Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Junxiao Bi <junxiao.bi@oracle.com>
To:     linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org
Cc:     paul@paul-moore.com, nathanl@linux.ibm.com, axboe@kernel.dk,
        jmorris@namei.org, serge@hallyn.com, konrad.wilk@oracle.com,
        joe.jin@oracle.com, junxiao.bi@oracle.com
Subject: [PATCH V3] debugfs: allow access blktrace trace files in lockdown mode
Date:   Tue, 18 Apr 2023 10:26:56 -0700
Message-Id: <20230418172656.33583-1-junxiao.bi@oracle.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?kwjkr7EbstKQS9yYlRYuSXa27wYI7BhK88rIKTDFr64AkTMGQlFvANIVi8fA?=
 =?us-ascii?Q?MLWxfLmtZHfJLyhbSV9CaW8taaDZolH0YJCEPYdH5RKBnDh047QsWq1W6VRN?=
 =?us-ascii?Q?vUdEjldxQAweRx3R11Zwv/bxhPcGuIlw3k8noSbrpE1+VyaD0eJgPrjJ4385?=
 =?us-ascii?Q?IlytvR0YBFDq4CaWxlfYd/CW5qoxKIcTIhiKwt1D0K8JT3ClQeV9PPU5ArFr?=
 =?us-ascii?Q?cVUqxkyp4/SaSt5rnFmvZhNMsI4ptvbK1sPte706cPdC8FuD+b0JyGtCHbj1?=
 =?us-ascii?Q?qMFDH93frZu60dE+0X+GzQBC+CMiqCxPLY2/eimWHwZf/5kqVqoBG53o3tcZ?=
 =?us-ascii?Q?LFqQy5pLJQGSc1UOMn8ExiZREESNOdcBi7p8FQhz2UENA39hB5m0k00SrbCs?=
 =?us-ascii?Q?hl7zSOPMRBOkSS/QyXH1lc1v0n5VSY6Z0/d3vuXgdtRUVDX6ILrAcBjFOcqE?=
 =?us-ascii?Q?/6yyde3L5/YnGX9G1OW32GCQU08k+BWlIY+Kr6CXmxFZ27j4ghBJJubMRzc3?=
 =?us-ascii?Q?U6Hc1+lk5E0jSGrIQlht+4N6ywk1f7ZHW9Xx2ujTK9STMu0F/Drd0X/HM0wk?=
 =?us-ascii?Q?mqEjE9sYL5+RtlebVMYP6grnpUmzf2xdxBXzkWDokdJY6lh61NWmVk9eMJJv?=
 =?us-ascii?Q?WWCa97JNPCIT69kv6zwCsURNi3D5iRUL6g62xQyjEBUyEsJnj5LX6flPCkIQ?=
 =?us-ascii?Q?KMJdY7+bXVoPPwdExORZ230YJ4rLIXUzRRf1sxCOvuRkFvPhJMb2AZBBsZy8?=
 =?us-ascii?Q?zShtx5m2uwlWaY+Y4XBNR0rKPAoeqcXomIpVl3sTXD0fGwPIR+Iov5ojGk0Q?=
 =?us-ascii?Q?SyYc3++i18DheuGW5PosvTaTJrldij4PvpSju8AXQ0gw/rsnLscpn7nuJA6+?=
 =?us-ascii?Q?X0EEO3pxasUYt2ZYTOaooDp9+JcFqWfQ/jCVfzuhlnxjmjhJe05fjm6GAWDx?=
 =?us-ascii?Q?vuXFlTqdIH+iE0D3A12H7EASevwJ4emS096XZkJq9U2uQmUurdN1mtQW4uFu?=
 =?us-ascii?Q?RJtnX4z6FddM9jquRkbb5WWUrN0Ux/+2+xHl6/itT4yUCgxflgyc5O8jd9NK?=
 =?us-ascii?Q?QhMQuaD+aX0t5J9gkzL0cgZ+ZLDW9Arz5CIxVBWLUmJJmBBQ0AxT/Pbr7NSy?=
 =?us-ascii?Q?7KJ6aNv4E0LaMb0qosNQosxiMWJNpcaJtvonbYr+SPQaQgg8MqaeaEiQcPYT?=
 =?us-ascii?Q?rSRVDpoqUDvUxkPOvveKCssDeHCPWxZG7HTEFeahh9Gvfm1obYqxOWDzOFnQ?=
 =?us-ascii?Q?jTg/jy9W3+/P6VBNcnYwmcO3Qv+Muf92+1SD1X7nQCjIqMUckzA8fg0LTRNQ?=
 =?us-ascii?Q?w7Kl7iImdBo7JMqF5ZdB1pn3z8E2FD3f3KqKj0MIhP6EwjoBa9sEqG1JhASf?=
 =?us-ascii?Q?KKa1NAW7Q5WG91KnngbdktH65q69ogPvxJJ8OL9nVBWfG06IrS+wjHpa1kgX?=
 =?us-ascii?Q?qPfOUD+UotrDL5uEhrMicKYWV8/LdIrnc6UXoYtr2iCiPjo1lcaRHZndZZm7?=
 =?us-ascii?Q?9AWYmkMkttr+kKs1gABUCBtRUYuPqDYtY0Vbu2uwPTYfF963nyGEScb83knv?=
 =?us-ascii?Q?foKjPP+zsfeJTrZYwfbRKQhzbbEVxXuDsTbnrmtg1D6s9PiHInv5SvR2BSds?=
 =?us-ascii?Q?r1C6qHx/yk2m1Ld+i+tbeAY=3D?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: c0KueAfCBENnFgiz5lY/Y/nYJFx+oPSFVRapPRPjN8lB5WialYlnA4FnfJPJ/H0d2dPgeMFpS0cfsN4OreXfIi+UpuuAupOcf+a18dZiLDnic3AQo2hAMT22P66XojyqSA13INJZ9lQ4DzjYfAYQLpTcb59PUUXfGlZ3OoGerTs4dxrTMhvK7cCncwRNMOi3y51NOgaoLTg5+aj9nCvaHXyc9pvW0lIQaRfNSYmIwV7Fop5jCgLdCYeNHOsJSXteqWbBU5c1/x3o7ec6Sf4GFwXOUKIvFgjNPXI1EfDmSOHG46khMe+J85AbbIGWUB5DeAFhLgsCjOvJj+mDbJjtQV4tRwmXlDFjW6syUuaJa/gtafpc5WpxfU3q0YxIheW5L/ROFQeB2T8GxRNuppE1ajHP/76yqsrwEwmtvJLxU/gX7UiWjQ8O9jBPC79hRWAMXIsH2LnGtjIUe/JIoFbG7Yo7enjTmomXtdQBrMA4pONsXReP4rPg5pqS3MhYsZCwnZWDF2R8rpfrLoN7k32fqv8kTRKup5QjKp8fHQ5lmvlsAS0qoobRdLywUdad4bNh9Abx/ZDxkiMxV0UQ5ppqtkiDTSBb4JT7YnlYoY0ipWLR3X2Hfy5Ya/zrVibsPxP5nEOC32W7bZqHh9V80dzYDMCArEXuMms9q0Q3Rw6mWZ+ZkUSbfhiYcaq/s0GjoGQDCKifp2E52KDqame5abwVZ4aEqaNjzC0+owNU31qZmsze9CCu+ocsY6nWtTXfrsXhpkHguhOYEBpihpxLGFvJvyg7vpnXcfGPMhtrjnTpdhCSH62RtpFkIG4NdXX56+bRY+4KNtA4sgIwmxj76bhCjqli45rPTfhulLFPz9EpNLbbu9bLmairgimoCltcHIkUJWFGRzfsuwtA82GcxjI63HIE+LGhBAo5G1MwLpBfDGc=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 1271699e-f10b-4af6-d024-08db40321f98
X-MS-Exchange-CrossTenant-AuthSource: SJ0PR10MB4752.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Apr 2023 17:27:02.7751
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: MAX2K4HIRXs2BrB9rXP1BlTMMzKh6D+OuKD9TlOM/GJC84pCtuyj6ProKj0aDzznmO40/hdeM5FAOM32d/0olg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR10MB6399
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22
 definitions=2023-04-18_13,2023-04-18_01,2023-02-09_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 adultscore=0
 malwarescore=0 mlxlogscore=999 mlxscore=0 bulkscore=0 phishscore=0
 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2303200000 definitions=main-2304180144
X-Proofpoint-GUID: nyqa9DsxJZAmKxBVjdE_Q0YhGvNJ0BWa
X-Proofpoint-ORIG-GUID: nyqa9DsxJZAmKxBVjdE_Q0YhGvNJ0BWa
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

blktrace trace files are per-cpu relay files that are used by kernel to
export IO metadata(IO events, type, target disk, offset and len etc.) to
userspace, no data from IO itself will be exported. These trace files have
permission 0400, but mmap is supported, so they are blocked by lockdown.
Skip lockdown for these files to allow blktrace work in lockdown mode.

v3 <- v2:
allow only blktrace trace file instead of relay files
https://lore.kernel.org/lkml/b68c9e1d-71c8-adf9-f7da-1b56a3d4bfbc@oracle.com/T/

v2 <- v1:
Fix build error when CONFIG_RELAY is not defined.
Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/oe-kbuild-all/202304121714.6mahd9EW-lkp@intel.com/
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
---
 fs/debugfs/file.c            | 10 ++++++++++
 include/linux/blktrace_api.h |  3 +++
 include/linux/relay.h        |  3 +++
 kernel/relay.c               | 16 ++++++++++++++++
 kernel/trace/blktrace.c      |  7 +++++++
 5 files changed, 39 insertions(+)

diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
index 1f971c880dde..973e38f3e8a1 100644
--- a/fs/debugfs/file.c
+++ b/fs/debugfs/file.c
@@ -21,6 +21,7 @@
 #include <linux/pm_runtime.h>
 #include <linux/poll.h>
 #include <linux/security.h>
+#include <linux/blktrace_api.h>
 
 #include "internal.h"
 
@@ -142,6 +143,12 @@ EXPORT_SYMBOL_GPL(debugfs_file_put);
  * Only permit access to world-readable files when the kernel is locked down.
  * We also need to exclude any file that has ways to write or alter it as root
  * can bypass the permissions check.
+ * Exception:
+ * blktrace trace files are per-cpu relay files that are used by kernel to
+ * export IO metadata(IO events, type, target disk, offset and len etc.) to
+ * userspace, no data from IO itself will be exported. These trace files have
+ * permission 0400, but mmap is supported, so they are blocked by lockdown.
+ * Skip lockdown for these files to allow blktrace work in lockdown mode.
  */
 static int debugfs_locked_down(struct inode *inode,
 			       struct file *filp,
@@ -154,6 +161,9 @@ static int debugfs_locked_down(struct inode *inode,
 	    !real_fops->mmap)
 		return 0;
 
+	if (blk_trace_is_tracefile(inode, real_fops))
+		return 0;
+
 	if (security_locked_down(LOCKDOWN_DEBUGFS))
 		return -EPERM;
 
diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
index cfbda114348c..42db54434d7a 100644
--- a/include/linux/blktrace_api.h
+++ b/include/linux/blktrace_api.h
@@ -78,6 +78,8 @@ extern int blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
 			   char __user *arg);
 extern int blk_trace_startstop(struct request_queue *q, int start);
 extern int blk_trace_remove(struct request_queue *q);
+extern bool blk_trace_is_tracefile(struct inode *inode,
+				 const struct file_operations *fops);
 
 #else /* !CONFIG_BLK_DEV_IO_TRACE */
 # define blk_trace_ioctl(bdev, cmd, arg)		(-ENOTTY)
@@ -89,6 +91,7 @@ extern int blk_trace_remove(struct request_queue *q);
 # define blk_add_trace_msg(q, fmt, ...)			do { } while (0)
 # define blk_add_cgroup_trace_msg(q, cg, fmt, ...)	do { } while (0)
 # define blk_trace_note_message_enabled(q)		(false)
+# define blk_trace_is_tracefile(inode, fops)	(false)
 #endif /* CONFIG_BLK_DEV_IO_TRACE */
 
 #ifdef CONFIG_COMPAT
diff --git a/include/linux/relay.h b/include/linux/relay.h
index 72b876dd5cb8..2346137adc94 100644
--- a/include/linux/relay.h
+++ b/include/linux/relay.h
@@ -279,8 +279,11 @@ extern const struct file_operations relay_file_operations;
 
 #ifdef CONFIG_RELAY
 int relay_prepare_cpu(unsigned int cpu);
+extern const struct rchan_callbacks *relay_get_cb(struct inode *inode,
+				 const struct file_operations *fops);
 #else
 #define relay_prepare_cpu     NULL
+#define relay_get_cb(inode, fops)	NULL
 #endif
 
 #endif /* _LINUX_RELAY_H */
diff --git a/kernel/relay.c b/kernel/relay.c
index 9aa70ae53d24..c97ade998311 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -1234,6 +1234,22 @@ static ssize_t relay_file_splice_read(struct file *in,
 	return ret;
 }
 
+const struct rchan_callbacks *relay_get_cb(struct inode *inode,
+				 const struct file_operations *fops)
+{
+	struct rchan_buf *buf;
+
+	/* Not a relay file */
+	if (fops != &relay_file_operations)
+		return NULL;
+	buf = (struct rchan_buf *)inode->i_private;
+	if (buf && buf->chan)
+		return buf->chan->cb;
+	else
+		return NULL;
+}
+EXPORT_SYMBOL_GPL(relay_get_cb);
+
 const struct file_operations relay_file_operations = {
 	.open		= relay_file_open,
 	.poll		= relay_file_poll,
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index d5d94510afd3..67e06a65d552 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -639,6 +639,13 @@ static int __blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
 	return 0;
 }
 
+bool blk_trace_is_tracefile(struct inode *inode,
+				 const struct file_operations *fops)
+{
+	return relay_get_cb(inode, fops) == &blk_relay_callbacks;
+}
+EXPORT_SYMBOL_GPL(blk_trace_is_tracefile);
+
 int blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
 		    struct block_device *bdev,
 		    char __user *arg)
-- 
2.24.3 (Apple Git-128)