helpdmidecode - Support: sr #109063, Access for non-root users

 
 

sr #109063: Access for non-root users

Submitted by:  None
Submitted on:  Tue 07 Jun 2016 06:09:04 AM UTC  
Votes:  100  
 
Category: NonePriority: 5 - Normal
Severity: 3 - NormalStatus: Confirmed
Privacy: PublicAssigned to: None
Originator Email: -unavailable-Open/Closed: Open
Operating System: GNU/Linux

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 08 Nov 2016 08:48:05 AM UTC, comment #4:

This is certainly a possibility. I don't know anything about D-Bus and I have no time to devote to this task, though, so I'm not going to do it. If you want it to happen, you'll have to do it yourself, or find someone else interested in working on this project.

Note that there is no such thing as a "default command line program". Everyone can use whatever command they prefer for the task at hand. If you want them to use your program, you have to make it better than the competition.

Jean Delvare <khali>
Project Administrator
Tue 08 Nov 2016 12:03:44 AM UTC, comment #3:

What about creating an as-root D-Bus service, then making the default command line program one which queries the service. The response to D-Bus queries could vary based on if the requester is root or not. Or the client could have to request the info one field at a time, and the server could refuse to give info on certain sensitive fields for non-root requesters.

Matthew Cline <matthew_cline>
Thu 30 Jun 2016 12:51:24 PM UTC, comment #2:

BTW, the group and permissions of sysfs files are boot-time defaults. If you want to let non-root users access all the DMI information, you could change the permissions of files under /sys/firmware/dmi/tables to 444 (or set the group to something meaningful for your system, and set the permissions to 440) in some init script.

Jean Delvare <khali>
Project Administrator
Thu 30 Jun 2016 10:16:08 AM UTC, comment #1:

Well, actually /sys/devices/virtual/dmi/id was created exactly for this purpose: let non-root users access the most popular DMI strings.

Dmidecode currently reads the DMI data from either /dev/mem or /sys/firmware/dmi/tables. Both are restricted to root, by the kernel. There is nothing dmidecode itself can do about that.

Adding support to let dmidecode read from /sys/devices/virtual/dmi/id would make no technical sense. For one thing, dmidecode expected a raw (undecoded) DMI table as its input. Having to parse arbitrary text files would require a significant amount of totally new code. For another, there isn't enough information there to rebuild a DMI table anyway. The information would be so partial that I doubt anyone would be interested. If you want to collect as much information as possible, this is a shell one-liner:

(cd /sys/devices/virtual/dmi/id && grep . * 2> /dev/null)

If you really want dmidecode to be usable as non-root, the only sane approach I can think of would be to make files under /sys/firmware/dmi/tables world-readable and let the kernel obfuscate the sensitive information for non-root. However it may be tricky to define "sensitive" in this context. At the moment, UUIDs and serial numbers are considered sensitive. But if we expose the whole table, then things like OEM-specific entries or fields might as well contain sensitive information.

Jean Delvare <khali>
Project Administrator
Tue 07 Jun 2016 06:09:04 AM UTC, original submission:

Hello ! I am writing in to request a feature enhancement. Currently, as far as I can tell, dmidecode always requires root privileges to gather all the information about the system. It would be fantastic to have the option to run the tool as a non-root user and gather as much information dmidecode can provide as that user is granted. (and alos annotating the information which is not provided due to read level access to parts of the server)

Can you provide this option for users who don't have root access? This would help admins avoid building custom scripts to scan things like Linux's "/sys/devices/virtual/dmi/id".

Thanks,
Bryant

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by matthew_cline (Posted a comment)
  • -unavailable- added by matthew_cline (Voted in favor of this item)
  • -unavailable- added by khali (Posted a comment)
  • -unavailable- added by None (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 100 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 08 Nov 2016 08:48:05 AM UTCkhaliAssigned tokhali=>None
    Tue 08 Nov 2016 12:03:44 AM UTCmatthew_clineCarbon-Copy-=>Added matthew_cline
    Thu 30 Jun 2016 10:16:08 AM UTCkhaliStatusNone=>Confirmed
      Assigned toNone=>khali

    Back to the top


    Powered by Savane 3.1-cleanup1