Received: by 2002:a25:4158:0:0:0:0:0 with SMTP id o85csp683519yba; Wed, 3 Apr 2019 17:33:50 -0700 (PDT) X-Google-Smtp-Source: APXvYqx2Z+prjBDoqqgJGv25osJNOGRSoqVHfXqelNseridkK8HebV0mgY8exv6KLXo8bJdHbvMC X-Received: by 2002:a65:5c4b:: with SMTP id v11mr2679098pgr.411.1554338030431; Wed, 03 Apr 2019 17:33:50 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1554338030; cv=none; d=google.com; s=arc-20160816; b=wyTjZoFquzZTWWaoyGfmXIWfL5Sc94rF4zqTbjkqegMqR40KolTTTf82rg9lhXB6Gc vmdFnEf3i3YFx3r4q4fOokav76hBKeeCAvTKBCOO0sw6xWMKS22NVL0ns0Dm94bZjuU1 rBw4lq4jH6QUhCA82O6Cvgsj5jG1om7zq53h/8hTpSlQ03vfl96LXdLiPW+CZ6Aj1YU3 SbJcxRur4gVuN8jtaY/WDFXqZVVaQYr8LckaGdOrHIcpvX++0VgeBhq5TRx8/O+y/PCX LefuQ8eLoGmEdAGflwMMbZ70MO3FblRbzhMdABQZJJetboKyfw6uVhtcv5BdjWoHHr5w 9Pxg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:cc:to:from:subject:mime-version :message-id:date:dkim-signature; bh=Y6V235ExOHhz04rZCHOgAR7JNFI4IiG20YTZkaOAY/c=; b=txtXeB/UDvhDljSSeYjIywhg2Mv77Eg3eGTEotJNfdnWwBwR2snVYF0vYwrlCdMu5y YQagTrmwv/VysgONYGhGKnTLgZxliAhwjIMsKmFcwsR4npCdlCs4sUgFgRwww/SMzOPe RcsDRFWqxI7N84kiCVlJBRZVMFJZVa4HAzXjwD5BFnOw8dD0+Gu9UH0mTYCaw+FZ6vsd Ggef4CQtHFJ+qNzj9ju4qePib8gH+AlKkOvAm1jd09vFy28E1c0bSZO+3W7JYwPTCojY LZJc55AwWKm8HwY7s89rGSPzEqcNdehncm4FKDFFlNNMP5kivRDY9XWZpKMDLvFwgDyi bj9w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b=i0MOEVgf; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id h31si14680132pgb.318.2019.04.03.17.33.35; Wed, 03 Apr 2019 17:33:50 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b=i0MOEVgf; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726456AbfDDAcz (ORCPT + 99 others); Wed, 3 Apr 2019 20:32:55 -0400 Received: from mail-pl1-f201.google.com ([209.85.214.201]:41967 "EHLO mail-pl1-f201.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726399AbfDDAcy (ORCPT ); Wed, 3 Apr 2019 20:32:54 -0400 Received: by mail-pl1-f201.google.com with SMTP id 42so622298pld.8 for ; Wed, 03 Apr 2019 17:32:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:message-id:mime-version:subject:from:to:cc; bh=Y6V235ExOHhz04rZCHOgAR7JNFI4IiG20YTZkaOAY/c=; b=i0MOEVgf+dILjVvzgO3iuR3khF61WwWfwF0fHopUpJvEacJVpDUygiaZcktQd3pB4l rcIYdT/8zgZ5Ih2U03BCrI14YR4JzzW0C4AFrFc1nCpIb88pJ4Bv6e1US7MeoJODEjMP 2FEd9WdMUOew41mhqorZ0BEAd7MsUBZ9/lumjBl1ZB2F+8HjTSWIVyDW+/oFB7U6wd+h A+wANYlD20pYtTXJFH5l6b1fMjOuBPitiyTmtg9waG4To++KJQIXNlDdu/3XCuVivtVA QTnNa0cfCsUWnBBe8/69qvJIg/XxmSecUd3L+MrO8gjFny66doS9f4eNwfXoEm9o7kgO SX9Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:message-id:mime-version:subject:from:to:cc; bh=Y6V235ExOHhz04rZCHOgAR7JNFI4IiG20YTZkaOAY/c=; b=sosbe+0XSxMqQiJsB4rjmPl5v1W1KuVyRXaPabd2W8KBz4BN9GoNeyI5JK9OW3P1GF Wh9BjaTjfmg6ULz1mgvsziZQ4pNXmr1jx8GxIYC9LK6GreeKR3JwAefwT4GsR60msSgZ A5Tsu37SZhT0J87SQVHyq1TG1YU8qHMauYOXOB955/4/v+3gc/nLnOWYBJYZwYNrYvf3 gLr4gpzBfb4GjZDsAvpTkBBrpBfqybR82QyqNpnnSSrdqKFbO85zSjGeoWox7JXjk2V6 DVixMRfavGeBnFrsQKnlc+XnSva6TeykYaWmFasOZ0bVDSZo8vFbPYuhehPgiz9B2Vua jRig== X-Gm-Message-State: APjAAAUvam8DUjR5u1uttGNHa5R9BmDq7L4qshgqUp596pYBkYKVBAA7 oyFQjxT8nW7+BkpVdS4MBRkk93O7YlurmE2pJdB4hw== X-Received: by 2002:a63:6b4a:: with SMTP id g71mr76248pgc.141.1554337973835; Wed, 03 Apr 2019 17:32:53 -0700 (PDT) Date: Wed, 3 Apr 2019 17:32:22 -0700 Message-Id: <20190404003249.14356-1-matthewgarrett@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.21.0.392.gf8f6787159e-goog Subject: [PATCH V32 0/27] Lockdown patches for 5.2 From: Matthew Garrett To: jmorris@namei.org Cc: linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, dhowells@redhat.com, linux-api@vger.kernel.org, luto@kernel.org Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Fairly minimal changes since the last set: tracefs is restricted at Steven's suggestion (but could do with a once-over, I'm very much not a vfs person), debugfs is back to Dave's original implementation. I've also fixed up a malformed patch that resulted from me getting confused during rebase, and added some further documentation to the initial patch in order to give a reference for the design goals.