linux-kernel - Re: [PATCH 2/2] nvmet: Restrict in-band config files to root

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <29921235.1r3eYUQgxm@anvil>
Date: Tue, 22 Apr 2025 08:36:41 +0200
From: Richard Weinberger <richard@...ma-star.at>
To: Richard Weinberger <richard@....at>,
 "linux-nvme@...ts.infradead.org" <linux-nvme@...ts.infradead.org>,
 upstream@...ma-star.at
Cc: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
 "a.hindborg@...nel.org" <a.hindborg@...nel.org>,
 "leitao@...ian.org" <leitao@...ian.org>,
 Chaitanya Kulkarni <chaitanyak@...dia.com>,
 "sagi@...mberg.me" <sagi@...mberg.me>, "hch@....de" <hch@....de>,
 "upstream+nvme@...ma-star.at" <upstream+nvme@...ma-star.at>,
 Chaitanya Kulkarni <chaitanyak@...dia.com>
Subject: Re: [PATCH 2/2] nvmet: Restrict in-band config files to root

On Dienstag, 22. April 2025 08:32 'Chaitanya Kulkarni' via upstream wrote:
> Patch looks good to me, can we do something like this and
> use in the rest of the patch ?
> 
> #define NVMET_CFGFS_ATTR_DEF_PERM (S_IRUSR | S_IWUSR)
> 
> or
> 
> Create a helper on the top of CONFIGFS_ATTR_PERM to wrap
> permission into that for all the CONFIGFS_ATTR_PERM()

Sounds like you want to restrict read access to all nvmet configfs
files? My focus was only on files that contain secrets.
Applying this to all files increases the risk of breaking existing
userspace tooling.

Thanks,
//richard

-- 
sigma star gmbh | Eduard-Bodem-Gasse 6, 6020 Innsbruck, AUT UID/VAT Nr:
ATU 66964118 | FN: 374287y