linux-kernel - Re: [PATCH] debugfs: allow access relay files in lockdown mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202304121714.6mahd9EW-lkp@intel.com>
Date:   Wed, 12 Apr 2023 17:31:45 +0800
From:   kernel test robot <lkp@...el.com>
To:     Junxiao Bi <junxiao.bi@...cle.com>, linux-kernel@...r.kernel.org,
        linux-security-module@...r.kernel.org
Cc:     oe-kbuild-all@...ts.linux.dev, paul@...l-moore.com,
        jmorris@...ei.org, serge@...lyn.com, nathanl@...ux.ibm.com,
        axboe@...nel.dk, konrad.wilk@...cle.com, joe.jin@...cle.com
Subject: Re: [PATCH] debugfs: allow access relay files in lockdown mode

Hi Junxiao,

kernel test robot noticed the following build errors:

[auto build test ERROR on driver-core/driver-core-testing]
[also build test ERROR on driver-core/driver-core-next driver-core/driver-core-linus linus/master v6.3-rc6 next-20230412]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Junxiao-Bi/debugfs-allow-access-relay-files-in-lockdown-mode/20230412-081241
patch link:    https://lore.kernel.org/r/20230412001030.88441-1-junxiao.bi%40oracle.com
patch subject: [PATCH] debugfs: allow access relay files in lockdown mode
config: i386-randconfig-a015-20230410 (https://download.01.org/0day-ci/archive/20230412/202304121714.6mahd9EW-lkp@intel.com/config)
compiler: gcc-11 (Debian 11.3.0-8) 11.3.0
reproduce (this is a W=1 build):
        # https://github.com/intel-lab-lkp/linux/commit/7891278613631bb6076e7b4603c1e907d1304cfa
        git remote add linux-review https://github.com/intel-lab-lkp/linux
        git fetch --no-tags linux-review Junxiao-Bi/debugfs-allow-access-relay-files-in-lockdown-mode/20230412-081241
        git checkout 7891278613631bb6076e7b4603c1e907d1304cfa
        # save the config file
        mkdir build_dir && cp config build_dir/.config
        make W=1 O=build_dir ARCH=i386 olddefconfig
        make W=1 O=build_dir ARCH=i386 SHELL=/bin/bash

If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@...el.com>
| Link: https://lore.kernel.org/oe-kbuild-all/202304121714.6mahd9EW-lkp@intel.com/

All errors (new ones prefixed by >>):

   ld: fs/debugfs/file.o: in function `debugfs_locked_down':
>> fs/debugfs/file.c:163: undefined reference to `relay_file_operations'


vim +163 fs/debugfs/file.c

   141	
   142	/*
   143	 * Only permit access to world-readable files when the kernel is locked down.
   144	 * We also need to exclude any file that has ways to write or alter it as root
   145	 * can bypass the permissions check.
   146	 * Exception:
   147	 * Relay files are used by kernel to transfer information to userspace, these
   148	 * files have permission 0400, but mmap is supported, so they are blocked by
   149	 * lockdown. But since kernel just generates the contents of those files while
   150	 * not reading it, it is saft to access relay files in lockdown mode.
   151	 */
   152	static int debugfs_locked_down(struct inode *inode,
   153				       struct file *filp,
   154				       const struct file_operations *real_fops)
   155	{
   156		if ((inode->i_mode & 07777 & ~0444) == 0 &&
   157		    !(filp->f_mode & FMODE_WRITE) &&
   158		    !real_fops->unlocked_ioctl &&
   159		    !real_fops->compat_ioctl &&
   160		    !real_fops->mmap)
   161			return 0;
   162	
 > 163		if (real_fops == &relay_file_operations)
   164			return 0;
   165	
   166		if (security_locked_down(LOCKDOWN_DEBUGFS))
   167			return -EPERM;
   168	
   169		return 0;
   170	}
   171	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests