Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <b68c9e1d-71c8-adf9-f7da-1b56a3d4bfbc@oracle.com>
Date:   Mon, 17 Apr 2023 16:48:57 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0)
 Gecko/20100101 Thunderbird/102.10.0
Subject: Re: [PATCH V2] debugfs: allow access relay files in lockdown mode
Content-Language: en-US
To:     Paul Moore <paul@paul-moore.com>,
        Nathan Lynch <nathanl@linux.ibm.com>
Cc:     linux-kernel@vger.kernel.org,
        linux-security-module@vger.kernel.org, jmorris@namei.org,
        serge@hallyn.com, axboe@kernel.dk, konrad.wilk@oracle.com,
        joe.jin@oracle.com
References: <20230412205316.7114-1-junxiao.bi@oracle.com>
 <878reqs0xg.fsf@linux.ibm.com>
 <CAHC9VhS3LpJ_x7ZfdV83KY3U49XFGMLejz7rsiEH19rzyUfD-w@mail.gmail.com>
From:   Junxiao Bi <junxiao.bi@oracle.com>
In-Reply-To: <CAHC9VhS3LpJ_x7ZfdV83KY3U49XFGMLejz7rsiEH19rzyUfD-w@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?U0hrT2JrV1FhN1B1MlNVa3QzRFpZcUJiZndzbE00MzJRNkZxUWJ2Q2xpemFL?=
 =?utf-8?B?QjBoWjVzM1JlSUlGOFRYV1ZXVXRiV1pMSGxKUVpLL1hCWHB0cUVxL05sSEVF?=
 =?utf-8?B?dkpWb2h1ZDZjTzNGMVhkZnBEdGhoNjdyd3BhMEgwOXBYUE9aYVJVaW5CQktX?=
 =?utf-8?B?M2pXdjZhbHhNT2FPbnBTN3FLSnM0U0J3SFVodnYwcG1VVEtKWDgwWGY1MXc0?=
 =?utf-8?B?cVNtVnliWFU5VU5HYU54SmUwdHgyK2Jxb2dHQkcwK0ZJaWVzU2lubFVXQVZp?=
 =?utf-8?B?cmU0aVpyMU1sOUZLMTlBQThTVnAvTU0yWmNyRCtSRjZGSmFJdmtiV1g3TmhR?=
 =?utf-8?B?S1BLN0o1eVRwMVdvYjlHT05rZGRoQklHOTZRd1czNzdscllmTHV6S3l1bXJN?=
 =?utf-8?B?Y0lJTTZML2lKRnhkTEdsM2lVV0szdGFLUzFkU0w5S21OY3Q3YTRwTHdQenZT?=
 =?utf-8?B?Mm9mWXNFeUhLUW5idXNsbzhNSHZvSlRjdWhWUHdMZXBweFlWSG1XRVZ4Q1Nz?=
 =?utf-8?B?TFBuN3M4YTE2NU5zU3Mxa2RJMEpPa0tQWmtVZzFvVXFhSjhXWGwzK29hYWsr?=
 =?utf-8?B?SzFRcmJadURPY1NnR1BvRDNpb0ZkdWErNnVOSnF3R3NHU2VFL0dzYjBlZXIr?=
 =?utf-8?B?dVJvbEp0ekFkR1VVZ0dmd0NsRzBIeVdBN1FLenB4amhuNTFvcWo5alI4U21x?=
 =?utf-8?B?UnFoYzRDOFNEaXFrVkd3aDJKWkRDNExsOVNaT1dzanAwNlMyR2FCNmR1ckpV?=
 =?utf-8?B?U3NPUW0xSGlRSHcyMEwrN0RhRVFxMWJFK2pRbzNDaHk2VDlGLzBmVXVGMDYr?=
 =?utf-8?B?ZEFaYWdrYkZ3dEkzVmk2T081eFMxNDhucXFxRG1HZmFNK1dwQXFxUFg0bnlp?=
 =?utf-8?B?T2JxbDdUWGY5OU1YZk9uZE44SHFqN2NCNTlaQWp4TXZrSkhZKzRad0lubW0y?=
 =?utf-8?B?Q0ltT2xDNnYzYW5iWGZmYmlQRmN0ZGJoYmlIb3V6ODNTdSt2T09LRnZkemw5?=
 =?utf-8?B?NzF0OHBSeGljR1FCMDlZU2pBMlJLOHhPREExUHpvM2MrVUt2QnlBT0RSV2Fs?=
 =?utf-8?B?QWRQRjIxVVM5SFpoeEc0NGdDdUhVQXMxVGNvMmVwK1VsT1FXRHFYTkNNayta?=
 =?utf-8?B?VnFBZm1ZMTVBMGxSMkdVZE5lUmJVY2I3SlZLejBsa1c5czlWdWFGM3BsZUI0?=
 =?utf-8?B?c3Z5TmpDRkM3SXVRNUYyRWdYaksxTUpCVmlac2NySjhta1ZZVEIwd2NCR3V0?=
 =?utf-8?B?ZjVVQ1NuU1VyVnJ1YmZSai8rNXg2eUYyZjkrcEdPL0VlVkx6QWc5Wlc5bGIx?=
 =?utf-8?B?b3pQcGJ0NWRUdEZDL2drL0xDYjhhOStuYnlEQ0VROFNyYTI4RGVsOVZ1UEFx?=
 =?utf-8?B?am04QklTcjV0V3NNMytSOUl2Wi9NWDRyVWV3N1M5ZE54Mm8vSXgxYzk3aDNi?=
 =?utf-8?B?ME9IQ0ZXVXVsc1Q5ZktDQXdyNExOWGpWWjk2RXRpSmFoWGsyVW0ySmlVOXRQ?=
 =?utf-8?B?QUZYWkNXbkFwNmtTZkxLSDJuZjVCdXZlSUg0UjR3VzlGYzE5TTU2NE1BU1pn?=
 =?utf-8?B?WWEvRnArUmZKRlBuTDhVTkhBekEwOWZZOUMwS29NV3h1V2JicnI2UDJzcGZQ?=
 =?utf-8?B?N0NoN0VRb2VMbHY5ZEVmMlF6QUplVXVUUzhYUjNxYXYxSGZwTVZMV3FHRWNz?=
 =?utf-8?B?RlNWZTNlUVN4dXE4a0lYaTVLelc4eGduRUhobDBGSHJqRXVpSE9jTkFsL0RU?=
 =?utf-8?B?MitGbzVzYk5rM0JhS0Y2SGxMdDR0b0JnTHpSVzNSU1pHVk9EcmRydGovTzJ6?=
 =?utf-8?B?bWMveGpnQjE3d2kyOTdkYXdzdzlnMnRUcS82TkVvY1RyNENBNkk3WGFOS3hH?=
 =?utf-8?B?WjRkZ2NILy84OXNLc3NJTUJoRDE1T21EeTQyYzhPZ29SL2VVMTI3TkozUklJ?=
 =?utf-8?B?UWk4V1RWRWUyb290THpEMTV6SE9YU05nSUdsdXJMY29Pc3JVbGF2UmI4WmpC?=
 =?utf-8?B?Um5hQ0ZKcEI0NHV6Z2IxVGtYK1hSZmQvN3VCd0JQbWFUS29yK282K1J5YmpL?=
 =?utf-8?B?cVJyN2xUSnZHMFk2TFRsU1dhMFJOZW9YY1RoOUFzYlJaMmM3eUJnNml4Y1dj?=
 =?utf-8?Q?Z+jUnVTCgTcIKAjsNTg/lgN5r?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: JjVc2Dh8tv0WkZJkDzff9stlrEVnl1ksFGT67J4FvudzRh2sz012aOMxBIQ2TPZvomzii69mFvsooQ/RCQY7B4DeGWgEREOyQRAj5G+aBxnHsQELD2ZvYX40xDtiBtIhySCgWbF+YaqnH6KEXlPQvhnU/1iufRFYxC+iIZhnyFtloZebUeaC0c8OnBtI7sIeR8cMJvqQ8wluFUrGsN0BL/2YMn3zgc75Mqi8AK3ct668+bRv3Hh40AHLZmkRg2l4HcbSigz7IldBOUwEucNPgiRmJbfn7tKtdwLDVi4/qP33ZhuUK5y24jpEd9JyOsOJMMzFNnmaYhrT7Wo92q3Meigp9OTPw9xU6UQ/E7GPQansqaQ2V1sGYhKJUF/mOoArKT+qn7qsoXn2dSyP6KViTxYSoZDpaQsFNUDxp2hyY+ZgPZlV6RWyNiF5H02UAsHD2w1IrbAiFNKBV2mYuB6GgJPZQWDUtDzhGBaXCiEUS2Lzab7f5bzXHjKZpfGCFrvhZRAQKGl8qeCKHmaC0UsQFn/VgArdtKsKXYb2cfiwmOLTXm8d7H53ZuPL03Z2QkzITmpviJtbW9ygthbF4hgxeP62PTyi0kh9tQ2g502UTZnlHtDKjXQqOKPm37x022YGotyAPRGzqEUxqfMa7k50knjIrzo7jUSDaga16K2pg2hIznsA/+rI+LYoY2f4UqEQwSjNV8Rl3cy3Nltj4v9Yu5JSYiUhC9S3rM84ut+cEtssiUGLGK/i0mtCqryzIn444MsYy75ORn99H+9w66iDCQPyzdbD+/c4jVHdLVmrjoz1LdqUpJiEo1lbUtyHLkA34ZcMJsXJTvVQOZsFHswW52i2gFDc9zD8nSuMsx+CeA/9VKMDi2d7FTm9AKMXXtb0hkSc/8p92KdTKWI99ivoinQFFwMfDrCzTrIeu7Ylf2M=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 6ea7c674-4832-4329-10bf-08db3f9e50b5
X-MS-Exchange-CrossTenant-AuthSource: SJ0PR10MB4752.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Apr 2023 23:48:59.6517
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: jvDhta89fDLFXrG/8wbDf/4UqS5PYT4JIxOcL1qe+ZYjRHZZBPAy8tKZHYWD1KkTrBfjNZqOBvbir+VlPgi3zQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR10MB5863
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22
 definitions=2023-04-17_14,2023-04-17_01,2023-02-09_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 adultscore=0
 malwarescore=0 mlxlogscore=999 mlxscore=0 bulkscore=0 phishscore=0
 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2303200000 definitions=main-2304170210
X-Proofpoint-GUID: DABTDW8gmj15-X3I7x_SzPWsbEDa_pZ-
X-Proofpoint-ORIG-GUID: DABTDW8gmj15-X3I7x_SzPWsbEDa_pZ-
X-Spam-Status: No, score=-5.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 4/17/23 2:56 PM, Paul Moore wrote:

> On Mon, Apr 17, 2023 at 4:39 PM Nathan Lynch<nathanl@linux.ibm.com>  wrote:
>> Junxiao Bi<junxiao.bi@oracle.com>  writes:
>>> Relay files are used by kernel to transfer information to userspace, these
>>> files have permission 0400, but mmap is supported, so they are blocked by
>>> lockdown. But since kernel just generates the contents of those files while
>>> not reading it, it is saft to access relay files in lockdown mode.
>>>
>>> With this, blktrace can work well in lockdown mode.
>> Assuming that all relay users do not expose the kinds of information
>> that confidentiality mode tries to restrict, this change seems OK to
>> me. I think that assumption applies to blktrace; apart from that, there
>> is a handful of drivers that use relay files (I searched for
>> relay_open() call sites, maybe there is a better way).
> At the very least I see an Intel graphics driver and some network
> drivers, but like you, that was a quick search and I'm probably
> missing something.  At the very least someone needs to go audit those
> users/drivers to ensure this is safe to merge.
>
> However, regardless of what that code audit may turn up, I'm a little
> concerned that it would be all too easy to add a new relay interface
> user which isn't safe.  The check in debugfs_locked_down() is far too
> removed from the code which is using the relay interface for it to be
> likely noticed in a future case where an unsafe user is added.  This
> looks like a vulnerability waiting to happen.

I got this concern. I will make a new version to limit it to only allow 
blktrace trace files.

Thanks,

Junxiao.