On Tue, Mar 26, 2019 at 5:31 PM Greg KH <gregkh@xxxxxxxxxxxxxxxxxxx> wrote: > On Tue, Mar 26, 2019 at 11:27:41AM -0700, Matthew Garrett wrote: > > From: Matthew Garrett <mjg59@xxxxxxxxxx> > > > > debugfs has not been meaningfully audited in terms of ensuring that > > userland cannot trample over the kernel. At Greg's request, disable > > access to it entirely when the kernel is locked down. This is done at > > open() time rather than init time as the kernel lockdown status may be > > made stricter at runtime. (snip) > Why allow all this, why not just abort the registering of the filesystem > with the vfs core so it can't even be mounted? As mentioned in the commit message, because the lockdown state can be made stricter at runtime - blocking at mount time would be inconsistent if the machine is locked down afterwards. We could potentially assert that it's the admin's responsibility to ensure that debugfs isn't mounted at the point of policy being made stricter?
