linux-kernel - [PATCH 2/2] nvmet: Restrict in-band config files to root

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250420104726.2963750-2-richard@nod.at>
Date: Sun, 20 Apr 2025 12:47:26 +0200
From: Richard Weinberger <richard@....at>
To: linux-nvme@...ts.infradead.org
Cc: linux-kernel@...r.kernel.org,
	a.hindborg@...nel.org,
	leitao@...ian.org,
	kch@...dia.com,
	sagi@...mberg.me,
	hch@....de,
	upstream+nvme@...ma-star.at,
	Richard Weinberger <richard@....at>
Subject: [PATCH 2/2] nvmet: Restrict in-band config files to root

There is no need to have key material world readable.

Signed-off-by: Richard Weinberger <richard@....at>
---
 drivers/nvme/target/configfs.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index e44ef69dffc2..7327543f161d 100644
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c
@@ -2128,7 +2128,7 @@ static ssize_t nvmet_host_dhchap_key_store(struct config_item *item,
 	return ret < 0 ? ret : count;
 }
 
-CONFIGFS_ATTR(nvmet_host_, dhchap_key);
+CONFIGFS_ATTR_PERM(nvmet_host_, dhchap_key, S_IRUSR | S_IWUSR);
 
 static ssize_t nvmet_host_dhchap_ctrl_key_show(struct config_item *item,
 		char *page)
@@ -2161,7 +2161,7 @@ static ssize_t nvmet_host_dhchap_ctrl_key_store(struct config_item *item,
 	return ret < 0 ? ret : count;
 }
 
-CONFIGFS_ATTR(nvmet_host_, dhchap_ctrl_key);
+CONFIGFS_ATTR_PERM(nvmet_host_, dhchap_ctrl_key, S_IRUSR | S_IWUSR);
 
 static ssize_t nvmet_host_dhchap_hash_show(struct config_item *item,
 		char *page)
@@ -2187,7 +2187,7 @@ static ssize_t nvmet_host_dhchap_hash_store(struct config_item *item,
 	return count;
 }
 
-CONFIGFS_ATTR(nvmet_host_, dhchap_hash);
+CONFIGFS_ATTR_PERM(nvmet_host_, dhchap_hash, S_IRUSR | S_IWUSR);
 
 static ssize_t nvmet_host_dhchap_dhgroup_show(struct config_item *item,
 		char *page)
@@ -2217,7 +2217,7 @@ static ssize_t nvmet_host_dhchap_dhgroup_store(struct config_item *item,
 	return count;
 }
 
-CONFIGFS_ATTR(nvmet_host_, dhchap_dhgroup);
+CONFIGFS_ATTR_PERM(nvmet_host_, dhchap_dhgroup, S_IRUSR | S_IWUSR);
 
 static struct configfs_attribute *nvmet_host_attrs[] = {
 	&nvmet_host_attr_dhchap_key,
-- 
2.48.1