From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754612Ab2H0Ucm (ORCPT ); Mon, 27 Aug 2012 16:32:42 -0400 Received: from smtp.outflux.net ([198.145.64.163]:37764 "EHLO smtp.outflux.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754484Ab2H0Ucl (ORCPT ); Mon, 27 Aug 2012 16:32:41 -0400 Date: Mon, 27 Aug 2012 13:32:15 -0700 From: Kees Cook To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , Ben Hutchings , Rob Landley , Al Viro , Ludwig Nussel , Alessandro Rubini , Kees Cook , linux-doc@vger.kernel.org Subject: [PATCH] debugfs: more tightly restrict default mount mode Message-ID: <20120827203215.GA16637@www.outflux.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.20 (2009-06-14) X-HELO: www.outflux.net Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Since the debugfs is mostly only used by root, make the default mount mode 0700. Most system owners do not need a more permissive value, but they can choose to weaken the restrictions via their fstab. Signed-off-by: Kees Cook --- Documentation/filesystems/debugfs.txt | 4 ++-- fs/debugfs/inode.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Documentation/filesystems/debugfs.txt b/Documentation/filesystems/debugfs.txt index 7a34f82..3a863f6 100644 --- a/Documentation/filesystems/debugfs.txt +++ b/Documentation/filesystems/debugfs.txt @@ -15,8 +15,8 @@ Debugfs is typically mounted with a command like: mount -t debugfs none /sys/kernel/debug (Or an equivalent /etc/fstab line). -The debugfs root directory is accessible by anyone by default. To -restrict access to the tree the "uid", "gid" and "mode" mount +The debugfs root directory is accessible only to the root user by +default. To change access to the tree the "uid", "gid" and "mode" mount options can be used. Note that the debugfs API is exported GPL-only to modules. diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c index 4733eab..2d22c81 100644 --- a/fs/debugfs/inode.c +++ b/fs/debugfs/inode.c @@ -28,7 +28,7 @@ #include #include -#define DEBUGFS_DEFAULT_MODE 0755 +#define DEBUGFS_DEFAULT_MODE 0700 static struct vfsmount *debugfs_mount; static int debugfs_mount_count; -- 1.7.0.4 -- Kees Cook Chrome OS Security