From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.2 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BA970C33CA4 for ; Fri, 10 Jan 2020 16:31:15 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 9B4F520673 for ; Fri, 10 Jan 2020 16:31:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728799AbgAJQbP (ORCPT ); Fri, 10 Jan 2020 11:31:15 -0500 Received: from mail.kernel.org ([198.145.29.99]:55076 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727928AbgAJQbO (ORCPT ); Fri, 10 Jan 2020 11:31:14 -0500 Received: from home.goodmis.org (cpe-66-24-58-225.stny.res.rr.com [66.24.58.225]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 79C71205F4; Fri, 10 Jan 2020 16:31:12 +0000 (UTC) Date: Fri, 10 Jan 2020 11:31:05 -0500 From: Steven Rostedt To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Linus Torvalds , Ingo Molnar , Andrew Morton , Matthew Garrett , bugzilla@colorremedies.com Subject: Re: [PATCH 3/3] tracing: Do not create directories if lockdown is in affect Message-ID: <20200110163105.GA17434@home.goodmis.org> References: <20191205020459.023316620@goodmis.org> <20191205020548.446051018@goodmis.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20191205020548.446051018@goodmis.org> User-Agent: Mutt/1.10.1 (2018-07-13) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org I should have marked this for stable. The commit it fixes (see Fixes tag) is in 5.4, and it appears this has yet to make it to 5.4 yet. -- Steve On Wed, Dec 04, 2019 at 09:05:02PM -0500, Steven Rostedt wrote: > From: "Steven Rostedt (VMware)" > > If lockdown is disabling tracing on boot up, it prevents the tracing files > from even bering created. But when that happens, there's several places that > will give a warning that the files were not created as that is usually a > sign of a bug. > > Add in strategic locations where a check is made to see if tracing is > disabled by lockdown, and if it is, do not go further, and fail silently > (but print that tracing is disabled by lockdown, without doing a WARN_ON()). > > Cc: Matthew Garrett > Fixes: 17911ff38aa5 ("tracing: Add locked_down checks to the open calls of files created for tracefs") > Signed-off-by: Steven Rostedt (VMware) > --- > kernel/trace/ring_buffer.c | 6 ++++++ > kernel/trace/trace.c | 17 +++++++++++++++++ > 2 files changed, 23 insertions(+) > > diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c > index 66358d66c933..4bf050fcfe3b 100644 > --- a/kernel/trace/ring_buffer.c > +++ b/kernel/trace/ring_buffer.c > @@ -11,6 +11,7 @@ > #include > #include > #include > +#include > #include > #include > #include /* for self test */ > @@ -5068,6 +5069,11 @@ static __init int test_ringbuffer(void) > int cpu; > int ret = 0; > > + if (security_locked_down(LOCKDOWN_TRACEFS)) { > + pr_warning("Lockdown is enabled, skipping ring buffer tests\n"); > + return 0; > + } > + > pr_info("Running ring buffer tests...\n"); > > buffer = ring_buffer_alloc(RB_TEST_BUFFER_SIZE, RB_FL_OVERWRITE); > diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c > index 02a23a6e5e00..23459d53d576 100644 > --- a/kernel/trace/trace.c > +++ b/kernel/trace/trace.c > @@ -1888,6 +1888,12 @@ int __init register_tracer(struct tracer *type) > return -1; > } > > + if (security_locked_down(LOCKDOWN_TRACEFS)) { > + pr_warning("Can not register tracer %s due to lockdown\n", > + type->name); > + return -EPERM; > + } > + > mutex_lock(&trace_types_lock); > > tracing_selftest_running = true; > @@ -8789,6 +8795,11 @@ struct dentry *tracing_init_dentry(void) > { > struct trace_array *tr = &global_trace; > > + if (security_locked_down(LOCKDOWN_TRACEFS)) { > + pr_warning("Tracing disabled due to lockdown\n"); > + return ERR_PTR(-EPERM); > + } > + > /* The top level trace array uses NULL as parent */ > if (tr->dir) > return NULL; > @@ -9231,6 +9242,12 @@ __init static int tracer_alloc_buffers(void) > int ring_buf_size; > int ret = -ENOMEM; > > + > + if (security_locked_down(LOCKDOWN_TRACEFS)) { > + pr_warning("Tracing disabled due to lockdown\n"); > + return -EPERM; > + } > + > /* > * Make sure we don't accidently add more trace options > * than we have bits for. > -- > 2.24.0 >