On Tue, Mar 26, 2019 at 5:31 PM Greg KH [off-list ref] wrote:

On Tue, Mar 26, 2019 at 11:27:41AM -0700, Matthew Garrett wrote:

quoted

From: Matthew Garrett <redacted>

debugfs has not been meaningfully audited in terms of ensuring that
userland cannot trample over the kernel. At Greg's request, disable
access to it entirely when the kernel is locked down. This is done at
open() time rather than init time as the kernel lockdown status may be
made stricter at runtime.

(snip)

Why allow all this, why not just abort the registering of the filesystem
with the vfs core so it can't even be mounted?

As mentioned in the commit message, because the lockdown state can be
made stricter at runtime - blocking at mount time would be
inconsistent if the machine is locked down afterwards. We could
potentially assert that it's the admin's responsibility to ensure that
debugfs isn't mounted at the point of policy being made stricter?