Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Junxiao Bi <junxiao.bi@oracle.com>
To:     linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org
Cc:     paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com,
        nathanl@linux.ibm.com, axboe@kernel.dk, konrad.wilk@oracle.com,
        joe.jin@oracle.com, junxiao.bi@oracle.com
Subject: [PATCH V2] debugfs: allow access relay files in lockdown mode
Date:   Wed, 12 Apr 2023 13:53:16 -0700
Message-Id: <20230412205316.7114-1-junxiao.bi@oracle.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?TqH8WL0yh833lCICczAszq4GnDdoDDjBU5PEOITItkGTHP9emogofhqQ1rc+?=
 =?us-ascii?Q?7/+GILUkF9zrKFy8SPnKtpzaRVdXWz774qomJKvru9CUILWVs51P7c7DZUF1?=
 =?us-ascii?Q?wO4zBo6Ilg19EwhQM7WZbMlhZb/ufuwId7F4Ffe+yK1WiZyCYYr/76Zdf078?=
 =?us-ascii?Q?x8x+BqJs8OC1vakH6SBTzPF4tdxkU01r0WOwmQyqhKFyTkKPMFgiH1vIo+0f?=
 =?us-ascii?Q?0YE6sBLIDmkHfQGMNdJJUulkwbwDcWD3SEpoEnuok8/wP/a3GPYiXKGxKtPe?=
 =?us-ascii?Q?vjgK9rwUyFnYfIWSbK9DVHZZa7ablRLOQ2X4zU7QhkxGG1Dop85sCLgzov38?=
 =?us-ascii?Q?rOsdGAVK9EzmzkWuHz2I9Ao//lYMjSGg2eMRUTRbmR46eJy3eoB9+M0/8gXg?=
 =?us-ascii?Q?hKp7x/HAzx2bxliwPniIUSuHyOOukIRb0B3wX+UpsMv9vltfuUG+LAHyq7F0?=
 =?us-ascii?Q?S6+LBH73W1063xubN8oJX6U1mdNNbTELd/86kJlSzwm81z9J218V2EimsoFc?=
 =?us-ascii?Q?jOKkqO1S0fh22VrWW8oBj4s07txAb1fXc+m/LUlRVqPOb0AE9GYP54yJNwlv?=
 =?us-ascii?Q?b06H25AF2H7DkJJf0x1MrDnNwweNsKEmL2uifv78YA0dKcvHkgIKTIJF7fan?=
 =?us-ascii?Q?l80q8KRMzA7LoNBERkDgQxOiIzQJfHZ3j5ffjR7Okbj59wHMOunbFdg0nAWf?=
 =?us-ascii?Q?9E6fITPNnDc4LDT6SKCXbtbYL21K+102ada5d5V3GgZNpa2nD3tfrijhcH0/?=
 =?us-ascii?Q?h2C6AenREOPr3MyP8Fqckjo/mdz/Gzvt9K4cFLYIDZKlrpOF2ob+OngADtcL?=
 =?us-ascii?Q?YhKBCEoxcW0bbM6jfPBA1XN8Em8jJSkTaGgrSEJEZ8umx2Gr81fpSYArr0nS?=
 =?us-ascii?Q?crBpuG2qWRa3PCvTVJyWfnPMJyTAh1fc2dj1/1FJu6Q9r8fDeyCSxq/iMHfE?=
 =?us-ascii?Q?P5Cx0kmF9gu+rDpV0V2hi2t5XWl4czJxGFaEsKd7Uj7CLJWsK4aFFBn733/s?=
 =?us-ascii?Q?J8FxRkjXa/eMnSZDAD6oXCF2sa6rDsIouPiNWgekPGa1LNncz5BHCJvk8pfw?=
 =?us-ascii?Q?Vg+UpZrJZ2YyZS5HkIbqvhiuotMk8rmFDisbIlh0d4SWkc+iNQsz7PcO1xPi?=
 =?us-ascii?Q?HhY0x1nRAE6GCeoz6DzHT+zIhMBVtvtREUAgBemRoXq3uCgvaq08cHu816CF?=
 =?us-ascii?Q?/BT2bkhycs1mkRG90avwoMrRRaxJhF4LeAjmBqgutx5FflysR+wsUrWY/gEo?=
 =?us-ascii?Q?Tjf8kEDUgl0+UclcWwdFyOvH9d27vedA1OUrOXKATwImDXkpV2oRWG1ZHogQ?=
 =?us-ascii?Q?oRa9okTk9yhbb8uQ3VGHe9lmFxdOSX+PZu3FvD09MO05KvQSy/sySfDEHMAf?=
 =?us-ascii?Q?bmIhJ1fiXnqTSkU3t5NSxofxQ9vqXs+4lRvJl4ikVKen5yj8G90NDDWwjmed?=
 =?us-ascii?Q?Gdysnm0uvmaZxf6OuZCfXwkQAdC6cosXlFp8qd3NOYHD65c14Szt/W5xJSXr?=
 =?us-ascii?Q?QUl8lmTW7rZkUNVb6sYfXbLmTIcuKKe6PxADqCqTtPrh4JzkuBCwkFQbzYT8?=
 =?us-ascii?Q?bLxXyrVQ544SAOmpIyjvgCuy8UgjtVp+9iO6UdE3U8wUA0iomf6/xADauJki?=
 =?us-ascii?Q?yQfrXWUXwl9ELNI77C3aUac=3D?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: YfqyaMiu8J6AUgYFPzDCamZeQWu6VoRMLGX5EqGssAJa8EWeg/SYp/vWJ5XjS6piZsNfgvDstxd/G6Ddt38WCm4nKqPvUzr6oYPrFIwwpvJIa7CXuSdc8B6vGG3yXO7EOmN0XkcLrRCjvpbcuCHYNNdpq6oNnTPAuIhmVDSPh78HvBv1kOl+huFyHwhcWDNf0L6u0Y+gReAqS+O05+wknASBvefPuEgoMoZXo643V9EiVQpxJSenJFXe56UCOkbP9gmDChHEfPf/a66z4bbizDo2JvNOy1lE1BtpNnzmjDKFT4inHaHjULitvgOsbmei/SOaAQklzuf4DKZucHHoBYqAzYvstdtS3+7ZgXB2ca28SOr6pgrVg8WlvGa3UXkcry7r9deIBbV3bWGqGWSXdqDlPdk4mLGZhHW4ykIVvpG8nwYfqc3qlhqXMmZbonJ5EM13Kl7fPXuKrVrUF8wHvd8TzNkx91gSFz9s8CDSLJDunRsT89TGa+JPSGl9sQ1h5Mk5uVJkcAinmqfIjaUJr+TswoiESXX1uKQxn6DyKaeEmFji/x5+rBd+0kPAJhBKpGF76rEb6RjqdAs5btIMvkrkZlRXnj1yqhhXuDx578u0Q2KVYFnTLnsdalyva3quiIGgGMJD/k3M4Te/xlnI1NvMc3xdkove+WGWXRjEPwP8corxBROJFAbA3t1d2YEwt2RR5w7iWLmHsNRBBIe7fu7rUFqyBkhjqJ/ewbZ+0LHK3956gLUAO7dlPUmyz0qZZA2WhwQbHqJj6mAJnkyaBy0q6uR6keW5jQf08ypGdhvjMxHqVyBHoy6dGKvvZVTrDkgyNEkq67+fh3JMhaSj0+IV4Kll7/PgghGw/pqYBqCt3IEkgQmJ3ZKraIDLBnOS9ChB6LYbvlpvKiy/UBfYhigGBbv2F7pUcsKrM1iIbfw=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c104e925-ed26-49db-f007-08db3b97f2c5
X-MS-Exchange-CrossTenant-AuthSource: SJ0PR10MB4752.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Apr 2023 20:53:20.4360
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: dkbh1fQL01aBSxZmFTEoy36b36PSwhf2tKZMW4GQFxmQbG8ZdAnhFMT8LSvxhmxHAg5BaHNUZRNF/F+8Tevz5w==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR10MB5548
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22
 definitions=2023-04-12_11,2023-04-12_01,2023-02-09_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0
 malwarescore=0 phishscore=0 bulkscore=0 adultscore=0 mlxscore=0
 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2303200000 definitions=main-2304120178
X-Proofpoint-GUID: 6K85tWasJqlKPJjfbVQroJJJ_uUY1L_j
X-Proofpoint-ORIG-GUID: 6K85tWasJqlKPJjfbVQroJJJ_uUY1L_j
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Relay files are used by kernel to transfer information to userspace, these
files have permission 0400, but mmap is supported, so they are blocked by
lockdown. But since kernel just generates the contents of those files while
not reading it, it is saft to access relay files in lockdown mode.

With this, blktrace can work well in lockdown mode.

v2 <- v1:
Fix build error when CONFIG_RELAY is not defined.
Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/oe-kbuild-all/202304121714.6mahd9EW-lkp@intel.com/

Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
---
 fs/debugfs/file.c     | 9 +++++++++
 include/linux/relay.h | 8 ++++++++
 2 files changed, 17 insertions(+)

diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
index 1f971c880dde..c52c94e20366 100644
--- a/fs/debugfs/file.c
+++ b/fs/debugfs/file.c
@@ -21,6 +21,7 @@
 #include <linux/pm_runtime.h>
 #include <linux/poll.h>
 #include <linux/security.h>
+#include <linux/relay.h>
 
 #include "internal.h"
 
@@ -142,6 +143,11 @@ EXPORT_SYMBOL_GPL(debugfs_file_put);
  * Only permit access to world-readable files when the kernel is locked down.
  * We also need to exclude any file that has ways to write or alter it as root
  * can bypass the permissions check.
+ * Exception:
+ * Relay files are used by kernel to transfer information to userspace, these
+ * files have permission 0400, but mmap is supported, so they are blocked by
+ * lockdown. But since kernel just generates the contents of those files while
+ * not reading it, it is saft to access relay files in lockdown mode.
  */
 static int debugfs_locked_down(struct inode *inode,
 			       struct file *filp,
@@ -154,6 +160,9 @@ static int debugfs_locked_down(struct inode *inode,
 	    !real_fops->mmap)
 		return 0;
 
+	if (is_relay_file(real_fops))
+		return 0;
+
 	if (security_locked_down(LOCKDOWN_DEBUGFS))
 		return -EPERM;
 
diff --git a/include/linux/relay.h b/include/linux/relay.h
index 72b876dd5cb8..914f116d826e 100644
--- a/include/linux/relay.h
+++ b/include/linux/relay.h
@@ -279,8 +279,16 @@ extern const struct file_operations relay_file_operations;
 
 #ifdef CONFIG_RELAY
 int relay_prepare_cpu(unsigned int cpu);
+static inline int is_relay_file(const struct file_operations *fops)
+{
+	return fops == &relay_file_operations;
+}
 #else
 #define relay_prepare_cpu     NULL
+static inline int is_relay_file(const struct file_operations *fops)
+{
+	return 0;
+}
 #endif
 
 #endif /* _LINUX_RELAY_H */
-- 
2.24.3 (Apple Git-128)