I/O privileges not obtained

[Ricky-Tigg]

Hello. I am attempting to get I/O privileges.

In host

$ hostnamectl | sed -n '8p;12p' | awk '$1=$1'
Operating System: Fedora Linux 44.20260805.0 (COSMIC Atomic)
Kernel: Linux 7.1.6-201.fc44.x86_64

In container

note: Toolbox container created by running 'toolbox create'

⬢ [...]$ cat /run/.containerenv \
| sed -n '1p;6p' | column
engine="podman-5.8.4"	rootless=1

Permanently added kernel argument 'iomem=relaxed' by running 'rpm-ostree kargs --append='iomem=relaxed'' then 'systemctl reboot'.

⬢ [...]$ cat /proc/cmdline
BOOT_IMAGE=(hd0,gpt2)/ostree/fedora-.../vmlinuz-7.1.6-201.fc44.x86_64
ostree=/ostree/boot.1/fedora/.../0 rhgb quiet root=UUID=... 
vconsole.keymap=fi rootflags=subvol=root rw iomem=relaxed

Dry run

⬢ [...]$ sudo flashprog -p internal | sed 2d
flashprog p1.5-97-gfda3d3f on Linux 7.1.6-201.fc44.x86_64 (x86_64)

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
ERROR: Could not get I/O privileges (Operation not permitted).
(...) If you are root, your kernel may still prevent access based
on security policies.
Error: Programmer initialization failed.

My kernel configuration would therefore not be appropriate to inhibit the function that prevents access to I/O. May I ask, do you happen to have a suggestion on this matter?

[Ricky-Tigg]

Since then. I am testing solely on traditional OS, and no longer in a container.

$ hostnamectl | sed -n '8p;12p' | awk '$1=$1'
Operating System: Fedora Linux 44 (Workstation Edition)
Kernel: Linux 7.1.8-200.fc44.x86_64

Parameters the kernel was compiled with that are relevant for this report:

$ grep ^CONFIG_.*DEVMEM.* /boot/config-$(uname -r)
CONFIG_NET_DEVMEM=y
CONFIG_DEVMEM=y
CONFIG_ARCH_HAS_DEVMEM_IS_ALLOWED=y
CONFIG_STRICT_DEVMEM=y
CONFIG_IO_STRICT_DEVMEM=y

In /etc/default/grub, keys strict-devmem=0, iomem=relaxed appended to parameter GRUB_CMDLINE_LINUX.

$ cat /proc/cmdline
BOOT_IMAGE=(hd0,gpt2)/vmlinuz-7.1.8-200.fc44.x86_64 root=UUID=(...) ro rootflags=subvol=root rhgb quiet strict-devmem=0 iomem=relaxed

Not yet the solution.

[i-c-o-n]

Hi @Ricky-Tigg,

ERROR: Could not get I/O privileges (Operation not permitted).

this message is about I/O ports, not MMIO (devmem). Are you getting the same error message without the container?

CONFIG_LOCK_DOWN_KERNEL_* may be related. You can also check the kernel log (dmesg) after running flashprog.

[Ricky-Tigg]

ERROR: Could not get I/O privileges (Operation not permitted).

Message I got in non virtualised machine and container.

$ grep ^CONFIG_LOCK_DOWN /boot/config-$(uname -r)
CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y

Now, with a new version.

$ sudo flashprog -p internal | sed '2d;$d'
flashprog p1.6-2-g6266292 on Linux 7.1.8-200.fc44.x86_64 (x86_64)

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
No DMI table found.
Found chipset "Intel Kaby Lake U w/ iHDCP2.2 Prem.".
Warning: BIOS region SMM protection is enabled!
Warning: Setting BIOS Control at 0xdc from 0xaa to 0x89 failed.
New value is 0xaa.
Enabling flash write... SPI Configuration is locked down.
FREG0: Flash Descriptor region (0x00000000-0x00000fff) is read-only.
FREG2: Management Engine region (0x00001000-0x001fffff) is read-only.
Not all flash regions are freely accessible by flashprog. This is most likely
due to an active ME. Please see https://flashprog.org/ME for details.
Enabling hardware sequencing because some important opcode is locked.
At least some flash regions are write protected. For write operations,
you should use a flash layout and include only writable regions. See
manpage for more details.
PROBLEMS, continuing anyway
Using Programmer flash chip "Opaque flash chip" (8192 kB, Programmer-specific) on internal.

note: 404 message reported against the https://flashprog.org/ME URL that is in output

Logs

While running this program

$ sudo journalctl --no-pager -f -p 7
(...) systemd[1]: fprintd.service: Deactivated successfully.
(...) systemd[1]: Starting fprintd.service - Fingerprint Authentication Daemon...
(...) systemd[1]: Started fprintd.service - Fingerprint Authentication Daemon.
(...) sudo[27483]:       _user_ : TTY=pts/2 ; PWD=/home/(...) ; USER=root ; COMMAND=/usr/local/sbin/flashprog -p internal
(...) systemd-logind[763]: Existing logind session ID 21 used by new audit session, ignoring.
(...) systemd-logind[763]: New session 'c80' of user 'root' with class 'user-early' and type 'tty'.
(...) systemd[1]: Started session-c80.scope - Session c80 of User root.
(...) sudo[27483]: pam_systemd(sudo:session): Failed to check if /run/user/0/bus exists, ignoring: Permission denied
(...) sudo[27483]: pam_unix(sudo:session): session opened for user root(uid=0) by yk(uid=1000)
(...) sudo[27483]: pam_unix(sudo:session): session closed for user root
(...) systemd[1]: session-c80.scope: Deactivated successfully.
(...) systemd-logind[763]: Session c80 logged out. Waiting for processes to exit.
(...) systemd-logind[763]: Removed session c80.

If only I knew what to filter from 'journalctl --dmesg' that is relevant for this report.