| Message ID | 20190715195946.223443-28-matthewgarrett@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Kernel lockdown functionality | expand |
On Mon, 15 Jul 2019 12:59:44 -0700 Matthew Garrett <matthewgarrett@google.com> wrote: > Tracefs may release more information about the kernel than desirable, so > restrict it when the kernel is locked down in confidentiality mode by > preventing open(). > > Signed-off-by: Matthew Garrett <mjg59@google.com> > Cc: Steven Rostedt <rostedt@goodmis.org> > --- > > @@ -389,6 +414,7 @@ struct dentry *tracefs_create_file(const char *name, umode_t mode, > { > struct dentry *dentry; > struct inode *inode; > + struct file_operations *proxy_fops; Small nit, but please add this as the first declaration, to keep the "upside-down x-mas tree" look. I know some of the other functions in this file don't follow that (which should be cleaned up some day), but I'd like to avoid adding more that breaks the aesthetic of the code. > > if (!(mode & S_IFMT)) > mode |= S_IFREG; > @@ -402,8 +428,18 @@ struct dentry *tracefs_create_file(const char *name, umode_t mode, > if (unlikely(!inode)) > return failed_creating(dentry); > > + proxy_fops = kzalloc(sizeof(struct file_operations), GFP_KERNEL); > + if (!proxy_fops) > + return failed_creating(dentry); > + > + if (fops) I think you meant "if (!fops)". -- Steve > + fops = &tracefs_file_operations; > + > + dentry->d_fsdata = (void *)fops; > + memcpy(proxy_fops, fops, sizeof(*proxy_fops)); > + proxy_fops->open = default_open_file; > inode->i_mode = mode; > - inode->i_fop = fops ? fops : &tracefs_file_operations; > + inode->i_fop = proxy_fops; > inode->i_private = data; > d_instantiate(dentry, inode); > fsnotify_create(dentry->d_parent->d_inode, dentry);
On Tue, Jul 16, 2019 at 4:14 PM Steven Rostedt <rostedt@goodmis.org> wrote: > Small nit, but please add this as the first declaration, to keep the > "upside-down x-mas tree" look. I know some of the other functions in > this file don't follow that (which should be cleaned up some day), but > I'd like to avoid adding more that breaks the aesthetic of the code. ACK. > > + > > + if (fops) > > I think you meant "if (!fops)". Blink. Whoops! Yup.
diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c index eeeae0475da9..4c04c0c89514 100644 --- a/fs/tracefs/inode.c +++ b/fs/tracefs/inode.c @@ -20,6 +20,7 @@ #include <linux/parser.h> #include <linux/magic.h> #include <linux/slab.h> +#include <linux/security.h> #define TRACEFS_DEFAULT_MODE 0700 @@ -27,6 +28,23 @@ static struct vfsmount *tracefs_mount; static int tracefs_mount_count; static bool tracefs_registered; +static int default_open_file(struct inode *inode, struct file *filp) +{ + struct dentry *dentry = filp->f_path.dentry; + struct file_operations *real_fops; + int ret; + + if (!dentry) + return -EINVAL; + + ret = security_locked_down(LOCKDOWN_TRACEFS); + if (ret) + return ret; + + real_fops = dentry->d_fsdata; + return real_fops->open(inode, filp); +} + static ssize_t default_read_file(struct file *file, char __user *buf, size_t count, loff_t *ppos) { @@ -221,6 +239,12 @@ static int tracefs_apply_options(struct super_block *sb) return 0; } +static void tracefs_destroy_inode(struct inode *inode) +{ + if (S_ISREG(inode->i_mode)) + kfree(inode->i_fop); +} + static int tracefs_remount(struct super_block *sb, int *flags, char *data) { int err; @@ -256,6 +280,7 @@ static int tracefs_show_options(struct seq_file *m, struct dentry *root) static const struct super_operations tracefs_super_operations = { .statfs = simple_statfs, + .destroy_inode = tracefs_destroy_inode, .remount_fs = tracefs_remount, .show_options = tracefs_show_options, }; @@ -389,6 +414,7 @@ struct dentry *tracefs_create_file(const char *name, umode_t mode, { struct dentry *dentry; struct inode *inode; + struct file_operations *proxy_fops; if (!(mode & S_IFMT)) mode |= S_IFREG; @@ -402,8 +428,18 @@ struct dentry *tracefs_create_file(const char *name, umode_t mode, if (unlikely(!inode)) return failed_creating(dentry); + proxy_fops = kzalloc(sizeof(struct file_operations), GFP_KERNEL); + if (!proxy_fops) + return failed_creating(dentry); + + if (fops) + fops = &tracefs_file_operations; + + dentry->d_fsdata = (void *)fops; + memcpy(proxy_fops, fops, sizeof(*proxy_fops)); + proxy_fops->open = default_open_file; inode->i_mode = mode; - inode->i_fop = fops ? fops : &tracefs_file_operations; + inode->i_fop = proxy_fops; inode->i_private = data; d_instantiate(dentry, inode); fsnotify_create(dentry->d_parent->d_inode, dentry); diff --git a/include/linux/security.h b/include/linux/security.h index d92323b44a3f..807dc0d24982 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -121,6 +121,7 @@ enum lockdown_reason { LOCKDOWN_KPROBES, LOCKDOWN_BPF_READ, LOCKDOWN_PERF, + LOCKDOWN_TRACEFS, LOCKDOWN_CONFIDENTIALITY_MAX, }; diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c index 37ef46320ef4..fd7cdbddd814 100644 --- a/security/lockdown/lockdown.c +++ b/security/lockdown/lockdown.c @@ -36,6 +36,7 @@ static char *lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = { [LOCKDOWN_KPROBES] = "use of kprobes", [LOCKDOWN_BPF_READ] = "use of bpf to read kernel RAM", [LOCKDOWN_PERF] = "unsafe use of perf", + [LOCKDOWN_TRACEFS] = "use of tracefs", [LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality", };
Tracefs may release more information about the kernel than desirable, so restrict it when the kernel is locked down in confidentiality mode by preventing open(). Signed-off-by: Matthew Garrett <mjg59@google.com> Cc: Steven Rostedt <rostedt@goodmis.org> --- fs/tracefs/inode.c | 38 +++++++++++++++++++++++++++++++++++- include/linux/security.h | 1 + security/lockdown/lockdown.c | 1 + 3 files changed, 39 insertions(+), 1 deletion(-)