Re: Hardening debugfs (Was Re: [PATCH] debugfs: more tightly restrict default mount mode)

[Kees Cook <keescook@xxxxxxxxxxxx>]

On Tue, Aug 28, 2012 at 10:09 AM, Greg Kroah-Hartman
<gregkh@xxxxxxxxxxxxxxxxxxx> wrote:
> On Tue, Aug 28, 2012 at 10:41:10AM -0400, Theodore Ts'o wrote:
>> On Mon, Aug 27, 2012 at 01:32:15PM -0700, Kees Cook wrote:
>> > Since the debugfs is mostly only used by root, make the default mount
>> > mode 0700. Most system owners do not need a more permissive value,
>> > but they can choose to weaken the restrictions via their fstab.
>> >
>> > Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
>>
>> I agree with this patch, but it would also be good if we could try to
>> harden debugfs in general.  Some ideas that might be worth discussing,
>> for example?
>>
>> 1) Adding a per-module flag, so things in debugfs only show up if they
>> are explicitly requested (you know, for debugging purposes).  If most
>> people are using debugfs for access to ftrace and powertap (my use
>> case), there's no point making directories for other device drivers
>> and file systems visible.
>
> The module code is "explicitly requesting" a debugfs file when it makes
> the call to create it.  If you want to depend on a flag for the
> individual modules to do this or not, sure, go ahead, but that's a
> module/driver issue, nothing I can do in the debugfs core itself.
>
>> 2) Can we find a pattern of common security #fail's with debugfs
>> files, and try to sweep through and fix them?
>
> The only one I know of is the "unload the module with an open file
> handle" issue.  I'm pretty sure this could be fixed up somehow in
> debugfs, much like it was resolved in sysfs, but it would take a lot of
> work, for a very limited benefit (in other words, if someone sends me
> patches for this, great, but it's so low on my TODO list that I'll
> probably never get to it myself.)

Staying after world-writable files is probably the biggest deal
(though this has been checked for in the past after problems
surfaced). I think the main reason I've wanted to push for 0700 was
just because the scope of the problems is so large. It could be as
simple as leaking kernel (or userspace) address locations (allowing
ASLR bypass, or heap location predictability) or other side-effects
from world-readable files, all the way to weird ioctl flaws in
world-writable files. In general, since debugfs is specifically
designed to have unstructured contents, it's not particularly trivial
to be able to reason about how those contents can be best protected.
As such, I just wanted to isolated it.

-Kees

-- 
Kees Cook
Chrome OS Security
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/