Why is "CONFIG_DEVMEM=n"?

[Utini2000]

Hello everyone,
I am trying to run "throttled" also known as "lenovo-throttling-fix" and it won't work because it needs "CONFIG_DEVMEM=y".
I wonder why linux-hardened as set it to "CONFIG_DEVMEM=n" and if there is a chance it could be changed to "CONFIG_DEVMEM=y"?

Thanks in advance!

[anthraxx]

It is disabled by default as it allows direct physical memory access and is not required for general use. Security and cutting attack surface is prioritized over additional optional features that only a marginal userbase would benefit from. You can compile your own variant if you really want to have it enabled and see if your use case works with ``` CONFIG_STRICT_DEVMEM=y CONFIG_IO_STRICT_DEVMEM=y ```

[Utini2000]

Well I tried several packages now that can modify the TDP/Power limit and they all won't work with linux-hardened.

Is there a way to make an exception for one specific package? e.g. have it disabled systemwide except for that one package?

[anthraxx]

I'm sorry, it is not possible to limit the usage to a specific application without exposing the surface in general. You either need to compile your own kernel or live without such applications.

[Utini2000]

Alright :( Thanks for your quick support!

[Bernhard40]

After LOCKDOWN will be upstreamed and enabled here it may be possible to use:

CONFIG_DEVMEM=y
CONFIG_STRICT_DEVMEM=y
CONFIG_IO_STRICT_DEVMEM=y

as DEVMEM will be protected by LOCKDOWN and the latter can be disabled o runtime without kernel recompilation.

[anthraxx]

Yes, but it would still (kind of, at least partially) mean to switch off hardened by toggling lockdown at runtime and is still nothing that can e limited to a specific application.