From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752503AbcAEPor (ORCPT ); Tue, 5 Jan 2016 10:44:47 -0500 Received: from mail-io0-f170.google.com ([209.85.223.170]:33198 "EHLO mail-io0-f170.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752248AbcAEPom (ORCPT ); Tue, 5 Jan 2016 10:44:42 -0500 Subject: Re: [PATCH] Add possibility to set /dev/tty number To: Greg KH , Pierre Paul MINGOT References: <20160104154305.GA24533@kroah.com> <568AA47D.6010604@gmail.com> <20160104171121.GA25961@kroah.com> <568ABCBD.3070909@gmail.com> <20160105152547.GC7251@kroah.com> Cc: jslaby@suse.cz, linux-kernel@vger.kernel.org From: "Austin S. Hemmelgarn" Message-ID: <568BE4B1.5040501@gmail.com> Date: Tue, 5 Jan 2016 10:43:45 -0500 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.5.0 MIME-Version: 1.0 In-Reply-To: <20160105152547.GC7251@kroah.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-Antivirus: avast! (VPS 160105-0, 2016-01-05), Outbound message X-Antivirus-Status: Clean Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 2016-01-05 10:25, Greg KH wrote: > On Tue, Jan 05, 2016 at 09:51:14AM +0100, Pierre Paul MINGOT wrote: >> In industrial sector, for obvious security and safety reasons we want >> configure our system and have a full control of the devices within it. >> So unused or dummy devices are not wanted , not nice to have. >> One way to achieve this goal is to have a full picture of the devices >> in our system and then identified which type of applications can run >> and then safety or security potential risks. Base on this analysis we >> can put in place mandatory actions to fix the risks. >> An other interest for reduce dummy /dev devices is hot-plug device >> creation detection through inotify or udev. Indeed, we can configure >> udev or inotify for monitoring the /dev directory and notify watched >> dedicated events. lesser the devices in /dev is better the response >> is. This aspect is crucial for RTOS with very high time constraint >> near of microseconds. It's the case for example for a system with >> Linux RT Patch or Xenomai. > > I don't understand how reducing the number of vt devices makes anything > more or less secure, or better yet, more responsive. Please provide > specific details showing how this happens. WRT security, the argument isn't that it makes the system inherently more secure, but that it makes it easier to prove the system is secure because there are fewer unused device nodes in /dev that you need to explain. In a way, it's a different aspect of the argument that reducing the number of VT's makes /dev less cluttered. I don't personally agree with doing hardware auditing via /dev, but that's a separate discussion. As far as the argument about hot-plug overhead, that is an issue (albeit a very small one) because that's at least 30+ extra uevents for devices that will likely never be used, but it's only an issue during boot unless you're doing crazy stuff with allocating and freeing VT's all the time. My statement in my reply to this particular message still applies though, if you're _that_ timing constrained, you should be using a real RTOS (Linux can do RT, but it's not optimal for it, especially with any of the regularly used userspace implementations).