# Re: \[PATCH V36 27/29\] tracefs: Restrict tracefs when the kernel is locked down

- From: Steven Rostedt \<rostedt@goodmis.org\>
- Date: 2019-07-25 02:23:59 
- List: linux-security-module
- Page: https://ratatoskr.run/linux-security-module/2019/07/5665805
- Thread: https://ratatoskr.run/linux-security-module/2019/07/5659396/t.md

```text
On Thu, 18 Jul 2019 12:44:13 -0700
Matthew Garrett [ref] wrote:

> @@ -387,6 +412,7 @@ struct dentry *tracefs_create_file(const char *name, umode_t mode,
>  				   struct dentry *parent, void *data,
>  				   const struct file_operations *fops)
>  {
> +	struct file_operations *proxy_fops;
>  	struct dentry *dentry;
>  	struct inode *inode;
>  
> @@ -402,8 +428,18 @@ struct dentry *tracefs_create_file(const char *name, umode_t mode,
>  	if (unlikely(!inode))
>  		return failed_creating(dentry);
>  
> +	proxy_fops = kzalloc(sizeof(struct file_operations), GFP_KERNEL);
> +	if (!proxy_fops)

I believe we need "iput(inode);" here. Or move the allocation before
the inode allocation and free it on inode failure.

-- Steve

> +		return failed_creating(dentry);
> +
> +	if (!fops)
> +		fops = &tracefs_file_operations;
> +
> +	dentry->d_fsdata = (void *)fops;
> +	memcpy(proxy_fops, fops, sizeof(*proxy_fops));
> +	proxy_fops->open = default_open_file;
>  	inode->i_mode = mode;
> -	inode->i_fop = fops ? fops : &tracefs_file_operations;
> +	inode->i_fop = proxy_fops;
>  	inode->i_private = data;
>  	d_instantiate(dentry, inode);
>  	fsnotify_create(dentry->d_parent->d_inode, dentry);
```