[kernel-hardening] [RFC v1] debugfs mount options

[kernel-hardening] [RFC v1] debugfs mount options

[Vasiliy Kulikov]

[-- Attachment #1: Type: text/plain, Size: 3595 bytes --]

This patch adds support of 2 debugfs mount options:

umask=0XXX - umask for newly created debugfs files.

gid=YYY - gid for newly created debugfs files.

While implementing it, I realized that it is probably more usefull to
implement it as 2 sysctls and CONFIG_DEBUGFS_* options - a lot of
debugfs files are created at the boot time, so it makes sense to change
these setting at the compile time and not to bother with chmod'ing
already created files.

diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
index d38c88f..5af9658 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -21,8 +21,10 @@
 #include <linux/kobject.h>
 #include <linux/namei.h>
 #include <linux/debugfs.h>
+#include <linux/parser.h>
 #include <linux/fsnotify.h>
 #include <linux/string.h>
+#include <linux/seq_file.h>
 #include <linux/magic.h>
 #include <linux/slab.h>
 
@@ -30,6 +32,9 @@ static struct vfsmount *debugfs_mount;
 static int debugfs_mount_count;
 static bool debugfs_registered;
 
+unsigned int debugfs_umask;
+gid_t debugfs_gid;
+
 static struct inode *debugfs_get_inode(struct super_block *sb, int mode, dev_t dev,
 				       void *data, const struct file_operations *fops)
 
@@ -63,8 +68,10 @@ static struct inode *debugfs_get_inode(struct super_block *sb, int mode, dev_t d
 			inc_nlink(inode);
 			break;
 		}
+		inode->i_mode &= ~(0777 & debugfs_umask);
+		inode->i_gid = debugfs_gid;
 	}
-	return inode; 
+	return inode;
 }
 
 /* SMP-safe */
@@ -125,11 +132,85 @@ static inline int debugfs_positive(struct dentry *dentry)
 	return dentry->d_inode && !d_unhashed(dentry);
 }
 
+enum {
+	Opt_gid, Opt_umask, Opt_err
+};
+
+static const match_table_t debug_tokens = {
+	{Opt_gid, "gid=%u"},
+	{Opt_umask, "umask=%o"},
+	{Opt_err, NULL},
+};
+
+static int debug_parse_options(char *options, struct super_block *sb)
+{
+	char *p;
+	substring_t args[MAX_OPT_ARGS];
+	int option;
+
+	if (!options)
+		return 1;
+
+	while ((p = strsep(&options, ",")) != NULL) {
+		int token;
+		if (!*p)
+			continue;
+
+		token = match_token(p, debug_tokens, args);
+		switch (token) {
+		case Opt_gid:
+			if (match_int(&args[0], &option))
+				return 0;
+			debugfs_gid = option;
+			break;
+		case Opt_umask:
+			if (match_octal(&args[0], &option))
+				return 0;
+			debugfs_umask = option;
+			break;
+		default:
+			pr_err("debugfs: unrecognized mount option \"%s\" "
+			       "or missing value", p);
+			return 0;
+		}
+	}
+	return 1;
+}
+
+static int debug_remount_fs(struct super_block *sb, int *flags, char *options)
+{
+	if (debug_parse_options(options, sb))
+		return 0;
+	else
+		return -EINVAL;
+}
+
+int debug_show_options(struct seq_file *seq, struct vfsmount *vfs)
+{
+	if (debugfs_umask)
+		seq_printf(seq, ",umask=%o", debugfs_umask);
+	if (debugfs_gid)
+		seq_printf(seq, ",gid=%lu", (unsigned long)debugfs_gid);
+	return 0;
+}
+
+static const struct super_operations debug_super_operations = {
+	.statfs		= simple_statfs,
+	.remount_fs	= debug_remount_fs,
+	.show_options   = debug_show_options,
+};
+
 static int debug_fill_super(struct super_block *sb, void *data, int silent)
 {
 	static struct tree_descr debug_files[] = {{""}};
+	int err;
+
+	if (!debug_parse_options(data, sb))
+		return -EINVAL;
 
-	return simple_fill_super(sb, DEBUGFS_MAGIC, debug_files);
+	sb->s_op = &debug_super_operations;
+	err = simple_fill_super(sb, DEBUGFS_MAGIC, debug_files);
+	return err;
 }
 
 static struct dentry *debug_mount(struct file_system_type *fs_type,
--

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 836 bytes --]

[kernel-hardening] Re: [RFC v1] debugfs mount options

[Vasiliy Kulikov]

[-- Attachment #1: Type: text/plain, Size: 663 bytes --]

On Sun, Jun 05, 2011 at 22:28 +0400, Vasiliy Kulikov wrote:
> While implementing it, I realized that it is probably more usefull to
> implement it as 2 sysctls and CONFIG_DEBUGFS_* options - a lot of
> debugfs files are created at the boot time, so it makes sense to change
> these setting at the compile time and not to bother with chmod'ing
> already created files.

The same for configfs.  However, I'm hesitating to mention sysfs as it
will be divided into well defined per-namespace parts in the future and
global sysfs umask would be confusing.

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 836 bytes --]

Re: [kernel-hardening] [RFC v1] debugfs mount options

[Solar Designer]

On Sun, Jun 05, 2011 at 10:30:27PM +0400, Vasiliy Kulikov wrote:
> On Sun, Jun 05, 2011 at 22:28 +0400, Vasiliy Kulikov wrote:
> > While implementing it, I realized that it is probably more usefull to
> > implement it as 2 sysctls and CONFIG_DEBUGFS_* options - a lot of
> > debugfs files are created at the boot time, so it makes sense to change
> > these setting at the compile time and not to bother with chmod'ing
> > already created files.
> 
> The same for configfs.  However, I'm hesitating to mention sysfs as it
> will be divided into well defined per-namespace parts in the future and
> global sysfs umask would be confusing.

I can't really comment on this.

However, please note that some Linux distros running in containers will
happen to mount sysfs, which with OpenVZ provides some very limited
functionality (just to make those distros happy).  Perhaps whatever you
implement will need to be consistent/compatible with that.

Alexander

Re: [kernel-hardening] [RFC v1] debugfs mount options

[Vasiliy Kulikov]

[-- Attachment #1: Type: text/plain, Size: 532 bytes --]

Solar,

On Sun, Jun 05, 2011 at 23:44 +0400, Solar Designer wrote:
> However, please note that some Linux distros running in containers will
> happen to mount sysfs, which with OpenVZ provides some very limited
> functionality (just to make those distros happy).  Perhaps whatever you
> implement will need to be consistent/compatible with that.

Ah, I used OpenVZ with sysfs feature disabled.  I thought it is just
left blank.  In the code I see it is indeed functional.  Will look into
this.

Thanks!

-- 
Vasiliy

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 836 bytes --]