Re: [PATCH v2 2/3] console_common: get_first_active: respect security policy

[Ahmad Fatoum <a.fatoum@pengutronix.de>]

Hi,

On 28.10.25 16:43, Fabian Pflug wrote:
> If the console input is deactivated through a security policy, then
> there is no need to iterate over the current consoles, as none should
> have a STDIN.
> 
> Signed-off-by: Fabian Pflug <f.pflug@pengutronix.de>
> ---
> v2:
> Fix in console common instead of working around it in startup.c
>  common/console_common.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/common/console_common.c b/common/console_common.c
> index 5b7a64c99c..a8319c20f3 100644
> --- a/common/console_common.c
> +++ b/common/console_common.c
> @@ -23,6 +23,7 @@
>  #include <linux/math64.h>
>  #include <linux/sizes.h>
>  #include <linux/overflow.h>
> +#include <security/config.h>
>  
>  #ifndef CONFIG_CONSOLE_NONE
>  
> @@ -331,6 +332,11 @@ struct console_device *console_get_first_active(void)
>  {
>  	struct console_device *cdev;
>  	const unsigned char active = CONSOLE_STDIN | CONSOLE_STDOUT;
> +
> +	/* if no console input is allows, then we can't have STDIN on any. */
> +	if (!IS_ALLOWED(SCONFIG_CONSOLE_INPUT))
> +		return NULL;

This stretches the definition of an "active" console, because the console
is still usable for output. Please rename to console_get_first_interactive()
as requested on v1.

Thanks,
Ahmad

> +
>  	/*
>  	 * Assumption to have BOTH CONSOLE_STDIN AND STDOUT in the
>  	 * same output console


-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |