linux-kernel - Re: [RESEND v5 2/4] fs: debugfs: Add write functionality to debugfs blobs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <bfa69197-e7c0-4da8-ab1b-342aba8d6430@amd.com>
Date:   Thu, 16 Nov 2023 15:46:00 -0600
From:   Avadhut Naik <avadnaik@....com>
To:     "Luck, Tony" <tony.luck@...el.com>
Cc:     "rafael@...nel.org" <rafael@...nel.org>,
        "lenb@...nel.org" <lenb@...nel.org>,
        "james.morse@....com" <james.morse@....com>,
        "bp@...en8.de" <bp@...en8.de>,
        "gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>,
        "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "alexey.kardashevskiy@....com" <alexey.kardashevskiy@....com>,
        "yazen.ghannam@....com" <yazen.ghannam@....com>,
        Avadhut Naik <avadhut.naik@....com>,
        "linux-acpi@...r.kernel.org" <linux-acpi@...r.kernel.org>
Subject: Re: [RESEND v5 2/4] fs: debugfs: Add write functionality to debugfs
 blobs



On 11/16/2023 12:44, Luck, Tony wrote:
>>> The minimalist change here would be to s/0444/0666/
>>>
>> Just realized that s/0444/0644/ might be an even more minimalist change since you anyways,
>> I think, need to be root for error injection through einj. Does that sound good?
> 
> You need write access. I don't think you need to be root. E.g. a validation system might
> set up an "einj" group and "chmod" all these files to 0664. But that's nitpicking.
> 
>>
>> In any case, using 0666 will result in the below checkpatch warning:
>>
>> [root avadnaik-linux]# ./scripts/checkpatch.pl --strict -g HEAD
>> WARNING: Exporting world writable files is usually an error. Consider more restrictive permissions.
>> #84: FILE: fs/debugfs/file.c:1063:
>> +       return debugfs_create_file_unsafe(name, mode & 0666, parent, blob, &fops_blob);
>>
>> total: 0 errors, 1 warnings, 0 checks, 54 lines checked
> 
> The warning is dubious. This code isn't necessarily exporting a world writeable file. But
> it does allow a caller of this routine to do that.
> 
>>
>> Would you be okay with s/0444/0644/?
> 
>> -       return debugfs_create_file_unsafe(name, mode & 0444, parent, blob, &fops_blob);
>> +       return debugfs_create_file_unsafe(name, mode & 0644, parent, blob, &fops_blob);
> 
> 
> Yes. This is fine (better). Make sure to mention in the commit comment that this allows
> callers to create files writeable by owner.
> 
Will do. Thanks for the confirmation!
> -Tony
> 
> 

-- 
Thanks,
Avadhut Naik