Re: Hardening debugfs (Was Re: [PATCH] debugfs: more tightly restrict default mount mode)

[Rob Landley <rob@landley.net>]

On 08/28/2012 09:41 AM, Theodore Ts'o wrote:
> On Mon, Aug 27, 2012 at 01:32:15PM -0700, Kees Cook wrote:
>> Since the debugfs is mostly only used by root, make the default mount
>> mode 0700. Most system owners do not need a more permissive value,
>> but they can choose to weaken the restrictions via their fstab.
>>
>> Signed-off-by: Kees Cook <keescook@chromium.org>
> 
> I agree with this patch, but it would also be good if we could try to
> harden debugfs in general.  Some ideas that might be worth discussing,
> for example?
> 
> 1) Adding a per-module flag, so things in debugfs only show up if they
> are explicitly requested (you know, for debugging purposes). If most
> people are using debugfs for access to ftrace and powertap (my use
> case), there's no point making directories for other device drivers
> and file systems visible.

Are you suggesting "echo 1 > /sys/module/mymod/debug", or are you
suggesting "mount -t devfs -o mymod /tmp/mymod", or knobs in devfs?

I've always been a bit confused by the debugfs design, which seems a
giant compost heap like /proc where we find a specific styrofoam cup
useful and the temporary thing becomes permanent. (Why is there _one_
debugfs?)

Oh well, presumably too late to change it now. (Unless you mount a tmpfs
on /sys/kernel/debug and mkdir mount points in there, but in the
perpetual absence of union mounts it would probably involve
userspace-visible path changes...)

> 2) Can we find a pattern of common security #fail's with debugfs
> files, and try to sweep through and fix them?
> 
> There may be other ideas, and again, I'm not saying that this means we
> shouldn't lock down the permissions on debugfs.  But a both/and
> approach might be useful here....

Plenty of other ideas, but it says "there are no usage rules" right
there in the documentation file which makes compatible cleanup hard...

Rob
-- 
GNU/Linux isn't: Linux=GPLv2, GNU=GPLv3+, they can't share code.
Either it's "mere aggregation", or a license violation.  Pick one.