linux-kernel - [PATCH] debugfs: Add mount restriction option

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200528080031.24149-1-peter.enderborg@sony.com>
Date:   Thu, 28 May 2020 10:00:31 +0200
From:   Peter Enderborg <peter.enderborg@...y.com>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        <linux-kernel@...r.kernel.org>,
        "Rafael J . Wysocki" <rafael@...nel.org>,
        Andrew Morton <akpm@...ux-foundation.org>
CC:     Peter Enderborg <peter.enderborg@...y.com>
Subject: [PATCH] debugfs: Add mount restriction option

Since debugfs include sensitive information it need to be treated
carefully. But it also has many very useful debug functions for userspace.
With this option we can have same configuration for system with
need of debugfs and a way to turn it off. It is needed new
kernel command line parameter to be activated.

Signed-off-by: Peter Enderborg <peter.enderborg@...y.com>
---
 fs/debugfs/inode.c | 17 ++++++++++++++++-
 lib/Kconfig.debug  | 10 ++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
index b7f2e971ecbc..bde37dab77e0 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -786,10 +786,25 @@ bool debugfs_initialized(void)
 }
 EXPORT_SYMBOL_GPL(debugfs_initialized);
 
+static int allow_debugfs;
+
+static int __init debugfs_kernel(char *str)
+{
+	if (str && !strcmp(str, "true"))
+		allow_debugfs = true;
+
+	return 0;
+
+}
+early_param("debugfs", debugfs_kernel);
+
 static int __init debugfs_init(void)
 {
 	int retval;
-
+#ifdef CONFIG_DEBUG_FS_MOUNT_RESTRICTED
+	if (!allow_debugfs)
+		return -EPERM;
+#endif
 	retval = sysfs_create_mount_point(kernel_kobj, "debug");
 	if (retval)
 		return retval;
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 21d9c5f6e7ec..d3a3338740d2 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -443,6 +443,16 @@ config DEBUG_FS
 
 	  If unsure, say N.
 
+config DEBUG_FS_MOUNT_RESTRICTED
+	bool "Debug Filesystem mount restricted"
+	depends on DEBUG_FS
+	help
+	  This is an additional restriction for mounting debugfs. It allows
+	  the kernel to have debugfs compiled, but requires that kernel command
+	  line has a debugfs parameter to register as a filesystem.
+
+	  If unsure, say N.
+
 source "lib/Kconfig.kgdb"
 
 source "lib/Kconfig.ubsan"
-- 
2.26.2