On Tue, Mar 26, 2019 at 12:20:24PM -0700, Andy Lutomirski wrote:

On Tue, Mar 26, 2019 at 11:28 AM Matthew Garrett
[off-list ref] wrote:

quoted

From: Matthew Garrett <redacted>

debugfs has not been meaningfully audited in terms of ensuring that
userland cannot trample over the kernel. At Greg's request, disable
access to it entirely when the kernel is locked down. This is done at
open() time rather than init time as the kernel lockdown status may be
made stricter at runtime.

Ugh.  Some of those files are very useful.  Could this perhaps still
allow O_RDONLY if we're in INTEGRITY mode?

Useful for what?  Debugging, sure, but for "normal operation", no kernel
functionality should ever require debugfs.  If it does, that's a bug and
should be fixed.

thanks,

greg k-h