lkml.org 
[lkml]   [2021]   [Nov]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 087/251] tracefs: Have tracefs directories not set OTH permission bits by default
    Date
    From: Steven Rostedt (VMware) <rostedt@goodmis.org>

    [ Upstream commit 49d67e445742bbcb03106b735b2ab39f6e5c56bc ]

    The tracefs file system is by default mounted such that only root user can
    access it. But there are legitimate reasons to create a group and allow
    those added to the group to have access to tracing. By changing the
    permissions of the tracefs mount point to allow access, it will allow
    group access to the tracefs directory.

    There should not be any real reason to allow all access to the tracefs
    directory as it contains sensitive information. Have the default
    permission of directories being created not have any OTH (other) bits set,
    such that an admin that wants to give permission to a group has to first
    disable all OTH bits in the file system.

    Link: https://lkml.kernel.org/r/20210818153038.664127804@goodmis.org

    Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/tracefs/inode.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
    index bea8ad876bf9a..0c123c5e70e08 100644
    --- a/fs/tracefs/inode.c
    +++ b/fs/tracefs/inode.c
    @@ -427,7 +427,8 @@ static struct dentry *__create_dir(const char *name, struct dentry *parent,
    if (unlikely(!inode))
    return failed_creating(dentry);

    - inode->i_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO;
    + /* Do not set bits for OTH */
    + inode->i_mode = S_IFDIR | S_IRWXU | S_IRUSR| S_IRGRP | S_IXUSR | S_IXGRP;
    inode->i_op = ops;
    inode->i_fop = &simple_dir_operations;

    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-24 13:40    [W:4.315 / U:0.248 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site