lkml.org 
[lkml]   [2012]   [Aug]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Hardening debugfs (Was Re: [PATCH] debugfs: more tightly restrict default mount mode)
On 08/28/2012 09:41 AM, Theodore Ts'o wrote:
> On Mon, Aug 27, 2012 at 01:32:15PM -0700, Kees Cook wrote:
>> Since the debugfs is mostly only used by root, make the default mount
>> mode 0700. Most system owners do not need a more permissive value,
>> but they can choose to weaken the restrictions via their fstab.
>>
>> Signed-off-by: Kees Cook <keescook@chromium.org>
>
> I agree with this patch, but it would also be good if we could try to
> harden debugfs in general. Some ideas that might be worth discussing,
> for example?
>
> 1) Adding a per-module flag, so things in debugfs only show up if they
> are explicitly requested (you know, for debugging purposes). If most
> people are using debugfs for access to ftrace and powertap (my use
> case), there's no point making directories for other device drivers
> and file systems visible.

Are you suggesting "echo 1 > /sys/module/mymod/debug", or are you
suggesting "mount -t devfs -o mymod /tmp/mymod", or knobs in devfs?

I've always been a bit confused by the debugfs design, which seems a
giant compost heap like /proc where we find a specific styrofoam cup
useful and the temporary thing becomes permanent. (Why is there _one_
debugfs?)

Oh well, presumably too late to change it now. (Unless you mount a tmpfs
on /sys/kernel/debug and mkdir mount points in there, but in the
perpetual absence of union mounts it would probably involve
userspace-visible path changes...)

> 2) Can we find a pattern of common security #fail's with debugfs
> files, and try to sweep through and fix them?
>
> There may be other ideas, and again, I'm not saying that this means we
> shouldn't lock down the permissions on debugfs. But a both/and
> approach might be useful here....

Plenty of other ideas, but it says "there are no usage rules" right
there in the documentation file which makes compatible cleanup hard...

Rob
--
GNU/Linux isn't: Linux=GPLv2, GNU=GPLv3+, they can't share code.
Either it's "mere aggregation", or a license violation. Pick one.


\
 
 \ /
  Last update: 2012-08-29 02:41    [W:0.124 / U:0.016 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site