linux-kernel - Re: Hardening debugfs (Was Re: [PATCH] debugfs: more tightly restrict default mount mode)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120828170908.GA14655@kroah.com>
Date:	Tue, 28 Aug 2012 10:09:08 -0700
From:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:	Theodore Ts'o <tytso@....edu>, Kees Cook <keescook@...omium.org>,
	linux-kernel@...r.kernel.org, Ben Hutchings <ben@...adent.org.uk>,
	Rob Landley <rob@...dley.net>,
	Al Viro <viro@...iv.linux.org.uk>,
	Ludwig Nussel <ludwig.nussel@...e.de>,
	Alessandro Rubini <rubini@...dd.com>, linux-doc@...r.kernel.org
Subject: Re: Hardening debugfs (Was Re: [PATCH] debugfs: more tightly
 restrict default mount mode)

On Tue, Aug 28, 2012 at 10:41:10AM -0400, Theodore Ts'o wrote:
> On Mon, Aug 27, 2012 at 01:32:15PM -0700, Kees Cook wrote:
> > Since the debugfs is mostly only used by root, make the default mount
> > mode 0700. Most system owners do not need a more permissive value,
> > but they can choose to weaken the restrictions via their fstab.
> > 
> > Signed-off-by: Kees Cook <keescook@...omium.org>
> 
> I agree with this patch, but it would also be good if we could try to
> harden debugfs in general.  Some ideas that might be worth discussing,
> for example?
> 
> 1) Adding a per-module flag, so things in debugfs only show up if they
> are explicitly requested (you know, for debugging purposes).  If most
> people are using debugfs for access to ftrace and powertap (my use
> case), there's no point making directories for other device drivers
> and file systems visible.

The module code is "explicitly requesting" a debugfs file when it makes
the call to create it.  If you want to depend on a flag for the
individual modules to do this or not, sure, go ahead, but that's a
module/driver issue, nothing I can do in the debugfs core itself.

> 2) Can we find a pattern of common security #fail's with debugfs
> files, and try to sweep through and fix them?

The only one I know of is the "unload the module with an open file
handle" issue.  I'm pretty sure this could be fixed up somehow in
debugfs, much like it was resolved in sysfs, but it would take a lot of
work, for a very limited benefit (in other words, if someone sends me
patches for this, great, but it's so low on my TODO list that I'll
probably never get to it myself.)

thanks,

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/