Re: Hardening debugfs (Was Re: [PATCH] debugfs: more tightly restrict default mount mode)

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Tue, Aug 28, 2012 at 10:41:10AM -0400, Theodore Ts'o wrote:
> On Mon, Aug 27, 2012 at 01:32:15PM -0700, Kees Cook wrote:
> > Since the debugfs is mostly only used by root, make the default mount
> > mode 0700. Most system owners do not need a more permissive value,
> > but they can choose to weaken the restrictions via their fstab.
> > 
> > Signed-off-by: Kees Cook <keescook@chromium.org>
> 
> I agree with this patch, but it would also be good if we could try to
> harden debugfs in general.  Some ideas that might be worth discussing,
> for example?
> 
> 1) Adding a per-module flag, so things in debugfs only show up if they
> are explicitly requested (you know, for debugging purposes).  If most
> people are using debugfs for access to ftrace and powertap (my use
> case), there's no point making directories for other device drivers
> and file systems visible.

The module code is "explicitly requesting" a debugfs file when it makes
the call to create it.  If you want to depend on a flag for the
individual modules to do this or not, sure, go ahead, but that's a
module/driver issue, nothing I can do in the debugfs core itself.

> 2) Can we find a pattern of common security #fail's with debugfs
> files, and try to sweep through and fix them?

The only one I know of is the "unload the module with an open file
handle" issue.  I'm pretty sure this could be fixed up somehow in
debugfs, much like it was resolved in sysfs, but it would take a lot of
work, for a very limited benefit (in other words, if someone sends me
patches for this, great, but it's so low on my TODO list that I'll
probably never get to it myself.)

thanks,

greg k-h