Re: [PATCH 25/27] debugfs: Restrict debugfs when the kernel is locked down

2019-03-25 Thread Greg Kroah-Hartman
On Mon, Mar 25, 2019 at 05:38:09PM -0700, Matthew Garrett wrote: > On Mon, Mar 25, 2019 at 5:35 PM Greg Kroah-Hartman > wrote: > > On Mon, Mar 25, 2019 at 03:09:52PM -0700, Matthew Garrett wrote: > > > Normal device interaction should be done through configfs, sysfs or a > > > miscdev, not debugfs

Re: [PATCH 25/27] debugfs: Restrict debugfs when the kernel is locked down

2019-03-25 Thread Matthew Garrett
On Mon, Mar 25, 2019 at 5:35 PM Greg Kroah-Hartman wrote: > On Mon, Mar 25, 2019 at 03:09:52PM -0700, Matthew Garrett wrote: > > Normal device interaction should be done through configfs, sysfs or a > > miscdev, not debugfs. > > Then why not just not allow debugfs at all if it is such a "big > pro

Re: [PATCH 25/27] debugfs: Restrict debugfs when the kernel is locked down

2019-03-25 Thread Greg Kroah-Hartman
On Mon, Mar 25, 2019 at 03:09:52PM -0700, Matthew Garrett wrote: > From: David Howells > > Disallow opening of debugfs files that might be used to muck around when > the kernel is locked down as various drivers give raw access to hardware > through debugfs. Given the effort of auditing all 2000

[PATCH 25/27] debugfs: Restrict debugfs when the kernel is locked down

2019-03-25 Thread Matthew Garrett
From: David Howells Disallow opening of debugfs files that might be used to muck around when the kernel is locked down as various drivers give raw access to hardware through debugfs. Given the effort of auditing all 2000 or so files and manually fixing each one as necessary, I've chosen to apply