From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Howells Subject: Re: [PATCH 15/24] asus-wmi: Restrict debugfs interface when the kernel is locked down Date: Tue, 18 Apr 2017 16:30:34 +0100 Message-ID: <16503.1492529434@warthog.procyon.org.uk> References: <1492526075.2409.140.camel@decadent.org.uk> <149142326734.5101.4596394505987813763.stgit@warthog.procyon.org.uk> <149142340198.5101.8171352010918423590.stgit@warthog.procyon.org.uk> <31421.1491569449@warthog.procyon.org.uk> <13615.1491830208@warthog.procyon.org.uk> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Return-path: In-Reply-To: <1492526075.2409.140.camel@decadent.org.uk> Content-ID: <16502.1492529434.1@warthog.procyon.org.uk> Sender: owner-linux-security-module@vger.kernel.org To: Ben Hutchings Cc: dhowells@redhat.com, Andy Shevchenko , "linux-kernel@vger.kernel.org" , matthew.garrett@nebula.com, linux-efi@vger.kernel.org, One Thousand Gnomes , Greg Kroah-Hartman , acpi4asus-user , Platform Driver , linux-security-module , keyrings@vger.kernel.org List-Id: platform-driver-x86.vger.kernel.org Ben Hutchings wrote: > So it's generally not going to be OK to turn off debugfs. There will > probably need to be a distinction between believed-safe and unsafe > directories/files. Any suggestion on how to mark this distinction? I'd prefer not to modify every read/write op associated with a debugfs file. Modify DEFINE_DEBUGFS_ATTRIBUTE() maybe? And provide lockable variants of debugfs_create_u8() and co.? David