Received: by 2002:ac0:bc90:0:0:0:0:0 with SMTP id a16csp4935037img; Tue, 26 Mar 2019 21:31:34 -0700 (PDT) X-Google-Smtp-Source: APXvYqxTggo8W6WDpXGlMpb2WWoBgaDbGHx/HSoj2D7Xlu1sLoM7fgXM+0AF2mVjqhhDziz6rwwz X-Received: by 2002:a17:902:15a8:: with SMTP id m37mr36041011pla.178.1553661094674; Tue, 26 Mar 2019 21:31:34 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553661094; cv=none; d=google.com; s=arc-20160816; b=GaV4oygTxnuPkSbg0dMsq30sGDz705fP7T5y+G8J019hI37zjrI4jz+a3zMDRvxadZ FWFDloH7njDYZxj0wmNu3fqpcCvJ02+Ka8i7V7ZGaz/e+GW2GdvbyR8pm/fgEPRFxEAY xYWi45GZHwMD/Np+ps3eN5MzVFDiyFO+WfzwWebp6d+crwORFWj8JeDiR2YRpljO25H+ 6P9a9GwzfURQCMXiebqIyxPJ3p+XpudncHY4E1/Pmc/yCzrYcyXWxcSBk9Lmy7VEupXd LnNaRB8Nbi7Au9sB5l+giXAqXnOJdK6njSDdK/O9eaC68V8VOOvr+OiCH9O0Apk49uy0 bUig== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=JzqImGmG7ij1lDmMRMaJaZaP5zsZh+mXdMA8mP5sicI=; b=FgWk559nItuXLxPBuUn8G7EAVNGcAtVTWMqlqkTQw4oDDi0i8JOFlTXTTHyDE+7+Q1 EfuWLhF6CH/HAIqa6cuq6WVs3/2goLTHLs/BKoPYL3+AmNoDXY6imU2ab0lkaNoYXmcG W00PC95ZKPT+djyWSwN/zNIRXQ5vo8Fj2BMqL4IyCkU43qtaPgo9VElZaJ1VLpWgt13D RcO2TaSECgzwfvk1cV2dmCS63kZbQI7vqUpv6duFBl9cTJ+EXDJZaEI3mHuOsuwO2VmW cfDDQ8KfWvV2NP5K8dhh+4/6GH3hu4DR7I+J5majVPwET+RxdF5xffZr7TlmOO2Wkxyp LB0g== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b="K9fGs/z3"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id r3si17258234pgp.154.2019.03.26.21.30.44; Tue, 26 Mar 2019 21:31:34 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b="K9fGs/z3"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726322AbfC0E33 (ORCPT + 99 others); Wed, 27 Mar 2019 00:29:29 -0400 Received: from mail.kernel.org ([198.145.29.99]:37516 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725763AbfC0E32 (ORCPT ); Wed, 27 Mar 2019 00:29:28 -0400 Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B500921734 for ; Wed, 27 Mar 2019 04:29:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553660967; bh=Zg1cTlPfZX1M+HOPd74bZBRElnN4Nw+XU23qLrCpyRs=; h=References:In-Reply-To:From:Date:Subject:To:Cc:From; b=K9fGs/z33lB0LhebeRULfYuJ880TaSBC88Lug7fpGhkZtRu4mtnie5gu1NqRothvf CHUzrxGmG7Qn087lFSJ5yPiAYnhofoZY6UhpaqJHEePhmjXuFTXpTZyhAHwXaMYzD8 4CntqPkvqYCxqr92ol82eOSlaQdwGcyUzAQD7ZKU= Received: by mail-wm1-f48.google.com with SMTP id q16so14759107wmj.3 for ; Tue, 26 Mar 2019 21:29:27 -0700 (PDT) X-Gm-Message-State: APjAAAXJo5DgJxeS41knmEB8NBNXMl0YGQ00ptRmFhiiHY0KzTlVGW/5 MQB7Gwto1G5OVEWrv5UKPokGgDt5OPapN+aHgoNpIA== X-Received: by 2002:a1c:eb14:: with SMTP id j20mr11661928wmh.32.1553660966187; Tue, 26 Mar 2019 21:29:26 -0700 (PDT) MIME-Version: 1.0 References: <20190326182742.16950-1-matthewgarrett@google.com> <20190326182742.16950-26-matthewgarrett@google.com> <20190327003057.GA27311@kroah.com> In-Reply-To: <20190327003057.GA27311@kroah.com> From: Andy Lutomirski Date: Tue, 26 Mar 2019 21:29:14 -0700 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [PATCH V31 25/25] debugfs: Disable open() when kernel is locked down To: Greg KH Cc: Andy Lutomirski , Matthew Garrett , James Morris , LSM List , LKML , David Howells , Linux API , Matthew Garrett Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Mar 26, 2019 at 5:31 PM Greg KH wrote: > > On Tue, Mar 26, 2019 at 12:20:24PM -0700, Andy Lutomirski wrote: > > On Tue, Mar 26, 2019 at 11:28 AM Matthew Garrett > > wrote: > > > > > > From: Matthew Garrett > > > > > > debugfs has not been meaningfully audited in terms of ensuring that > > > userland cannot trample over the kernel. At Greg's request, disable > > > access to it entirely when the kernel is locked down. This is done at > > > open() time rather than init time as the kernel lockdown status may be > > > made stricter at runtime. > > > > Ugh. Some of those files are very useful. Could this perhaps still > > allow O_RDONLY if we're in INTEGRITY mode? > > Useful for what? Debugging, sure, but for "normal operation", no kernel > functionality should ever require debugfs. If it does, that's a bug and > should be fixed. > I semi-regularly read files in debugfs to diagnose things, and I think it would be good for this to work on distro kernels.