Received-SPF: pass (google.com: domain of linux-kernel+bounces-212064-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Date: Wed, 12 Jun 2024 11:23:48 -0700
From: Kees Cook <kees@kernel.org>
To: Adrian Ratiu <adrian.ratiu@collabora.com>
Cc: linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org,
	linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org,
	linux-doc@vger.kernel.org, kernel@collabora.com, gbiv@google.com,
	ryanbeltran@google.com, inglorion@google.com, ajordanr@google.com,
	jorgelo@chromium.org, Guenter Roeck <groeck@chromium.org>,
	Doug Anderson <dianders@chromium.org>, Jann Horn <jannh@google.com>,
	Andrew Morton <akpm@linux-foundation.org>,
	Randy Dunlap <rdunlap@infradead.org>,
	Christian Brauner <brauner@kernel.org>, Jeff Xu <jeffxu@google.com>,
	Mike Frysinger <vapier@chromium.org>
Subject: Re: [PATCH v5 2/2] proc: restrict /proc/pid/mem
Message-ID: <202406121123.B0F60E91E@keescook>
References: <20240605164931.3753-1-adrian.ratiu@collabora.com>
 <20240605164931.3753-2-adrian.ratiu@collabora.com>
 <202406060917.8DEE8E3@keescook>
 <3304e0-6669e580-9f9-33d83680@155585222>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <3304e0-6669e580-9f9-33d83680@155585222>

On Wed, Jun 12, 2024 at 07:13:41PM +0100, Adrian Ratiu wrote:
> Would macros like the following be acceptable?
> I know it's more verbose but also much easier to understand and it works.
> 
> #if IS_ENABLED(CONFIG_PROC_MEM_RESTRICT_OPEN_READ_ALL)
> DEFINE_STATIC_KEY_TRUE_RO(proc_mem_restrict_open_read_all);
> DEFINE_STATIC_KEY_FALSE_RO(proc_mem_restrict_open_read_ptracer);
> #elif IS_ENABLED(CONFIG_PROC_MEM_RESTRICT_OPEN_READ_PTRACE)
> DEFINE_STATIC_KEY_FALSE_RO(proc_mem_restrict_open_read_all);
> DEFINE_STATIC_KEY_TRUE_RO(proc_mem_restrict_open_read_ptracer);
> #else
> DEFINE_STATIC_KEY_FALSE_RO(proc_mem_restrict_open_read_all);
> DEFINE_STATIC_KEY_FALSE_RO(proc_mem_restrict_open_read_ptracer);
> #endif

Yeah, that'd be fine by me. I was a little concerned I was
over-generalizing those macros. :P

-- 
Kees Cook