* [PATCH] lockdown: ratelimit denial messages
@ 2022-09-08 22:02 Nathan Lynch
2022-09-09 14:05 ` Paul Moore
0 siblings, 1 reply; 3+ messages in thread
From: Nathan Lynch @ 2022-09-08 22:02 UTC (permalink / raw)
To: linux-security-module; +Cc: linux-kernel, paul, jmorris, serge
User space can flood the log with lockdown denial messages:
[ 662.555584] Lockdown: bash: debugfs access is restricted; see man kernel_lockdown.7
[ 662.563237] Lockdown: bash: debugfs access is restricted; see man kernel_lockdown.7
[ 662.571134] Lockdown: bash: debugfs access is restricted; see man kernel_lockdown.7
[ 662.578668] Lockdown: bash: debugfs access is restricted; see man kernel_lockdown.7
[ 662.586021] Lockdown: bash: debugfs access is restricted; see man kernel_lockdown.7
[ 662.593398] Lockdown: bash: debugfs access is restricted; see man kernel_lockdown.7
Ratelimiting these shouldn't meaningfully degrade the quality of the
information logged.
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
---
security/lockdown/lockdown.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
index 87cbdc64d272..a79b985e917e 100644
--- a/security/lockdown/lockdown.c
+++ b/security/lockdown/lockdown.c
@@ -63,7 +63,7 @@ static int lockdown_is_locked_down(enum lockdown_reason what)
if (kernel_locked_down >= what) {
if (lockdown_reasons[what])
- pr_notice("Lockdown: %s: %s is restricted; see man kernel_lockdown.7\n",
+ pr_notice_ratelimited("Lockdown: %s: %s is restricted; see man kernel_lockdown.7\n",
current->comm, lockdown_reasons[what]);
return -EPERM;
}
--
2.37.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] lockdown: ratelimit denial messages
2022-09-08 22:02 [PATCH] lockdown: ratelimit denial messages Nathan Lynch
@ 2022-09-09 14:05 ` Paul Moore
2022-09-14 11:43 ` Paul Moore
0 siblings, 1 reply; 3+ messages in thread
From: Paul Moore @ 2022-09-09 14:05 UTC (permalink / raw)
To: Nathan Lynch; +Cc: linux-security-module, linux-kernel, jmorris, serge
On Thu, Sep 8, 2022 at 6:02 PM Nathan Lynch <nathanl@linux.ibm.com> wrote:
>
> User space can flood the log with lockdown denial messages:
>
> [ 662.555584] Lockdown: bash: debugfs access is restricted; see man kernel_lockdown.7
> [ 662.563237] Lockdown: bash: debugfs access is restricted; see man kernel_lockdown.7
> [ 662.571134] Lockdown: bash: debugfs access is restricted; see man kernel_lockdown.7
> [ 662.578668] Lockdown: bash: debugfs access is restricted; see man kernel_lockdown.7
> [ 662.586021] Lockdown: bash: debugfs access is restricted; see man kernel_lockdown.7
> [ 662.593398] Lockdown: bash: debugfs access is restricted; see man kernel_lockdown.7
>
> Ratelimiting these shouldn't meaningfully degrade the quality of the
> information logged.
>
> Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
> ---
> security/lockdown/lockdown.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
This seems reasonable. While the last visible lockdown message to the
console might be incorrect/old, I think it would give the user a good
indication that lockdown is being hit and hopefully preserve the start
of the denial storm. It is also worth noting that this does introduce
a spinlock to this code path, but since it is only an issue on error I
doubt it will have any significant impact.
I'll leave this until next week to give people a chance to
comment/object, but if there are no further comments I'll plan on
merging this into lsm/next.
> diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
> index 87cbdc64d272..a79b985e917e 100644
> --- a/security/lockdown/lockdown.c
> +++ b/security/lockdown/lockdown.c
> @@ -63,7 +63,7 @@ static int lockdown_is_locked_down(enum lockdown_reason what)
>
> if (kernel_locked_down >= what) {
> if (lockdown_reasons[what])
> - pr_notice("Lockdown: %s: %s is restricted; see man kernel_lockdown.7\n",
> + pr_notice_ratelimited("Lockdown: %s: %s is restricted; see man kernel_lockdown.7\n",
> current->comm, lockdown_reasons[what]);
> return -EPERM;
> }
> --
> 2.37.1
--
paul-moore.com
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] lockdown: ratelimit denial messages
2022-09-09 14:05 ` Paul Moore
@ 2022-09-14 11:43 ` Paul Moore
0 siblings, 0 replies; 3+ messages in thread
From: Paul Moore @ 2022-09-14 11:43 UTC (permalink / raw)
To: Nathan Lynch; +Cc: linux-security-module, linux-kernel, jmorris, serge
On Fri, Sep 9, 2022 at 10:05 AM Paul Moore <paul@paul-moore.com> wrote:
> On Thu, Sep 8, 2022 at 6:02 PM Nathan Lynch <nathanl@linux.ibm.com> wrote:
> >
> > User space can flood the log with lockdown denial messages:
> >
> > [ 662.555584] Lockdown: bash: debugfs access is restricted; see man kernel_lockdown.7
> > [ 662.563237] Lockdown: bash: debugfs access is restricted; see man kernel_lockdown.7
> > [ 662.571134] Lockdown: bash: debugfs access is restricted; see man kernel_lockdown.7
> > [ 662.578668] Lockdown: bash: debugfs access is restricted; see man kernel_lockdown.7
> > [ 662.586021] Lockdown: bash: debugfs access is restricted; see man kernel_lockdown.7
> > [ 662.593398] Lockdown: bash: debugfs access is restricted; see man kernel_lockdown.7
> >
> > Ratelimiting these shouldn't meaningfully degrade the quality of the
> > information logged.
> >
> > Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
> > ---
> > security/lockdown/lockdown.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
>
> This seems reasonable. While the last visible lockdown message to the
> console might be incorrect/old, I think it would give the user a good
> indication that lockdown is being hit and hopefully preserve the start
> of the denial storm. It is also worth noting that this does introduce
> a spinlock to this code path, but since it is only an issue on error I
> doubt it will have any significant impact.
>
> I'll leave this until next week to give people a chance to
> comment/object, but if there are no further comments I'll plan on
> merging this into lsm/next.
Now merged into lsm/next, thanks!
--
paul-moore.com
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-09-14 11:43 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-09-08 22:02 [PATCH] lockdown: ratelimit denial messages Nathan Lynch
2022-09-09 14:05 ` Paul Moore
2022-09-14 11:43 ` Paul Moore
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).