From patchwork Sat Jan 11 09:50:56 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 234017 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 02DD6C33C9E for ; Sat, 11 Jan 2020 10:31:27 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id C964020882 for ; Sat, 11 Jan 2020 10:31:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578738686; bh=6P3mEpt+EZtfaqkH6sYTaUltr3yxoCaUdwy0Fm+ZyJg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=l/ENJFx6ZzxQX8rD84V0xrok+iaMZ8JQEw5mYyzF3G80+zHPAiu/SN5pXt4c64AP2 pMlqmZvCiZpEZ4J/hDbRcAkseJXbFKnqX6oZa+vBOAJ9oJ7HGshkTjn1kw+SGKNaCn gu3s3QB+EdDh0B8iPbaFD9qEPAxZC87T7XeFM0oU= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731292AbgAKKb0 (ORCPT ); Sat, 11 Jan 2020 05:31:26 -0500 Received: from mail.kernel.org ([198.145.29.99]:43090 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728901AbgAKKbZ (ORCPT ); Sat, 11 Jan 2020 05:31:25 -0500 Received: from localhost (unknown [62.119.166.9]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 111A120880; Sat, 11 Jan 2020 10:31:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578738684; bh=6P3mEpt+EZtfaqkH6sYTaUltr3yxoCaUdwy0Fm+ZyJg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YIgT2qq84T+7QhZB2nqKzXhetqrK8aVe7Zft5gh00akKOxIBqMmbo8Dcv5XI53Z+7 4Er4xmugeGEJ9CUIUO0rP3mK7rm7p0lRLkX2cqRZfyvcKH2lAEui7t2SwBxexV0G9g 0y/m+0Co0I2gOsfhWx8FvwOsEzdC3KInDBl5n8KU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Matthew Garrett , "Steven Rostedt (VMware)" Subject: [PATCH 5.4 137/165] tracing: Do not create directories if lockdown is in affect Date: Sat, 11 Jan 2020 10:50:56 +0100 Message-Id: <20200111094937.426468077@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200111094921.347491861@linuxfoundation.org> References: <20200111094921.347491861@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Steven Rostedt (VMware) commit a356646a56857c2e5ad875beec734d7145ecd49a upstream. If lockdown is disabling tracing on boot up, it prevents the tracing files from even bering created. But when that happens, there's several places that will give a warning that the files were not created as that is usually a sign of a bug. Add in strategic locations where a check is made to see if tracing is disabled by lockdown, and if it is, do not go further, and fail silently (but print that tracing is disabled by lockdown, without doing a WARN_ON()). Cc: Matthew Garrett Fixes: 17911ff38aa5 ("tracing: Add locked_down checks to the open calls of files created for tracefs") Signed-off-by: Steven Rostedt (VMware) Signed-off-by: Greg Kroah-Hartman --- kernel/trace/ring_buffer.c | 6 ++++++ kernel/trace/trace.c | 17 +++++++++++++++++ 2 files changed, 23 insertions(+) --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -11,6 +11,7 @@ #include #include #include +#include #include #include #include /* for self test */ @@ -5068,6 +5069,11 @@ static __init int test_ringbuffer(void) int cpu; int ret = 0; + if (security_locked_down(LOCKDOWN_TRACEFS)) { + pr_warning("Lockdown is enabled, skipping ring buffer tests\n"); + return 0; + } + pr_info("Running ring buffer tests...\n"); buffer = ring_buffer_alloc(RB_TEST_BUFFER_SIZE, RB_FL_OVERWRITE); --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -1804,6 +1804,12 @@ int __init register_tracer(struct tracer return -1; } + if (security_locked_down(LOCKDOWN_TRACEFS)) { + pr_warning("Can not register tracer %s due to lockdown\n", + type->name); + return -EPERM; + } + mutex_lock(&trace_types_lock); tracing_selftest_running = true; @@ -8647,6 +8653,11 @@ struct dentry *tracing_init_dentry(void) { struct trace_array *tr = &global_trace; + if (security_locked_down(LOCKDOWN_TRACEFS)) { + pr_warning("Tracing disabled due to lockdown\n"); + return ERR_PTR(-EPERM); + } + /* The top level trace array uses NULL as parent */ if (tr->dir) return NULL; @@ -9089,6 +9100,12 @@ __init static int tracer_alloc_buffers(v int ring_buf_size; int ret = -ENOMEM; + + if (security_locked_down(LOCKDOWN_TRACEFS)) { + pr_warning("Tracing disabled due to lockdown\n"); + return -EPERM; + } + /* * Make sure we don't accidently add more trace options * than we have bits for.