Received: by 2002:ac0:bc90:0:0:0:0:0 with SMTP id a16csp4588743img; Tue, 26 Mar 2019 12:24:36 -0700 (PDT) X-Google-Smtp-Source: APXvYqysmK+McHf5mNkZaXmEg5w8a7gq7/c+QO+dAXLKWEeS16WQgv89+pcUL/4COfUufsDUtkiB X-Received: by 2002:a63:2ad4:: with SMTP id q203mr31219346pgq.43.1553628276553; Tue, 26 Mar 2019 12:24:36 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553628276; cv=none; d=google.com; s=arc-20160816; b=ZwAMKk3mho9VmJ2l2xovK07lPsVntw8uLOm/PDTJTQvgRoLKCKF789tmjPsrJmwBFT bUgb+V2p9EZ1StZx3L/f25cYefZtyupacRPHeqCrPB3cqIgUKTKg60FC2tHSwHTohfgY OcuG8mGdQ5GizPzylnlh44XIcgNXT11yUCoQXI7d4AIsWB3O6tjA/IE4Byy/XZzVy9Xm NjchDIKVfykHp+mgn+1ebEbiW4HkD/mEYYH5ASCiEufMJrAIiBdPwcNgi1PqXO+CwgiD eXeYYBaftvYHp//eW4n9ukJjgjn0B7rw0SYCyU59sYFvZrF4fqTo/LQPaN3KIq+T/jSc UHOg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=0yz5iUwny8Ht7a2ATcqBN10pGhmhd/4c3IbQqOwFU9s=; b=ZdafGtErDr5c+oFOyLOGLpGwxOToauxPebyAkIT8BO413dMqsiv+5kRdwMAMmCiFJT 5a4bW2KdIU6wogVRroZ+CLbos3sjimO4KzmsuxXdhTcpUIIqG4lpr9zcl/Ys6EzCETpO Cll+teED06109icJ3SWh7J4baDDdbUDIToKQBRHG/e/6G0N1Y/YZDUD1I/wn4OgsCUBZ NwjT/b9Im7IzI5iti4o6oqgQJPXwN8ehWYC1ytdvo207JAj0/qSVH1VSVIEky71mli2n B3LC7OHGWukge07LXQZjL1c4o3vmZLF3j+Kw/avJpnniMZvKTtg+92nliQz96NBNiX2N pgbg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b="R/JsQK22"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id l127si16719625pfl.2.2019.03.26.12.24.20; Tue, 26 Mar 2019 12:24:36 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b="R/JsQK22"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732414AbfCZTWJ (ORCPT + 99 others); Tue, 26 Mar 2019 15:22:09 -0400 Received: from mail-it1-f196.google.com ([209.85.166.196]:54869 "EHLO mail-it1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732057AbfCZTWI (ORCPT ); Tue, 26 Mar 2019 15:22:08 -0400 Received: by mail-it1-f196.google.com with SMTP id w18so21561493itj.4 for ; Tue, 26 Mar 2019 12:22:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=0yz5iUwny8Ht7a2ATcqBN10pGhmhd/4c3IbQqOwFU9s=; b=R/JsQK22WGb0m54Ri61jCZc+s66DyN9WXyY+PIunrLXEwyc2JUoS0mx439O2nVF8VG tIIp9vq83mHeDNWEEfXF1nTvhCzSr4UeiF95LbHLc6/D9oATJiVQp9ywUccVN1k5yfJ+ XKDJxILr0IRUgBW1vuqfNfWV+FL+M/4AkUf7dRXQ4eqo/8Z8OvehipfPrZohDrLFelNF yTulv2oAjgnmq3Gq4zqingx7SUaiCRLAn09wnfiLoWUEPH48PaSeKubG74lkjXIa9tli iz0P04Es8m3KqACTuttlcpas8ps0MkrsWaIrj+ZIEcGe5LiKLx9nLw/Y8o6Agl1b936V RnKw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=0yz5iUwny8Ht7a2ATcqBN10pGhmhd/4c3IbQqOwFU9s=; b=UgCmeLHET+PA6wKrN6vQhkqhAnL/cXbgytG4pNz0pq+2PW0F7nwvUk4b7lywiVpwm3 pIz61AWGQMxK0S7hdn0shNt5ACH1hzKurPGIsmp5TJAXL1YJK9T0O9zEd/ua1bZCgM+o CBUYSCufDmRkrbb4Iu/B2bXfs9LwqK9smITkmkg0IdXuZNAUCDXjrnZ7cNH0jeQG1dx9 F3KJ9FFp87W77xfiwFFrNx+WaihyFM0HKSrNTfwoYarDftIox9+RXWjnWSOwTcRxZlR2 731voREw22yMbUOI92stUjcZBYGQQqprLFixxgGJjCzcRw5pa7m1qUS16FpoxMcuMCnC JhZg== X-Gm-Message-State: APjAAAWUiXPUxfgx/TYEIKINJDEYDzBj/eTrQQ9r9hSVvBa5X130qEi1 OxWdiILDnGBR6MBS160RntX04FpKvxr9vVuNwLSY5Q== X-Received: by 2002:a02:c955:: with SMTP id u21mr6629600jao.105.1553628127676; Tue, 26 Mar 2019 12:22:07 -0700 (PDT) MIME-Version: 1.0 References: <20190326182742.16950-1-matthewgarrett@google.com> <20190326182742.16950-26-matthewgarrett@google.com> In-Reply-To: From: Matthew Garrett Date: Tue, 26 Mar 2019 12:21:56 -0700 Message-ID: Subject: Re: [PATCH V31 25/25] debugfs: Disable open() when kernel is locked down To: Andy Lutomirski Cc: James Morris , LSM List , LKML , David Howells , Linux API , Greg KH Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Mar 26, 2019 at 12:20 PM Andy Lutomirski wrote: > Ugh. Some of those files are very useful. Could this perhaps still > allow O_RDONLY if we're in INTEGRITY mode? The previous implementation did, but Greg wanted it to go away entirely.