On Mon, Aug 27, 2012 at 01:32:15PM -0700, Kees Cook wrote: > Since the debugfs is mostly only used by root, make the default mount > mode 0700. Most system owners do not need a more permissive value, > but they can choose to weaken the restrictions via their fstab. > > Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx> I agree with this patch, but it would also be good if we could try to harden debugfs in general. Some ideas that might be worth discussing, for example? 1) Adding a per-module flag, so things in debugfs only show up if they are explicitly requested (you know, for debugging purposes). If most people are using debugfs for access to ftrace and powertap (my use case), there's no point making directories for other device drivers and file systems visible. 2) Can we find a pattern of common security #fail's with debugfs files, and try to sweep through and fix them? There may be other ideas, and again, I'm not saying that this means we shouldn't lock down the permissions on debugfs. But a both/and approach might be useful here.... - Ted -- To unsubscribe from this list: send the line "unsubscribe linux-doc" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
