if (ret != OK)
     {
       lederr("ERROR: Failed to register driver: %d\n", ret);

drivers/leds/max7219.c

@@ -349,7 +349,7 @@ int max7219_leds_register(FAR const char *devpath, FAR struct spi_dev_s *spi)
 
   /* Register the character driver */
 
-  ret = register_driver(devpath, &g_max7219fops, 0666, priv);
+  ret = register_driver(devpath, &g_max7219fops, 0600, priv);
   if (ret < 0)
     {
       lederr("ERROR: Failed to register driver: %d\n", ret);

drivers/leds/ncp5623c.c

@@ -284,7 +284,7 @@ int ncp5623c_register(FAR const char *devpath, FAR struct i2c_master_s *i2c,
 
   /* Register the character driver */
 
-  int const ret = register_driver(devpath, &g_ncp5623c_fileops, 0666, priv);
+  int const ret = register_driver(devpath, &g_ncp5623c_fileops, 0600, priv);
   if (ret != OK)
     {
       lcderr("ERROR: Failed to register driver: %d\n", ret);

drivers/leds/pca9635pw.c

@@ -356,7 +356,7 @@ int pca9635pw_register(FAR const char *devpath, FAR struct i2c_master_s *i2c,
 
   /* Register the character driver */
 
-  int const ret = register_driver(devpath, &g_pca9635pw_fileops, 0222, priv);
+  int const ret = register_driver(devpath, &g_pca9635pw_fileops, 0200, priv);
   if (ret != OK)
     {
       lcderr("ERROR: Failed to register driver: %d\n", ret);

drivers/leds/rgbled.c

@@ -496,7 +496,7 @@ int rgbled_register(FAR const char *path, FAR struct pwm_lowerhalf_s *ledr,
   /* Register the PWM device */
 
   lcdinfo("Registering %s\n", path);
-  return register_driver(path, &g_rgbledops, 0666, upper);
+  return register_driver(path, &g_rgbledops, 0600, upper);
 }
 
 #endif /* CONFIG_RGBLED */

drivers/leds/userled_upper.c

@@ -550,7 +550,7 @@ int userled_register(FAR const char *devname,
 
   /* And register the LED driver */
 
-  ret = register_driver(devname, &g_userled_fops, 0666, priv);
+  ret = register_driver(devname, &g_userled_fops, 0600, priv);
   if (ret < 0)
     {
       lederr("ERROR: register_driver failed: %d\n", ret);

drivers/leds/ws2812.c

@@ -614,7 +614,7 @@ int ws2812_register(FAR const char          *dev_path,
 {
   /* Register the character driver */
 
-  int ret = register_driver(dev_path, &g_ws2812fops, 0666, dev_data);
+  int ret = register_driver(dev_path, &g_ws2812fops, 0600, dev_data);
   if (ret < 0)
     {
       lederr("ERROR: Failed to register ws2812 driver: %d\n", ret);
@@ -685,7 +685,7 @@ int ws2812_leds_register(FAR const char *devpath, FAR struct spi_dev_s *spi,
 
   /* Register the character driver */
 
-  ret = register_driver(devpath, &g_ws2812fops, 0666, priv);
+  ret = register_driver(devpath, &g_ws2812fops, 0600, priv);
   if (ret < 0)
     {
       lederr("ERROR: Failed to register driver: %d\n", ret);

drivers/loop/loop.c

@@ -168,7 +168,7 @@ static int loop_ioctl(FAR struct file *filep, int cmd, unsigned long arg)
 
 void loop_register(void)
 {
-  register_driver("/dev/loop", &g_loop_fops, 0666, NULL);
+  register_driver("/dev/loop", &g_loop_fops, 0600, NULL);
 }
 
 #endif /* CONFIG_DEV_LOOP */

drivers/math/math.c

@@ -220,7 +220,7 @@ int math_register(FAR const char *path,
 
   /* Register the math timer device */
 
-  ret = register_driver(path, &g_math_ops, 0666, upper);
+  ret = register_driver(path, &g_math_ops, 0600, upper);
   if (ret < 0)
     {
       _err("register math driver failed: %d\n", ret);

drivers/misc/dev_ascii.c

@@ -137,5 +137,5 @@ static int devascii_poll(FAR struct file *filep, FAR struct pollfd *fds,
 
 void devascii_register(void)
 {
-  register_driver("/dev/ascii", &g_devascii_fops, 0666, NULL);
+  register_driver("/dev/ascii", &g_devascii_fops, 0644, NULL);
 }

drivers/misc/dev_mem.c

@@ -198,5 +198,5 @@ static int devmem_mmap(FAR struct file *filep,
 int devmem_register(void)
 {
   return register_driver("/dev/mem", &g_devmem_fops,
-                         0666, (FAR void *)g_memory_region);
+                         0600, (FAR void *)g_memory_region);
 }