[PATCH] x86/mm/ptdump: Make (debugfs)/kernel_page_tables read-only

[PATCH] x86/mm/ptdump: Make (debugfs)/kernel_page_tables read-only

[Borislav Petkov]

From: Borislav Petkov <bp@suse.de>

File should be created with S_IRUSR and not with S_IWUSR too because
writing to it doesn't make any sense. I mean, we don't have a ->write
method anyway but let's have the permissions correct too.

Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: Arjan van de Ven <arjan@linux.intel.com>
---
 arch/x86/mm/debug_pagetables.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/mm/debug_pagetables.c b/arch/x86/mm/debug_pagetables.c
index b35ee86a9316..bfcffdf6c577 100644
--- a/arch/x86/mm/debug_pagetables.c
+++ b/arch/x86/mm/debug_pagetables.c
@@ -26,7 +26,7 @@ static struct dentry *pe;
 
 static int __init pt_dump_debug_init(void)
 {
-	pe = debugfs_create_file("kernel_page_tables", 0600, NULL, NULL,
+	pe = debugfs_create_file("kernel_page_tables", S_IRUSR, NULL, NULL,
 				 &ptdump_fops);
 	if (!pe)
 		return -ENOMEM;
-- 
2.3.5

[tip:x86/mm] x86/mm/ptdump: Make (debugfs)/ kernel_page_tables read-only

[tip-bot for Borislav Petkov]

Commit-ID:  071ac0c4e8e90d5de05f0779b03ae69ce84820d5
Gitweb:     http://git.kernel.org/tip/071ac0c4e8e90d5de05f0779b03ae69ce84820d5
Author:     Borislav Petkov <bp@suse.de>
AuthorDate: Mon, 30 Nov 2015 13:12:59 +0100
Committer:  Ingo Molnar <mingo@kernel.org>
CommitDate: Fri, 4 Dec 2015 12:55:01 +0100

x86/mm/ptdump: Make (debugfs)/kernel_page_tables read-only

File should be created with S_IRUSR and not with S_IWUSR too
because writing to it doesn't make any sense. I mean, we don't
have a ->write method anyway but let's have the permissions
correct too.

Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Arjan van de Ven <arjan@linux.intel.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/1448885579-32506-1-git-send-email-bp@alien8.de
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
 arch/x86/mm/debug_pagetables.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/mm/debug_pagetables.c b/arch/x86/mm/debug_pagetables.c
index b35ee86..bfcffdf 100644
--- a/arch/x86/mm/debug_pagetables.c
+++ b/arch/x86/mm/debug_pagetables.c
@@ -26,7 +26,7 @@ static struct dentry *pe;
 
 static int __init pt_dump_debug_init(void)
 {
-	pe = debugfs_create_file("kernel_page_tables", 0600, NULL, NULL,
+	pe = debugfs_create_file("kernel_page_tables", S_IRUSR, NULL, NULL,
 				 &ptdump_fops);
 	if (!pe)
 		return -ENOMEM;

Re: [PATCH] x86/mm/ptdump: Make (debugfs)/kernel_page_tables read-only

[Kees Cook]

On Mon, Nov 30, 2015 at 4:12 AM, Borislav Petkov <bp@alien8.de> wrote:
> From: Borislav Petkov <bp@suse.de>
>
> File should be created with S_IRUSR and not with S_IWUSR too because
> writing to it doesn't make any sense. I mean, we don't have a ->write
> method anyway but let's have the permissions correct too.
>
> Signed-off-by: Borislav Petkov <bp@suse.de>
> Cc: Arjan van de Ven <arjan@linux.intel.com>

We need a EHAHANOPE errno and have write return that. ;)

Acked-by: Kees Cook <keescook@chromium.org>

-Kees

> ---
>  arch/x86/mm/debug_pagetables.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/x86/mm/debug_pagetables.c b/arch/x86/mm/debug_pagetables.c
> index b35ee86a9316..bfcffdf6c577 100644
> --- a/arch/x86/mm/debug_pagetables.c
> +++ b/arch/x86/mm/debug_pagetables.c
> @@ -26,7 +26,7 @@ static struct dentry *pe;
>
>  static int __init pt_dump_debug_init(void)
>  {
> -       pe = debugfs_create_file("kernel_page_tables", 0600, NULL, NULL,
> +       pe = debugfs_create_file("kernel_page_tables", S_IRUSR, NULL, NULL,
>                                  &ptdump_fops);
>         if (!pe)
>                 return -ENOMEM;
> --
> 2.3.5
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/



-- 
Kees Cook
Chrome OS & Brillo Security

Re: [PATCH] x86/mm/ptdump: Make (debugfs)/kernel_page_tables read-only

[Borislav Petkov]

On Fri, Dec 04, 2015 at 05:57:05AM -0800, Kees Cook wrote:
> We need a EHAHANOPE errno and have write return that. ;)

Sure, lemme add it to glibc:

---
diff --git a/manual/errno.texi b/manual/errno.texi
index 1068be3a5072..ec92cc00f81b 100644
--- a/manual/errno.texi
+++ b/manual/errno.texi
@@ -1279,6 +1279,12 @@ They are not yet documented.}
 @comment errno ???/???
 @end deftypevr
 
+@comment errno.h
+@comment Linux: Haha, nope, you wish.
+@deftypevar Macro int EHAHANOPE
+@comment errno ???/???
+@end deftypevr
+
 @node Error Messages,  , Error Codes, Error Reporting
 @section Error Messages
---

:-P

-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.