On 08/28/2012 09:41 AM, Theodore Ts'o wrote: > On Mon, Aug 27, 2012 at 01:32:15PM -0700, Kees Cook wrote: >> Since the debugfs is mostly only used by root, make the default mount >> mode 0700. Most system owners do not need a more permissive value, >> but they can choose to weaken the restrictions via their fstab. >> >> Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx> > > I agree with this patch, but it would also be good if we could try to > harden debugfs in general. Some ideas that might be worth discussing, > for example? > > 1) Adding a per-module flag, so things in debugfs only show up if they > are explicitly requested (you know, for debugging purposes). If most > people are using debugfs for access to ftrace and powertap (my use > case), there's no point making directories for other device drivers > and file systems visible. Are you suggesting "echo 1 > /sys/module/mymod/debug", or are you suggesting "mount -t devfs -o mymod /tmp/mymod", or knobs in devfs? I've always been a bit confused by the debugfs design, which seems a giant compost heap like /proc where we find a specific styrofoam cup useful and the temporary thing becomes permanent. (Why is there _one_ debugfs?) Oh well, presumably too late to change it now. (Unless you mount a tmpfs on /sys/kernel/debug and mkdir mount points in there, but in the perpetual absence of union mounts it would probably involve userspace-visible path changes...) > 2) Can we find a pattern of common security #fail's with debugfs > files, and try to sweep through and fix them? > > There may be other ideas, and again, I'm not saying that this means we > shouldn't lock down the permissions on debugfs. But a both/and > approach might be useful here.... Plenty of other ideas, but it says "there are no usage rules" right there in the documentation file which makes compatible cleanup hard... Rob -- GNU/Linux isn't: Linux=GPLv2, GNU=GPLv3+, they can't share code. Either it's "mere aggregation", or a license violation. Pick one. -- To unsubscribe from this list: send the line "unsubscribe linux-doc" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
