Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Junxiao Bi <junxiao.bi@oracle.com>
To:     linux-kernel@vger.kernel.org,
        linux-security-module@vger.kernel.org, linux-block@vger.kernel.org
Cc:     paul@paul-moore.com, nathanl@linux.ibm.com, axboe@kernel.dk,
        jmorris@namei.org, serge@hallyn.com, konrad.wilk@oracle.com,
        joe.jin@oracle.com, junxiao.bi@oracle.com
Subject: [PATCH V4 1/2] debugfs: provide a way for relay user bypass lockdown
Date:   Thu, 20 Apr 2023 14:53:30 -0700
Message-Id: <20230420215331.88326-1-junxiao.bi@oracle.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?HuK4AiX8TDILEEaThfPr9xSnsPyRTJ2+e2PveLnyOXuA1x4J2/NBKpREHm22?=
 =?us-ascii?Q?ZQ+JJrjmsu6LJdkgDJl+zz/sDJnmYZC8kaixL45IPyKqQ1dWmNQiuF6ZiWOv?=
 =?us-ascii?Q?p2Mvlq9AuX3xX+CPqEB25Sl6qSTcD5+K++R9tQSTkWaVcaVvmxdzCC/nWm7Z?=
 =?us-ascii?Q?wxQwInt+O79ckLWmTLNn9vC3SDTbkk+4kGv2sfJWrMKFZKFhl0bFthjQ2Flx?=
 =?us-ascii?Q?cg2BCcqYh9WVQj0Q1RKnwhkG2A1a3pyubReVlUz/nE5AKyHjbUAbFoQOPz3M?=
 =?us-ascii?Q?FyTFZnwWhIqrG0mDUtKbq/X51qxq+7e99qO28+kZvVqYTfxgjaUgzAidlU4g?=
 =?us-ascii?Q?aztVr07pZcwEsZvH8uN1aTo8fCQJZTkUbUwwKIZI9J8/cxOM1J+jzHQmzQrL?=
 =?us-ascii?Q?sauk2Qc7gUgq1SaG60RT3hVxlvUPkfmyEowNFwCkWfnFJvSfVzSCR4q1w0QW?=
 =?us-ascii?Q?dX1H+HY6DlnqpEx/TnVNXDFd2qHJ9kpxbzXfxbIaXLZigsO1Usthg7xLnpN0?=
 =?us-ascii?Q?AP5W7Zjt5oNAZOJ0CBK8DrRhYpm2HjkkXE2gpaI1hBK2eUs3HFXX3BHSKQWN?=
 =?us-ascii?Q?++BWNoI34vJA9wzk3JRGlzU4YGNcOm5JrgT+Vb7bIRuTQaEQC3oH3cIdFtLM?=
 =?us-ascii?Q?qQNXZhvo+2RG0BzLo8riixkr+QqfmJCuZxdbvKomxWjddiSLrJyo+Ye/q56z?=
 =?us-ascii?Q?CJf8Hnz8jCkDZanqr+vQ96+uTK5Hoced9X50Vy2gguPeng6GJIsBkCa3Lrcs?=
 =?us-ascii?Q?DvrDySdpd7zcDrFYNK2Ti7t/zlu9VxZr5oALyKLTcJJOcmZv5+vZWwK/61rB?=
 =?us-ascii?Q?vT4qWo7Be4GBbjWjZPBk3g8oUSyQBznI943WeEE6W7WyKF5SZEhAvri3+T2s?=
 =?us-ascii?Q?Fa4fCcMC3hcDd9Q902OIycP+PiofgZeskGZHPrNu9uEzxmPrl0OUjAErUxyU?=
 =?us-ascii?Q?OG/wSB8jF4dhkCxzm8f796XH0lkt7/g/I7yNnx1mdnBr7QDk6yW1uc1ekM1x?=
 =?us-ascii?Q?v5TKtMbZsYLTAcOGSBG+6A8i7mOAuc7ihSKavKet1sPFrQJCR4RW9b4RKQ11?=
 =?us-ascii?Q?IcofYqbcnw0OGcGWZrYY/VlTFuXQAU4WcwKuw2/GYZun78bOzJV3r99ycdS0?=
 =?us-ascii?Q?1YaIyNx0n2GYoeNXDG9v/pKchzoo+LXJiDpXmSFMPxUYBWB3c4YvB6KAnzML?=
 =?us-ascii?Q?BhwkY4Cg8b4ix+IA0W3KrQ8g9AHWtMAmZCOqwE2HUozzb136yFdDSCheFthN?=
 =?us-ascii?Q?XwMpQSZ2IoMcFosW1DnaBti0qE7xLMIVh/GVMgR80mD2Qpea4vvqbpEQxKiO?=
 =?us-ascii?Q?jrmT+XwDPkiy6DNyjuW1uAerYGqAQdSXJBpZzcY2v6jJmBRmZZUBZUSOG3Km?=
 =?us-ascii?Q?9hCWmJ1KvsJuVtnguCohXjCEuk8BzzewR+1xOvfJYJxm5piCLDNmZx8DGnU8?=
 =?us-ascii?Q?to9fnUrPXezc2pga1JtM6Zw8VDTCu85oYXRzzT5YkfMP6c7cztelHDh4iWrk?=
 =?us-ascii?Q?FKmSxRGBDdgGZpNKe71Wp4EdAbXb7niqEe8RgpdbjB4dSHk9lfuSuZSVLMwN?=
 =?us-ascii?Q?qkGElyqacgFhDyH7ORqu1nPF6RYhNnsFaBQ8SYxIDapa5Cr9HCv4IwhOXUMz?=
 =?us-ascii?Q?cDbET7cGvR9L87wbTsph+6c=3D?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: a3KSYRqJ5MSIOce46VcIj20uPBe5djp9TCCXg1PIvULHPWKVjKcMszk3gapEUqYPKOe9fvchknxHAL75MM59vMxf2xblxtOS2fr2ylNa+IvdbMT/vnQTVmtnNncoxL3NJNfpIYmPicuvLmOINjEkeQS7bEKGHKTFx5G9xXCYqXiV8GHGebwjlcGOH94iFV7lRnocW/heOdUQETIhSS4gu4qIZpdS86gUnmsG7j7o02qIS1fXjXXl4xp/gIhYl+SqFH+QLFpxfZapIMzOieVvcQOMACpghUwF6Z0zpT7dJt5EgURt8yIMVXCKVLrkYhiaMhCdFnB0juVWrkY5pV5GeTkrizbMfOqTjbCEdhGqwjurFPvhtDLasfqnUj1qAZg0u0y5bStUrloj89GQxF9NI/lS4GW4AAcjp72WQXrIfNorYQDAR34yM/oaXBFwKRYk8Y3RKgsqwhs/Ugg6S4bTeHjwBygGI+5IqNDsAw4LpYcGD7OuZZzUtf+CracTPS8pl4K6BR/+4ZctlDmNE+ON8yjRZD6VWSvdGj614IQXA+oxRz5ff3QNNSPUOLHXXXlZs118DZ7/4MzwfUAMTybyv5i88ITzjt0OXm+Oom7edieiNXgiGENZmxl2vwBoOxg4jeb9oykVPiu3D8RquptT9/61wwrPdO3buIU4BYUlZ3km8sJ8wAVc+vAwWhn4vjyyb+Q/N4rXzlfiEQTuslwnb9ip6qgizZ21aKnly7FUJ4VUThVim+S8A13TkrjhiAY/+ZXjTq+WwKYoc0ZFcOUzYjdts7DHnTwRdwgAw1Ip2X4wCr/WUW0VrDOsnZ6rVBFNtzm0e0Ihroo4Q4/bEoH6u4rDoVI7/pDbQDyBKJ6qnEdshn7kYioxyetXu/ly+Ovm07rvbfbSHv0mJSCcEojGiq2AhWCx19wuC4nLb1bqSDM=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 0f8c928c-926d-4f47-fd40-08db41e9b2ba
X-MS-Exchange-CrossTenant-AuthSource: SJ0PR10MB4752.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Apr 2023 21:53:38.9381
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: u+p1uUrxXtEeEfQn2KJ99aQezWSQw8om0Iz73RxlCG5qai24nj5D4tVFvA8OkPW3n3TG9hFDOIJTemJdIBa6nQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR10MB7036
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22
 definitions=2023-04-20_15,2023-04-20_01,2023-02-09_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=999 adultscore=0
 phishscore=0 malwarescore=0 spamscore=0 bulkscore=0 suspectscore=0
 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2303200000 definitions=main-2304200185
X-Proofpoint-GUID: eVa_uEkNxCkED3-hjFP5BOk_UZz7yDiN
X-Proofpoint-ORIG-GUID: eVa_uEkNxCkED3-hjFP5BOk_UZz7yDiN
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Relay files in debugfs is used to export information from kernel to
userspace, relay user should tell whether the exported information
is safe to access in lockdown mode or not. The access will be denied
by default.

v4 <- v3:
refactor the code to make code more foolproof.

v3 <- v2:
allow only blktrace trace file instead of relay files
https://lore.kernel.org/all/20230418172656.33583-1-junxiao.bi@oracle.com/

v2 <- v1:
Fix build error when CONFIG_RELAY is not defined.
Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/oe-kbuild-all/202304121714.6mahd9EW-lkp@intel.com/
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
---
 fs/debugfs/file.c     | 11 +++++++++++
 include/linux/relay.h | 16 ++++++++++++++++
 kernel/relay.c        | 17 +++++++++++++++++
 3 files changed, 44 insertions(+)

diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
index 1f971c880dde..e12dd8634dc6 100644
--- a/fs/debugfs/file.c
+++ b/fs/debugfs/file.c
@@ -21,6 +21,7 @@
 #include <linux/pm_runtime.h>
 #include <linux/poll.h>
 #include <linux/security.h>
+#include <linux/relay.h>
 
 #include "internal.h"
 
@@ -142,6 +143,13 @@ EXPORT_SYMBOL_GPL(debugfs_file_put);
  * Only permit access to world-readable files when the kernel is locked down.
  * We also need to exclude any file that has ways to write or alter it as root
  * can bypass the permissions check.
+ * Exception:
+ * Relay files in debugfs are used by kernel to transfer data from kernel to
+ * userspace, these files are with permission 0400, but mmap is supported, so
+ * the access is blocked by default. But there are relay users like blktrace
+ * which will only export none security sensitive info to userspace, so provide
+ * a way for relay user to hook in to tell whether accessing the file in lockdown
+ * mode is safe or not.
  */
 static int debugfs_locked_down(struct inode *inode,
 			       struct file *filp,
@@ -154,6 +162,9 @@ static int debugfs_locked_down(struct inode *inode,
 	    !real_fops->mmap)
 		return 0;
 
+	if (relay_bypass_lockdown(inode, real_fops))
+		return 0;
+
 	if (security_locked_down(LOCKDOWN_DEBUGFS))
 		return -EPERM;
 
diff --git a/include/linux/relay.h b/include/linux/relay.h
index 72b876dd5cb8..0fd1fb638434 100644
--- a/include/linux/relay.h
+++ b/include/linux/relay.h
@@ -147,6 +147,19 @@ struct rchan_callbacks
 	 * This callback is mandatory.
 	 */
 	int (*remove_buf_file)(struct dentry *dentry);
+
+	/*
+	 * bypass_lockdown - check whether file can be accessed in lockdown mode.
+	 *
+	 * Called during file open. It depends on each relay user to tell whether
+	 * accessing the file is safe or not in lockdown mode.
+	 *
+	 * The callback should return "true" if allowing access, "false" if not.
+	 *
+	 * This callback is optional. If not set, accessing the file will be
+	 * denied in lockdown mode.
+	 */
+	bool (*bypass_lockdown)(struct inode *inode);
 };
 
 /*
@@ -279,8 +292,11 @@ extern const struct file_operations relay_file_operations;
 
 #ifdef CONFIG_RELAY
 int relay_prepare_cpu(unsigned int cpu);
+extern bool relay_bypass_lockdown(struct inode *inode,
+				 const struct file_operations *fops);
 #else
 #define relay_prepare_cpu     NULL
+#define relay_bypass_lockdown(inode, fops)    (false)
 #endif
 
 #endif /* _LINUX_RELAY_H */
diff --git a/kernel/relay.c b/kernel/relay.c
index 9aa70ae53d24..d5a76566ef62 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -1234,6 +1234,23 @@ static ssize_t relay_file_splice_read(struct file *in,
 	return ret;
 }
 
+bool relay_bypass_lockdown(struct inode *inode,
+				 const struct file_operations *fops)
+{
+	struct rchan_buf *buf;
+
+	/* Not a relay file */
+	if (fops != &relay_file_operations)
+		return false;
+
+	buf = (struct rchan_buf *)inode->i_private;
+	if (!buf->chan->cb->bypass_lockdown)
+		return false;
+
+	return buf->chan->cb->bypass_lockdown(inode);
+}
+EXPORT_SYMBOL_GPL(relay_bypass_lockdown);
+
 const struct file_operations relay_file_operations = {
 	.open		= relay_file_open,
 	.poll		= relay_file_poll,
-- 
2.24.3 (Apple Git-128)