Re: [PATCH V31 25/25] debugfs: Disable open() when kernel is locked down
From: Andy Lutomirski <luto@kernel.org>
Date: 2019-03-26 19:20:42
Also in:
linux-security-module, lkml
On Tue, Mar 26, 2019 at 11:28 AM Matthew Garrett [off-list ref] wrote:
From: Matthew Garrett <redacted> debugfs has not been meaningfully audited in terms of ensuring that userland cannot trample over the kernel. At Greg's request, disable access to it entirely when the kernel is locked down. This is done at open() time rather than init time as the kernel lockdown status may be made stricter at runtime.
Ugh. Some of those files are very useful. Could this perhaps still allow O_RDONLY if we're in INTEGRITY mode?