user processes given direct access to I/O ports

[zodiac]

Hi all,

Can any one give me examples of user processes that are given direct access to I/O ports ?

The only example which I know is X-server ,is there any other process ?

[menaka]

hai,
can any one help me about nagios configuration.At the end of the nagios configuration error will occur the following command /usr/local/nagios/etc/nagios.cfg.



error:unexpected EOF while looking for matching `"'

[Rubberman]

hai,
can any one help me about nagios configuration.At the end of the nagios configuration error will occur the following command /usr/local/nagios/etc/nagios.cfg.



error:unexpected EOF while looking for matching `"'

Please don't post new/unrelated questions in someone else's thread! Post this to a new thread, please!

[Rubberman]

Hi all,

Can any one give me examples of user processes that are given direct access to I/O ports ?

The only example which I know is X-server ,is there any other process ?

A program that accesses hardware I/O ports has to have root privileges. This is required by the operating system. You can do this if the application (not script) is owned by root and has the setuid bit set. Then, when it is run, it will be as a root process. This is not to be done without careful consideration as it leaves the system vulnerable to malware or just simple coding errors. You will note that the X server, /usr/bin/Xorg, is such an application, owned by root and has the setuid bit enabled.

[zodiac]

normally all I/O goes through the kernel so that it can schedule the operations and prevent processes from stepping on each other isn't it ?.

Does that mean that all programs with setuid bit set are allowed to slide around the kernel ???

[Rubberman]

A setuid bit with root permissions only allows the application, in user space, to access kernel functions via system calls that can potentially harm the system. Free access to I/O ports is one of those situations. As for "sliding around in the kernel", no this does not allow that. You would need to write a kernel module to do that, and only root has the privileges to add a module to the kernel. However, I suspect that if you enabled the setuid bit on modprobe, then you would be allowing anyone to link any module into the kernel, though I haven't tried that. From the security analysis perspective, it would be an interesting experiment.