maindmidecode - Support: sr #109063, Access for non-root users

 
 

sr #109063: Access for non-root users

Submitter:  None
Submitted:  Tue 07 Jun 2016 06:09:04 AM UTC
Votes: 100
 
Category:  None Priority:  5 - Normal
Severity:  3 - Normal Status:  Confirmed
Privacy:  Public Assigned to:  None
Originator Email:  -email is unavailable- Open/Closed:  Open
Operating System:  GNU/Linux
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 08 Nov 2016 08:48:05 AM UTC, comment #4: 

This is certainly a possibility. I don't know anything about D-Bus and I have no time to devote to this task, though, so I'm not going to do it. If you want it to happen, you'll have to do it yourself, or find someone else interested in working on this project.

Note that there is no such thing as a "default command line program". Everyone can use whatever command they prefer for the task at hand. If you want them to use your program, you have to make it better than the competition.

Jean Delvare <khali>
Group administrator
Tue 08 Nov 2016 12:03:44 AM UTC, comment #3: 

What about creating an as-root D-Bus service, then making the default command line program one which queries the service.  The response to D-Bus queries could vary based on if the requester is root or not.  Or the client could have to request the info one field at a time, and the server could refuse to give info on certain sensitive fields for non-root requesters.

Matthew Cline <matthew_cline>
Thu 30 Jun 2016 12:51:24 PM UTC, comment #2: 

BTW, the group and permissions of sysfs files are boot-time defaults. If you want to let non-root users access all the DMI information, you could change the permissions of files under /sys/firmware/dmi/tables to 444 (or set the group to something meaningful for your system, and set the permissions to 440) in some init script.

Jean Delvare <khali>
Group administrator
Thu 30 Jun 2016 10:16:08 AM UTC, comment #1: 

Well, actually /sys/devices/virtual/dmi/id was created exactly for this purpose: let non-root users access the most popular DMI strings.

Dmidecode currently reads the DMI data from either /dev/mem or /sys/firmware/dmi/tables. Both are restricted to root, by the kernel. There is nothing dmidecode itself can do about that.

Adding support to let dmidecode read from /sys/devices/virtual/dmi/id would make no technical sense. For one thing, dmidecode expected a raw (undecoded) DMI table as its input. Having to parse arbitrary text files would require a significant amount of totally new code. For another, there isn't enough information there to rebuild a DMI table anyway. The information would be so partial that I doubt anyone would be interested. If you want to collect as much information as possible, this is a shell one-liner:

(cd /sys/devices/virtual/dmi/id && grep . * 2> /dev/null)

If you really want dmidecode to be usable as non-root, the only sane approach I can think of would be to make files under /sys/firmware/dmi/tables world-readable and let the kernel obfuscate the sensitive information for non-root. However it may be tricky to define "sensitive" in this context. At the moment, UUIDs and serial numbers are considered sensitive. But if we expose the whole table, then things like OEM-specific entries or fields might as well contain sensitive information.

Jean Delvare <khali>
Group administrator
Tue 07 Jun 2016 06:09:04 AM UTC, original submission:  

Hello !  I am writing in to request a feature enhancement.  Currently, as far as I can tell, dmidecode always requires root privileges to gather all the information about the system.  It would be fantastic to have the option to run the tool as a non-root user and gather as much information dmidecode can provide as that user is granted. (and alos annotating the information which is not provided due to read level access to parts of the server)

Can you provide this option for users who don't have root access?  This would help admins avoid building custom scripts to scan things like Linux's "/sys/devices/virtual/dmi/id".

Thanks,
Bryant

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by matthew_cline (Posted a comment)
  • -email is unavailable- added by matthew_cline (Voted in favor of this item)
  • -email is unavailable- added by khali (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)
  •  

    There are 100 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-11-08 khali Assigned tokhali None
    2016-11-08 matthew_cline Carbon-Copy- Added matthew_cline
    2016-06-30 khali StatusNone Confirmed
        Assigned toNone khali

    Back to the top

    Powered by Savane 3.13-3230.
    Corresponding source code