linux-kernel - Re: [PATCH V31 25/25] debugfs: Disable open() when kernel is locked down

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190327050615.GA548@kroah.com>
Date:   Wed, 27 Mar 2019 14:06:15 +0900
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Andy Lutomirski <luto@...nel.org>
Cc:     Matthew Garrett <matthewgarrett@...gle.com>,
        James Morris <jmorris@...ei.org>,
        LSM List <linux-security-module@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        David Howells <dhowells@...hat.com>,
        Linux API <linux-api@...r.kernel.org>,
        Matthew Garrett <mjg59@...gle.com>
Subject: Re: [PATCH V31 25/25] debugfs: Disable open() when kernel is locked
 down

On Tue, Mar 26, 2019 at 09:29:14PM -0700, Andy Lutomirski wrote:
> On Tue, Mar 26, 2019 at 5:31 PM Greg KH <gregkh@...uxfoundation.org> wrote:
> >
> > On Tue, Mar 26, 2019 at 12:20:24PM -0700, Andy Lutomirski wrote:
> > > On Tue, Mar 26, 2019 at 11:28 AM Matthew Garrett
> > > <matthewgarrett@...gle.com> wrote:
> > > >
> > > > From: Matthew Garrett <mjg59@...gle.com>
> > > >
> > > > debugfs has not been meaningfully audited in terms of ensuring that
> > > > userland cannot trample over the kernel. At Greg's request, disable
> > > > access to it entirely when the kernel is locked down. This is done at
> > > > open() time rather than init time as the kernel lockdown status may be
> > > > made stricter at runtime.
> > >
> > > Ugh.  Some of those files are very useful.  Could this perhaps still
> > > allow O_RDONLY if we're in INTEGRITY mode?
> >
> > Useful for what?  Debugging, sure, but for "normal operation", no kernel
> > functionality should ever require debugfs.  If it does, that's a bug and
> > should be fixed.
> >
> 
> I semi-regularly read files in debugfs to diagnose things, and I think
> it would be good for this to work on distro kernels.

Doing that for debugging is wonderful.  People who want this type of
"lock down" are trading potential security for diagnositic ability.

good luck!

greg k-h