Re: [PATCH V37 27/29] tracefs: Restrict tracefs when the kernel is locked down

---
  fs/tracefs/inode.c           | 40 +++++++++++++++++++++++++++++++++++-
  include/linux/security.h     |  1 +
  security/lockdown/lockdown.c |  1 +
  3 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
index 1387bcd96a79..12a325fb4cbd 100644
--- a/fs/tracefs/inode.c
+++ b/fs/tracefs/inode.c

@@ -21,6 +21,7 @@
  #include <linux/seq_file.h>
  #include <linux/magic.h>
  #include <linux/slab.h>
+#include <linux/security.h>
  
  #define TRACEFS_DEFAULT_MODE	0700
  

@@ -28,6 +29,23 @@ static struct vfsmount *tracefs_mount;
  static int tracefs_mount_count;
  static bool tracefs_registered;
  
+static int default_open_file(struct inode *inode, struct file *filp)
+{
+	struct dentry *dentry = filp->f_path.dentry;
+	struct file_operations *real_fops;
+	int ret;
+
+	if (!dentry)
+		return -EINVAL;
+
+	ret = security_locked_down(LOCKDOWN_TRACEFS);
+	if (ret)
+		return ret;
+
+	real_fops = dentry->d_fsdata;

+	return real_fops->open(inode, filp);
+}
+
  static ssize_t default_read_file(struct file *file, char __user *buf,
  				 size_t count, loff_t *ppos)
  {

@@ -210,6 +228,12 @@ static int tracefs_apply_options(struct super_block *sb)
  	return 0;
  }
  
+static void tracefs_destroy_inode(struct inode *inode)
+{
+	if (S_ISREG(inode->i_mode))
+		kfree(inode->i_fop);
+}
+
  static int tracefs_reconfigure(struct fs_context *fc)
  {
  	struct super_block *sb = fc->root->d_sb;

@@ -236,6 +260,7 @@ static int tracefs_show_options(struct seq_file *m, struct dentry *root)
  
  static const struct super_operations tracefs_super_operations = {
  	.statfs		= simple_statfs,
+	.destroy_inode  = tracefs_destroy_inode,
  	.show_options	= tracefs_show_options,
  };
  

@@ -372,6 +397,7 @@ struct dentry *tracefs_create_file(const char *name, umode_t mode,
  				   struct dentry *parent, void *data,
  				   const struct file_operations *fops)
  {
+	struct file_operations *proxy_fops;
  	struct dentry *dentry;
  	struct inode *inode;
  

@@ -387,8 +413,20 @@ struct dentry *tracefs_create_file(const char *name, umode_t mode,
  	if (unlikely(!inode))
  		return failed_creating(dentry);
  
+	proxy_fops = kzalloc(sizeof(struct file_operations), GFP_KERNEL);
+	if (unlikely(!proxy_fops)) {
+		iput(inode);
+		return failed_creating(dentry);
+	}
+
+	if (!fops)
+		fops = &tracefs_file_operations;
+
+	dentry->d_fsdata = (void *)fops;
+	memcpy(proxy_fops, fops, sizeof(*proxy_fops));
+	proxy_fops->open = default_open_file;
  	inode->i_mode = mode;
-	inode->i_fop = fops ? fops : &tracefs_file_operations;
+	inode->i_fop = proxy_fops;
  	inode->i_private = data;
  	d_instantiate(dentry, inode);
  	fsnotify_create(dentry->d_parent->d_inode, dentry);

diff --git a/include/linux/security.h b/include/linux/security.h
index d92323b44a3f..807dc0d24982 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h

@@ -121,6 +121,7 @@ enum lockdown_reason {
  	LOCKDOWN_KPROBES,
  	LOCKDOWN_BPF_READ,
  	LOCKDOWN_PERF,
+	LOCKDOWN_TRACEFS,
  	LOCKDOWN_CONFIDENTIALITY_MAX,
  };
  

diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
index 88064ce1c844..173191562047 100644
--- a/security/lockdown/lockdown.c
+++ b/security/lockdown/lockdown.c

@@ -36,6 +36,7 @@ static char *lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = {
  	[LOCKDOWN_KPROBES] = "use of kprobes",
  	[LOCKDOWN_BPF_READ] = "use of bpf to read kernel RAM",
  	[LOCKDOWN_PERF] = "unsafe use of perf",
+	[LOCKDOWN_TRACEFS] = "use of tracefs",
  	[LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality",
  };