From patchwork Thu Apr 20 21:53:30 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junxiao Bi X-Patchwork-Id: 13219207 X-Patchwork-Delegate: paul@paul-moore.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 74D26C77B7C for ; Thu, 20 Apr 2023 21:54:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232817AbjDTVyp (ORCPT ); Thu, 20 Apr 2023 17:54:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60790 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232836AbjDTVym (ORCPT ); Thu, 20 Apr 2023 17:54:42 -0400 Received: from mx0a-00069f02.pphosted.com (mx0a-00069f02.pphosted.com [205.220.165.32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BD92A26B3; Thu, 20 Apr 2023 14:54:38 -0700 (PDT) Received: from pps.filterd (m0246627.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 33KKGLYZ009202; Thu, 20 Apr 2023 21:53:43 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : content-transfer-encoding : content-type : mime-version; s=corp-2023-03-30; bh=vj1BssR+OqWnYGF9jMKMNrgV3jvPAHClYoOkW+SK88A=; b=wUSLz1yEaPZgr+3FLTpPTPAA69bmMLbXl2ACv5r38KHGZn/kT477bICE9BH3YMHSSv19 ecv9tkoy4BPbk5iRPmMUZPb8gV6ElvzkQRFr8bZJGcvxbGXyl5VqcgYzNvwqBGNhN6bB BI65EbiYHGgXBHXfUD60NZxXwuJ515uHwZGRxD7RMsCgmr5dJDbbp1Poujyak2PZ7DwC ZloiHTWn+k9cYza4OIhmyJD1AtJZ9I/QdiPAeCgBQa+FQsSGCbOsKX3IkMjpnTdU2ob9 Z+8mfIlKqjjjgYB/7TjJ3ChIzkjMxwT08Vb8JOg95BtJHxuU4NKFUFSTtyoQB4j9EKal Ug== Received: from iadpaimrmta02.imrmtpd1.prodappiadaev1.oraclevcn.com (iadpaimrmta02.appoci.oracle.com [147.154.18.20]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3pyjh1v2r0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 20 Apr 2023 21:53:42 +0000 Received: from pps.filterd (iadpaimrmta02.imrmtpd1.prodappiadaev1.oraclevcn.com [127.0.0.1]) by iadpaimrmta02.imrmtpd1.prodappiadaev1.oraclevcn.com (8.17.1.19/8.17.1.19) with ESMTP id 33KK9Opq015638; Thu, 20 Apr 2023 21:53:41 GMT Received: from nam12-dm6-obe.outbound.protection.outlook.com (mail-dm6nam12lp2177.outbound.protection.outlook.com [104.47.59.177]) by iadpaimrmta02.imrmtpd1.prodappiadaev1.oraclevcn.com (PPS) with ESMTPS id 3pyjcevsf8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 20 Apr 2023 21:53:41 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=SOj0UNC2BfEwnatWsyoGseKg2T8pFWNEiDIIen3OyN0Afx/LixdiHyQwkqQGcvRp0H58yCvJceStsHekHwB2n2YUn6FZ5jq1qoTxGQcTMQXTqNIntIkukXkpKZ7iEYqvaV66WaznLBoOuuuLdnU1TdNQqLRNplMHd/odE7WlA5O2YH0HnPRwKcCWDehogQ8ccp8Vnap1/ki/UFH5GeZyhjQz5o1DMUE4CZYQXF2/xz58gDCadx1bO9j/N6qmhUztMFESom55/YtJXH0OdtDu6sAPw4S+CZ5ip0bfqAwiLDXNi1ZRtoBVzmx9EmlhmNntW1psVvoYpaMl0Ao9wKSBdA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=vj1BssR+OqWnYGF9jMKMNrgV3jvPAHClYoOkW+SK88A=; b=AYBd6LTMcvLLQv/rx9foc89eFOg4KSy8kGN3yaGhU+APnTfLYwH2E4jGIC18cg8Ef5bNSJwJ8hszC2rLsW6A+tEruEX4Bk90UNn6UOb8c7jeR2MGbIF8JB+F3WBJbGr1Tbb+GXpkd2VwGPT3gv4cAXnMqBZ13aGv5dtFx8JsxfTfzv1srpY2+DkuK7blqiH9ygYMN6Pn5JcLyjCvotvPK8ZZsKJkg4vFmnroOupZvkcObUn3XQ8vsK7Fe5X3/vnP+lig+brRD4+8legrhYRWVDy7KzN2uH1whBP2DLzGJv3WjKCpP8j3mUIzBy+xSn3ZTnfs4cqTB/Hrng8nxIJCqw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=vj1BssR+OqWnYGF9jMKMNrgV3jvPAHClYoOkW+SK88A=; b=CQBrAOE9f2euM37s4EMCrNwAwLavFvNThWlFc6WjT/PwLdvEYhFe0BxA+6sOQrGUrEb2s6VFchmxMnIrkExOz5l+5G2rTZZ2Tktb6S5RXltqILNd/7Th2nFH0VxKqI7Oo53Sh9B12qZsL5yMJUZa0TULSEOhmFYzEFL5py7j+T4= Received: from SJ0PR10MB4752.namprd10.prod.outlook.com (2603:10b6:a03:2d7::19) by PH7PR10MB7036.namprd10.prod.outlook.com (2603:10b6:510:274::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6298.45; Thu, 20 Apr 2023 21:53:39 +0000 Received: from SJ0PR10MB4752.namprd10.prod.outlook.com ([fe80::4a9d:b42c:57c7:b53c]) by SJ0PR10MB4752.namprd10.prod.outlook.com ([fe80::4a9d:b42c:57c7:b53c%5]) with mapi id 15.20.6319.022; Thu, 20 Apr 2023 21:53:38 +0000 From: Junxiao Bi To: linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-block@vger.kernel.org Cc: paul@paul-moore.com, nathanl@linux.ibm.com, axboe@kernel.dk, jmorris@namei.org, serge@hallyn.com, konrad.wilk@oracle.com, joe.jin@oracle.com, junxiao.bi@oracle.com Subject: [PATCH V4 1/2] debugfs: provide a way for relay user bypass lockdown Date: Thu, 20 Apr 2023 14:53:30 -0700 Message-Id: <20230420215331.88326-1-junxiao.bi@oracle.com> X-Mailer: git-send-email 2.24.3 (Apple Git-128) X-ClientProxiedBy: LO3P123CA0008.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:ba::13) To SJ0PR10MB4752.namprd10.prod.outlook.com (2603:10b6:a03:2d7::19) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SJ0PR10MB4752:EE_|PH7PR10MB7036:EE_ X-MS-Office365-Filtering-Correlation-Id: 0f8c928c-926d-4f47-fd40-08db41e9b2ba X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 23WWxyxyoGKgCqpzA+nc3IR5J2bBtxYWmDgaFI5PFUHgA+rRAY51/ZFHDTAWNGQlByOpvy2R9mM0OKm74YNqBI3sMjqYho38/zpYMu4wYdZuC9F5Np31/U8/doOJ7OndTstge+QpbSWawLU18GdWb9q04qkUxrK5DKtNaAlsqM59QQlmIJPAKAa4pQww8tEYbMoHKbMmlw0JQv4LsTZ2K4BbRH3FyzY+98Moy5cmPVmwRxb37kHJBszkWsDCS3xGRyCXwbsH1gt0DS4Ep2mmsRSdKonuh5nsy6Dqjrrb0eTN/O6DTKDPcsY/Wc34hBbOSVrDRInCWLLEfkvtK4HDgMt3cuL4kSVudXrMeZpmmwxVB3jFHG+cRT7ilsameUGVh/ScciFybz9iQKl+gDqXQtbYbMHSGxUBlEF9Rm2RPiUca1LGQF4PVPyma8AaBYliODldGBthsjga0RfjOfUMnbF5YlGWlE40G2yVQxS15R0rlEO3d9S9lL1X1wwE24jkpvtvZCllH49sUsYixwRf8V3BJ7mdJFJtTznKcCSpXTKoPC5JTfcrBOLnkX2sCKq6pmQYjzBK/tNUJCNOTDIFIw== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SJ0PR10MB4752.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230028)(366004)(39860400002)(376002)(396003)(346002)(136003)(451199021)(5660300002)(44832011)(2616005)(41300700001)(83380400001)(86362001)(107886003)(966005)(1076003)(6512007)(6506007)(186003)(38100700002)(8936002)(8676002)(478600001)(6666004)(6486002)(316002)(36756003)(66946007)(66556008)(66476007)(4326008)(2906002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: HuK4AiX8TDILEEaThfPr9xSnsPyRTJ2+e2PveLnyOXuA1x4J2/NBKpREHm22ZQ+JJrjmsu6LJdkgDJl+zz/sDJnmYZC8kaixL45IPyKqQ1dWmNQiuF6ZiWOvp2Mvlq9AuX3xX+CPqEB25Sl6qSTcD5+K++R9tQSTkWaVcaVvmxdzCC/nWm7ZwxQwInt+O79ckLWmTLNn9vC3SDTbkk+4kGv2sfJWrMKFZKFhl0bFthjQ2Flxcg2BCcqYh9WVQj0Q1RKnwhkG2A1a3pyubReVlUz/nE5AKyHjbUAbFoQOPz3MFyTFZnwWhIqrG0mDUtKbq/X51qxq+7e99qO28+kZvVqYTfxgjaUgzAidlU4gaztVr07pZcwEsZvH8uN1aTo8fCQJZTkUbUwwKIZI9J8/cxOM1J+jzHQmzQrLsauk2Qc7gUgq1SaG60RT3hVxlvUPkfmyEowNFwCkWfnFJvSfVzSCR4q1w0QWdX1H+HY6DlnqpEx/TnVNXDFd2qHJ9kpxbzXfxbIaXLZigsO1Usthg7xLnpN0AP5W7Zjt5oNAZOJ0CBK8DrRhYpm2HjkkXE2gpaI1hBK2eUs3HFXX3BHSKQWN++BWNoI34vJA9wzk3JRGlzU4YGNcOm5JrgT+Vb7bIRuTQaEQC3oH3cIdFtLMqQNXZhvo+2RG0BzLo8riixkr+QqfmJCuZxdbvKomxWjddiSLrJyo+Ye/q56zCJf8Hnz8jCkDZanqr+vQ96+uTK5Hoced9X50Vy2gguPeng6GJIsBkCa3LrcsDvrDySdpd7zcDrFYNK2Ti7t/zlu9VxZr5oALyKLTcJJOcmZv5+vZWwK/61rBvT4qWo7Be4GBbjWjZPBk3g8oUSyQBznI943WeEE6W7WyKF5SZEhAvri3+T2sFa4fCcMC3hcDd9Q902OIycP+PiofgZeskGZHPrNu9uEzxmPrl0OUjAErUxyUOG/wSB8jF4dhkCxzm8f796XH0lkt7/g/I7yNnx1mdnBr7QDk6yW1uc1ekM1xv5TKtMbZsYLTAcOGSBG+6A8i7mOAuc7ihSKavKet1sPFrQJCR4RW9b4RKQ11IcofYqbcnw0OGcGWZrYY/VlTFuXQAU4WcwKuw2/GYZun78bOzJV3r99ycdS01YaIyNx0n2GYoeNXDG9v/pKchzoo+LXJiDpXmSFMPxUYBWB3c4YvB6KAnzMLBhwkY4Cg8b4ix+IA0W3KrQ8g9AHWtMAmZCOqwE2HUozzb136yFdDSCheFthNXwMpQSZ2IoMcFosW1DnaBti0qE7xLMIVh/GVMgR80mD2Qpea4vvqbpEQxKiOjrmT+XwDPkiy6DNyjuW1uAerYGqAQdSXJBpZzcY2v6jJmBRmZZUBZUSOG3Km9hCWmJ1KvsJuVtnguCohXjCEuk8BzzewR+1xOvfJYJxm5piCLDNmZx8DGnU8to9fnUrPXezc2pga1JtM6Zw8VDTCu85oYXRzzT5YkfMP6c7cztelHDh4iWrkFKmSxRGBDdgGZpNKe71Wp4EdAbXb7niqEe8RgpdbjB4dSHk9lfuSuZSVLMwNqkGElyqacgFhDyH7ORqu1nPF6RYhNnsFaBQ8SYxIDapa5Cr9HCv4IwhOXUMzcDbET7cGvR9L87wbTsph+6c= X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: a3KSYRqJ5MSIOce46VcIj20uPBe5djp9TCCXg1PIvULHPWKVjKcMszk3gapEUqYPKOe9fvchknxHAL75MM59vMxf2xblxtOS2fr2ylNa+IvdbMT/vnQTVmtnNncoxL3NJNfpIYmPicuvLmOINjEkeQS7bEKGHKTFx5G9xXCYqXiV8GHGebwjlcGOH94iFV7lRnocW/heOdUQETIhSS4gu4qIZpdS86gUnmsG7j7o02qIS1fXjXXl4xp/gIhYl+SqFH+QLFpxfZapIMzOieVvcQOMACpghUwF6Z0zpT7dJt5EgURt8yIMVXCKVLrkYhiaMhCdFnB0juVWrkY5pV5GeTkrizbMfOqTjbCEdhGqwjurFPvhtDLasfqnUj1qAZg0u0y5bStUrloj89GQxF9NI/lS4GW4AAcjp72WQXrIfNorYQDAR34yM/oaXBFwKRYk8Y3RKgsqwhs/Ugg6S4bTeHjwBygGI+5IqNDsAw4LpYcGD7OuZZzUtf+CracTPS8pl4K6BR/+4ZctlDmNE+ON8yjRZD6VWSvdGj614IQXA+oxRz5ff3QNNSPUOLHXXXlZs118DZ7/4MzwfUAMTybyv5i88ITzjt0OXm+Oom7edieiNXgiGENZmxl2vwBoOxg4jeb9oykVPiu3D8RquptT9/61wwrPdO3buIU4BYUlZ3km8sJ8wAVc+vAwWhn4vjyyb+Q/N4rXzlfiEQTuslwnb9ip6qgizZ21aKnly7FUJ4VUThVim+S8A13TkrjhiAY/+ZXjTq+WwKYoc0ZFcOUzYjdts7DHnTwRdwgAw1Ip2X4wCr/WUW0VrDOsnZ6rVBFNtzm0e0Ihroo4Q4/bEoH6u4rDoVI7/pDbQDyBKJ6qnEdshn7kYioxyetXu/ly+Ovm07rvbfbSHv0mJSCcEojGiq2AhWCx19wuC4nLb1bqSDM= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0f8c928c-926d-4f47-fd40-08db41e9b2ba X-MS-Exchange-CrossTenant-AuthSource: SJ0PR10MB4752.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Apr 2023 21:53:38.9381 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: u+p1uUrxXtEeEfQn2KJ99aQezWSQw8om0Iz73RxlCG5qai24nj5D4tVFvA8OkPW3n3TG9hFDOIJTemJdIBa6nQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR10MB7036 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.254,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-04-20_15,2023-04-20_01,2023-02-09_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=999 adultscore=0 phishscore=0 malwarescore=0 spamscore=0 bulkscore=0 suspectscore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2303200000 definitions=main-2304200185 X-Proofpoint-GUID: eVa_uEkNxCkED3-hjFP5BOk_UZz7yDiN X-Proofpoint-ORIG-GUID: eVa_uEkNxCkED3-hjFP5BOk_UZz7yDiN Precedence: bulk List-ID: Relay files in debugfs is used to export information from kernel to userspace, relay user should tell whether the exported information is safe to access in lockdown mode or not. The access will be denied by default. v4 <- v3: refactor the code to make code more foolproof. v3 <- v2: allow only blktrace trace file instead of relay files https://lore.kernel.org/all/20230418172656.33583-1-junxiao.bi@oracle.com/ v2 <- v1: Fix build error when CONFIG_RELAY is not defined. Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202304121714.6mahd9EW-lkp@intel.com/ Signed-off-by: Junxiao Bi --- fs/debugfs/file.c | 11 +++++++++++ include/linux/relay.h | 16 ++++++++++++++++ kernel/relay.c | 17 +++++++++++++++++ 3 files changed, 44 insertions(+) diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c index 1f971c880dde..e12dd8634dc6 100644 --- a/fs/debugfs/file.c +++ b/fs/debugfs/file.c @@ -21,6 +21,7 @@ #include #include #include +#include #include "internal.h" @@ -142,6 +143,13 @@ EXPORT_SYMBOL_GPL(debugfs_file_put); * Only permit access to world-readable files when the kernel is locked down. * We also need to exclude any file that has ways to write or alter it as root * can bypass the permissions check. + * Exception: + * Relay files in debugfs are used by kernel to transfer data from kernel to + * userspace, these files are with permission 0400, but mmap is supported, so + * the access is blocked by default. But there are relay users like blktrace + * which will only export none security sensitive info to userspace, so provide + * a way for relay user to hook in to tell whether accessing the file in lockdown + * mode is safe or not. */ static int debugfs_locked_down(struct inode *inode, struct file *filp, @@ -154,6 +162,9 @@ static int debugfs_locked_down(struct inode *inode, !real_fops->mmap) return 0; + if (relay_bypass_lockdown(inode, real_fops)) + return 0; + if (security_locked_down(LOCKDOWN_DEBUGFS)) return -EPERM; diff --git a/include/linux/relay.h b/include/linux/relay.h index 72b876dd5cb8..0fd1fb638434 100644 --- a/include/linux/relay.h +++ b/include/linux/relay.h @@ -147,6 +147,19 @@ struct rchan_callbacks * This callback is mandatory. */ int (*remove_buf_file)(struct dentry *dentry); + + /* + * bypass_lockdown - check whether file can be accessed in lockdown mode. + * + * Called during file open. It depends on each relay user to tell whether + * accessing the file is safe or not in lockdown mode. + * + * The callback should return "true" if allowing access, "false" if not. + * + * This callback is optional. If not set, accessing the file will be + * denied in lockdown mode. + */ + bool (*bypass_lockdown)(struct inode *inode); }; /* @@ -279,8 +292,11 @@ extern const struct file_operations relay_file_operations; #ifdef CONFIG_RELAY int relay_prepare_cpu(unsigned int cpu); +extern bool relay_bypass_lockdown(struct inode *inode, + const struct file_operations *fops); #else #define relay_prepare_cpu NULL +#define relay_bypass_lockdown(inode, fops) (false) #endif #endif /* _LINUX_RELAY_H */ diff --git a/kernel/relay.c b/kernel/relay.c index 9aa70ae53d24..d5a76566ef62 100644 --- a/kernel/relay.c +++ b/kernel/relay.c @@ -1234,6 +1234,23 @@ static ssize_t relay_file_splice_read(struct file *in, return ret; } +bool relay_bypass_lockdown(struct inode *inode, + const struct file_operations *fops) +{ + struct rchan_buf *buf; + + /* Not a relay file */ + if (fops != &relay_file_operations) + return false; + + buf = (struct rchan_buf *)inode->i_private; + if (!buf->chan->cb->bypass_lockdown) + return false; + + return buf->chan->cb->bypass_lockdown(inode); +} +EXPORT_SYMBOL_GPL(relay_bypass_lockdown); + const struct file_operations relay_file_operations = { .open = relay_file_open, .poll = relay_file_poll, From patchwork Thu Apr 20 21:53:31 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junxiao Bi X-Patchwork-Id: 13219206 X-Patchwork-Delegate: paul@paul-moore.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B7340C7618E for ; Thu, 20 Apr 2023 21:53:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231996AbjDTVx6 (ORCPT ); Thu, 20 Apr 2023 17:53:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60148 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231728AbjDTVx5 (ORCPT ); Thu, 20 Apr 2023 17:53:57 -0400 Received: from mx0b-00069f02.pphosted.com (mx0b-00069f02.pphosted.com [205.220.177.32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5AA901730; Thu, 20 Apr 2023 14:53:56 -0700 (PDT) Received: from pps.filterd (m0246632.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 33KK1lhd002114; Thu, 20 Apr 2023 21:53:50 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : content-type : mime-version; s=corp-2023-03-30; bh=wX9gDl7MwAkkjyL5VOUvTctIf8owQ51L8PKd1cTmMaA=; b=l2nyumOkMnvAgH14dmDkBgdwYq/UpsszYGZV8qle9LjwTsvyaogxDsNU3vkjSYTAypZl uPy2iH/crATRzuWVRBN9yK/RG42B1yb4TIkzIkTNnhzxM/Or+PUpjJ2XoqRa7QJGMfV3 u10VGVDdGK6Xucn89GElK8mf4feiIuafEFMkZktcGGKhm/o3Vy06F2uEJDoumhNpO4Cx LEl2vqUye4pfLzdTjhJtcXDBDY9arwNT7AvWk43iGE+G/NcYMhrupS5II6Gnbi8TNa3l uIktl6xaOp0E/jsqRO3a0qMTqbkEf79ZQSaCGS522gF9LtvNzky7ENdhubdmAjuuTdIU Rg== Received: from phxpaimrmta03.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta03.appoci.oracle.com [138.1.37.129]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3pykhu40wx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 20 Apr 2023 21:53:50 +0000 Received: from pps.filterd (phxpaimrmta03.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta03.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.19/8.17.1.19) with ESMTP id 33KK666E037795; Thu, 20 Apr 2023 21:53:49 GMT Received: from nam11-bn8-obe.outbound.protection.outlook.com (mail-bn8nam11lp2168.outbound.protection.outlook.com [104.47.58.168]) by phxpaimrmta03.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3pyjc8ug3u-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 20 Apr 2023 21:53:49 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=S/xqLcQpfWFY054qOEX87zzOABp2ZyD1YHvoPCvL9ZlXyFqf9zEyWBuhMESrJpRt2nFL2qAqctay3aNKTTbQeJ+HoWLr4cpXr+HxgMc/j6RR8u+7L84J0P9Nl+TkcpV0KBzRlzZVWp23dZVVHltOhwgKJHUGNoQEz2uWpUOz/2XsbNIZy5lpyl9vFm/JvpF2jzf07fzTh/tGNUiUSXZR5tA9MoXSRIV1i31IRgNpbR78qTiKt9UDsmIYc1qfWmbjhWEpLQ41cwk6Tg7Nw/bxWphlXtkr2LnFtXcOxuXlrjUnTllAsDCnTNVhttuILUqFiXMINg0wHIS+UU4OwWyuaA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=wX9gDl7MwAkkjyL5VOUvTctIf8owQ51L8PKd1cTmMaA=; b=N7VQcNDFH+uVrYYBdzOfNaGHbO0/AM/rDyAL9gmOPG2uMpbycb+v80OGvA9adAOfm5i+neK+CVj0TKJPT+ksZUyn4kuqQQT0OfAmzuemyAW7vi8PBPegCSRn8RJYWYqX8CJrH7qhaOZyLycF7/Y7qdCPhC2mee60fAjFnRJ1YfDMRgNpMvnUkcpv8/edDuGvvZjCgW9wo+Xm9iupnSVxLDxRFdZwj5mSwFH63D3LQMOhtcPOQ+HgMBjvd6St/n6ZMHo/CSt3pBmDFFUPQJ1dsebIJ31ulmd/X1bBYD1GTA5N+w68f7qi+s+S2Z+ejHPKv/0VvWXJQZfZCI3BcQkOLg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=wX9gDl7MwAkkjyL5VOUvTctIf8owQ51L8PKd1cTmMaA=; b=xJlAqp9x7LeUvnP24iUPz/ITFukDbck/IXpKknDCKHDe2SSzl05D+dUlmSHvOE1XJyPOufhgv2eZVn/MGrR0ko/FBt38E03OXU061GsYizWaldsA4udL4ixjemV2j0x8H2ySOc6gYi9i8MxNIS5vcQ9yg9SetZzwv1Nrw9oxFbo= Received: from SJ0PR10MB4752.namprd10.prod.outlook.com (2603:10b6:a03:2d7::19) by PH7PR10MB7036.namprd10.prod.outlook.com (2603:10b6:510:274::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6298.45; Thu, 20 Apr 2023 21:53:47 +0000 Received: from SJ0PR10MB4752.namprd10.prod.outlook.com ([fe80::4a9d:b42c:57c7:b53c]) by SJ0PR10MB4752.namprd10.prod.outlook.com ([fe80::4a9d:b42c:57c7:b53c%5]) with mapi id 15.20.6319.022; Thu, 20 Apr 2023 21:53:47 +0000 From: Junxiao Bi To: linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-block@vger.kernel.org Cc: paul@paul-moore.com, nathanl@linux.ibm.com, axboe@kernel.dk, jmorris@namei.org, serge@hallyn.com, konrad.wilk@oracle.com, joe.jin@oracle.com, junxiao.bi@oracle.com Subject: [PATCH V4 2/2] blktrace: allow access trace file in lockdown mode Date: Thu, 20 Apr 2023 14:53:31 -0700 Message-Id: <20230420215331.88326-2-junxiao.bi@oracle.com> X-Mailer: git-send-email 2.24.3 (Apple Git-128) In-Reply-To: <20230420215331.88326-1-junxiao.bi@oracle.com> References: <20230420215331.88326-1-junxiao.bi@oracle.com> X-ClientProxiedBy: LO2P123CA0046.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600::34) To SJ0PR10MB4752.namprd10.prod.outlook.com (2603:10b6:a03:2d7::19) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SJ0PR10MB4752:EE_|PH7PR10MB7036:EE_ X-MS-Office365-Filtering-Correlation-Id: 8475b27d-7caa-44cd-898b-08db41e9b7b1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: cStGXCJumBZmjK7y7/xY93wbDZzDeNw66HwieSMtfsPT9TelKch8wrVrJxAXpnFX/51yEgsROPoKt6MLq1pUsP/8tDfPFRf4MuJ37Ck/VvBKdWe3f8BjuYl5vdhhHHUWzNshFmPZ+S77PzHZpI8eKA5BlGklYenKUHWqeP9nEcNJ3phwFDNHmOclk72GEPhK9qTgQnCpSZVPB2uOm0rw9suwJPmzdHF75cWamadbP/sj9NqUXBGsYhRpbuQnK9m8+EV5s8LtlpC0RCOku0Xm3VcH6tDFw152tgkUt/DBzg/KFqQ/JsVdrjjuSXV91x/Ny2bvs864G4sdGmwywCQdRfjd2brBgNx/uTq59oWzd1WrfwoPoqsQbAbBpaKFWDBnLi5GC04L9OoQ28yvniHzELAUGYeuE7peJ0znLklEpj0LN8a1xpFdXT1kBDaJZ7CRwWYDNT4aYP6raPVHEjx+LM319z8BsGhVZ5uzsIkjfnFRQwXe0LjoTpRTs/zgQdlgzMl9QyrgLLKw0MdnhVu0qKYyIHJ+8+v+ksFOS3R8dWErW92zJQCWuoS2Jdj2ML1v X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SJ0PR10MB4752.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230028)(366004)(39860400002)(376002)(396003)(346002)(136003)(451199021)(5660300002)(44832011)(2616005)(41300700001)(83380400001)(86362001)(107886003)(1076003)(6512007)(6506007)(186003)(38100700002)(8936002)(8676002)(478600001)(6666004)(6486002)(316002)(36756003)(66946007)(66556008)(66476007)(4326008)(2906002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 0w6YP0qNKeh5/qcqdLsJOa9BIDgbrk1IqhSHvQJtwSPTRMIHSlWF3lzC4UPhgMgAlsIfMFQGdI7MCybyMzIeT+GYLoyxLMtguoLsDtOQldj52F8qF5vH6PJevr4dY2bP8cubL7CdOEcy9HSssBKroenlgCDlrgcOlJiE3s4CtTtBrPEbPqzOM7c7aEKkeRMpavF8Fxy6nqq9R/Fnnj8PdnrH8DVcd5+qtm8xxMhx3agV5qA7VaNkIlarBeM9AYizNiAC/TY12SmtSGmdEh82mPHAvmHUCk5UgbDs/FMZ4OD0W9bNsxTEi2AG4wFAjBeUyXQuds5Yv/yqEmUssF9/KRfCjSkRsQDidmy3RRNoDntpUDp2X7ql9FDChxqDd5Wt4g57O6Kf+62IJ3U4Gj5MK7lycMU20XWUeA+qXNeevhgwwrSjZtZ7CfT5rN4FxqyBQjaJC89nFO3zfTJYGYIqOFB6r0gs7QCMkzlmAyoZoWnshjc3l9VWWUcEPKALTN31ANaUFRkUrsLD8rvbhzD/fLhj7SBTYM9sKqI4FcDCi1XeRNzkKv3kziLpofxRBAiOKYrAznUXo3fAPibnVhzhlQzOzVnfXCguSCINu3RTaOiexIxHbwb/fH1DchuYApn/CnYV71Anx2IZvsMCt9aHB9w0ebbJbt+uFDgaZ7En/VUkjVUGgqBWaYnS/FARYdoYBY0zl1euITJwMhfx1Nv3dBqZve930w9wZeopx3/t+oaO3RVGVlCIGeZXuHAoY3nYVyH0Mjp4ZGYQwWsJy4AcPj3KMqExXr88SGjyTtmjhPFTqtN/JX+4fK5EKL05rsJa6uu911vwd5sqYXtqFFAK27bqopfflsEtOrJsjhrjML9P8miXsUyCuNnM87GBqN4Cm7cy0Pl0S+MrRgQ3cLsNoG1T61sWN4o90woFu9Scr7Iq3XPg7yjkkM5gG8crw7+cXV2EX/uMW6K/DjinrtYT5qK2jwkI0QYlxumwd9A8da3MyB0oze49jlVmEbPRaq4q+pR+M3SbJTCWWnKt1zOTaMBoJOSKk/q6c1+HQKSpGukUVsaXKlUn9rYTBsvrZ6jMWO3xyzFaWmJCapwPxOIqifJlce33w7H/5HgWVkSI5+F9N0YxP+/vPR/z/vABSYkP2Csg8KDc+TCZKNSOysQO9QXzrDgS454jzsWaax7mbxhM3oBhp8Ca8SvvECgKS72pAY21DaXOa05LApJe/xhM0Arv36mB2gJJywKm3RYGP3aIljNo5mONEddWY7/XIBVfmwSdlEgpzvGGiIEkZOIVOdUFffGqDl1/yRuhVvrbjwxefkeiHy2uH0M7exmjjOQwxL4fzr7vegnnj0LkyOnIwn1oE5XEU9yLvuinBfdDH/MEaKJAVjMgIMK7c6BGMvHflpjJwZmnY+rrARwo/7A2DY6+sfbA9NaJBY04kc+TK5Y2AiwFUqT5NOhefOvw+SSDD68h91ryMyAHek/1B1puLNyuTbxgbMAFVreWXsl2iXR8TFZn+yQw6EunCzBtBsqt91U6FpaoZDW/n9EJugzVYtMfQLAzbCXNwejbE4B4/ogtitRCCEI7wls3tfnw1nAjF96WN3REQj/gEgOMhK0OfWOy8vOsMubyZWn7IOxjJjM= X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 8/teiFWywI+2Mj+wtW7IKGiQ4nz1HKAcQT5L0SifLzS6LjT6Jhethhai497x56Ta9ZOPchGV9lAENoD9gEmUmFJkrDFEpwRHlZ27gt71iVRDDFhRnPh8qq6v0G38FNSsnKa/rm3VGnwuShv9zpsZCX+7teTYYJuJyIasvrzZw9wAt++Ce4iw0aZkQPjz0cT2TuQcFC4A5pZX6KB6GgS9waKMRh9c1UsHSEU/+fGgBnIXgNJsomTQqgz6hUajemkvidjL1Yr8WYd7NXy5Vfo6zu+XEDC0pd7XpMdQZF4NgVGjMg9DU9UI92QfqjWAa8CHaB7u5Ski4M0PABbQqR640sdCe/S4gFjQsVyqCOTkJptSPDc2uCIblGN4uzLYYoUu2Yleg55jidvDeH7k9vJVcs3eGozEkByGKaCdcRSDUyWEmCeUgnpkbSlg2RHYWLwyVqI680TNe3U7kO3j77pdPR4YulkHSyI2jnfTY+1viJt96t7ns4cDKhyAWhLTBYxxHCk8Bqu0pzxgEFBqV/H+2J+FaY1Wx5XH9ULwPEc5dB6KC7elQkg5N70NfJyKgcWBsWtO/BdBvwH1sOraA09v90fHYgEx9cgEH9lUXKpVbkkWBiNgYUhVvRmPs2Bk51ao0yHH+rejBHl+RvDQgkxKT0WVdUpLeYLqwG2LT+uHfRrZPTIIID5Fk6GEuE/uJuYUwCQhcT1BR513jXVNiWbT2+hmEY51JBU4ZJiRDv6QqZNeq8s58kMgJHc0oZFRMaKsyLWqRpnFDCUJxalKX6s8TcFwsYb5I48gMDN0aw4KC7bsKHEzaRzOxKL6X+VaNU3VtJVGdE+UIVn6cSdVGKbkJSssMxutkKLBuf7JraZXGZBkcgbAtecC7T4or3JhqNq0RFw7JWkuiTBsT0UUdznYW6CaimeEC9M3tO2mdAA9njg= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8475b27d-7caa-44cd-898b-08db41e9b7b1 X-MS-Exchange-CrossTenant-AuthSource: SJ0PR10MB4752.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Apr 2023 21:53:47.3150 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: ES19ecZs3TZgThBm68jH9aTMota3q3yEpiqmNVpgTUb5FrsDbGKgWVNd+RIc8vRpiuGYDpZUc20OhyLhoqTHug== X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR10MB7036 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.254,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-04-20_15,2023-04-20_01,2023-02-09_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=999 adultscore=0 spamscore=0 malwarescore=0 suspectscore=0 mlxscore=0 phishscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2303200000 definitions=main-2304200185 X-Proofpoint-GUID: _nEKtGSYN58_925wjIfNpUeL4LuoX7mu X-Proofpoint-ORIG-GUID: _nEKtGSYN58_925wjIfNpUeL4LuoX7mu Precedence: bulk List-ID: blktrace trace files are per-cpu relay files that are used by kernel to export IO metadata(IO events, type, target disk, offset and len etc.) to userspace, no data from IO itself will be exported. Bypass lockdown for these files will make blktrace work in lockdown mode. Signed-off-by: Junxiao Bi --- kernel/trace/blktrace.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c index d5d94510afd3..e1a9f8b7d710 100644 --- a/kernel/trace/blktrace.c +++ b/kernel/trace/blktrace.c @@ -490,10 +490,16 @@ static struct dentry *blk_create_buf_file_callback(const char *filename, &relay_file_operations); } +static bool blk_bypass_lockdown(struct inode *inode) +{ + return true; +} + static const struct rchan_callbacks blk_relay_callbacks = { .subbuf_start = blk_subbuf_start_callback, .create_buf_file = blk_create_buf_file_callback, .remove_buf_file = blk_remove_buf_file_callback, + .bypass_lockdown = blk_bypass_lockdown, }; static void blk_trace_setup_lba(struct blk_trace *bt,