[PATCH] debugfs: allow access relay files in lockdown mode

[PATCH] debugfs: allow access relay files in lockdown mode

[Junxiao Bi]

Relay files are used by kernel to transfer information to userspace, these
files have permission 0400, but mmap is supported, so they are blocked by
lockdown. But since kernel just generates the contents of those files while
not reading it, it is saft to access relay files in lockdown mode.

With this, blktrace can work well in lockdown mode.

Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
---
 fs/debugfs/file.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
index 1f971c880dde..04fa813a227e 100644
--- a/fs/debugfs/file.c
+++ b/fs/debugfs/file.c
@@ -21,6 +21,7 @@
 #include <linux/pm_runtime.h>
 #include <linux/poll.h>
 #include <linux/security.h>
+#include <linux/relay.h>
 
 #include "internal.h"
 
@@ -142,6 +143,11 @@ EXPORT_SYMBOL_GPL(debugfs_file_put);
  * Only permit access to world-readable files when the kernel is locked down.
  * We also need to exclude any file that has ways to write or alter it as root
  * can bypass the permissions check.
+ * Exception:
+ * Relay files are used by kernel to transfer information to userspace, these
+ * files have permission 0400, but mmap is supported, so they are blocked by
+ * lockdown. But since kernel just generates the contents of those files while
+ * not reading it, it is saft to access relay files in lockdown mode.
  */
 static int debugfs_locked_down(struct inode *inode,
 			       struct file *filp,
@@ -154,6 +160,9 @@ static int debugfs_locked_down(struct inode *inode,
 	    !real_fops->mmap)
 		return 0;
 
+	if (real_fops == &relay_file_operations)
+		return 0;
+
 	if (security_locked_down(LOCKDOWN_DEBUGFS))
 		return -EPERM;
 
-- 
2.24.3 (Apple Git-128)

Re: [PATCH] debugfs: allow access relay files in lockdown mode

[kernel test robot]

Hi Junxiao,

kernel test robot noticed the following build errors:

[auto build test ERROR on driver-core/driver-core-testing]
[also build test ERROR on driver-core/driver-core-next driver-core/driver-core-linus linus/master v6.3-rc6 next-20230412]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Junxiao-Bi/debugfs-allow-access-relay-files-in-lockdown-mode/20230412-081241
patch link:    https://lore.kernel.org/r/20230412001030.88441-1-junxiao.bi%40oracle.com
patch subject: [PATCH] debugfs: allow access relay files in lockdown mode
config: i386-randconfig-a015-20230410 (https://download.01.org/0day-ci/archive/20230412/202304121714.6mahd9EW-lkp@intel.com/config)
compiler: gcc-11 (Debian 11.3.0-8) 11.3.0
reproduce (this is a W=1 build):
        # https://github.com/intel-lab-lkp/linux/commit/7891278613631bb6076e7b4603c1e907d1304cfa
        git remote add linux-review https://github.com/intel-lab-lkp/linux
        git fetch --no-tags linux-review Junxiao-Bi/debugfs-allow-access-relay-files-in-lockdown-mode/20230412-081241
        git checkout 7891278613631bb6076e7b4603c1e907d1304cfa
        # save the config file
        mkdir build_dir && cp config build_dir/.config
        make W=1 O=build_dir ARCH=i386 olddefconfig
        make W=1 O=build_dir ARCH=i386 SHELL=/bin/bash

If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@intel.com>
| Link: https://lore.kernel.org/oe-kbuild-all/202304121714.6mahd9EW-lkp@intel.com/

All errors (new ones prefixed by >>):

   ld: fs/debugfs/file.o: in function `debugfs_locked_down':
>> fs/debugfs/file.c:163: undefined reference to `relay_file_operations'


vim +163 fs/debugfs/file.c

   141	
   142	/*
   143	 * Only permit access to world-readable files when the kernel is locked down.
   144	 * We also need to exclude any file that has ways to write or alter it as root
   145	 * can bypass the permissions check.
   146	 * Exception:
   147	 * Relay files are used by kernel to transfer information to userspace, these
   148	 * files have permission 0400, but mmap is supported, so they are blocked by
   149	 * lockdown. But since kernel just generates the contents of those files while
   150	 * not reading it, it is saft to access relay files in lockdown mode.
   151	 */
   152	static int debugfs_locked_down(struct inode *inode,
   153				       struct file *filp,
   154				       const struct file_operations *real_fops)
   155	{
   156		if ((inode->i_mode & 07777 & ~0444) == 0 &&
   157		    !(filp->f_mode & FMODE_WRITE) &&
   158		    !real_fops->unlocked_ioctl &&
   159		    !real_fops->compat_ioctl &&
   160		    !real_fops->mmap)
   161			return 0;
   162	
 > 163		if (real_fops == &relay_file_operations)
   164			return 0;
   165	
   166		if (security_locked_down(LOCKDOWN_DEBUGFS))
   167			return -EPERM;
   168	
   169		return 0;
   170	}
   171	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests

Re: [PATCH] debugfs: allow access relay files in lockdown mode

[kernel test robot]

Hi Junxiao,

kernel test robot noticed the following build errors:

[auto build test ERROR on driver-core/driver-core-testing]
[also build test ERROR on driver-core/driver-core-next driver-core/driver-core-linus linus/master v6.3-rc6 next-20230412]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Junxiao-Bi/debugfs-allow-access-relay-files-in-lockdown-mode/20230412-081241
patch link:    https://lore.kernel.org/r/20230412001030.88441-1-junxiao.bi%40oracle.com
patch subject: [PATCH] debugfs: allow access relay files in lockdown mode
config: powerpc-buildonly-randconfig-r003-20230410 (https://download.01.org/0day-ci/archive/20230412/202304121808.IDucPQw7-lkp@intel.com/config)
compiler: powerpc-linux-gcc (GCC) 12.1.0
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/intel-lab-lkp/linux/commit/7891278613631bb6076e7b4603c1e907d1304cfa
        git remote add linux-review https://github.com/intel-lab-lkp/linux
        git fetch --no-tags linux-review Junxiao-Bi/debugfs-allow-access-relay-files-in-lockdown-mode/20230412-081241
        git checkout 7891278613631bb6076e7b4603c1e907d1304cfa
        # save the config file
        mkdir build_dir && cp config build_dir/.config
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross W=1 O=build_dir ARCH=powerpc olddefconfig
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross W=1 O=build_dir ARCH=powerpc SHELL=/bin/bash

If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@intel.com>
| Link: https://lore.kernel.org/oe-kbuild-all/202304121808.IDucPQw7-lkp@intel.com/

All errors (new ones prefixed by >>):

   powerpc-linux-ld: fs/debugfs/file.o: in function `debugfs_locked_down':
   fs/debugfs/file.c:163: undefined reference to `relay_file_operations'
>> powerpc-linux-ld: fs/debugfs/file.c:163: undefined reference to `relay_file_operations'

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests