diff options
| author | Steven Rostedt (VMware) <rostedt@goodmis.org> | 2019-10-11 17:22:50 -0400 |
|---|---|---|
| committer | Steven Rostedt (VMware) <rostedt@goodmis.org> | 2019-10-12 20:48:06 -0400 |
| commit | 17911ff38aa58d3c95c07589dbf5d3564c4cf3c5 (patch) | |
| tree | 0437649533f3c50b4207fd9368bf47ae06bcfe95 /kernel/trace/trace.c | |
| parent | 8530dec63e7b486e3761cc3d74a22de301845ff5 (diff) | |
| download | linux-stable-17911ff38aa58d3c95c07589dbf5d3564c4cf3c5.tar.gz linux-stable-17911ff38aa58d3c95c07589dbf5d3564c4cf3c5.tar.bz2 linux-stable-17911ff38aa58d3c95c07589dbf5d3564c4cf3c5.zip | |
tracing: Add locked_down checks to the open calls of files created for tracefs
Added various checks on open tracefs calls to see if tracefs is in lockdown
mode, and if so, to return -EPERM.
Note, the event format files (which are basically standard on all machines)
as well as the enabled_functions file (which shows what is currently being
traced) are not lockde down. Perhaps they should be, but it seems counter
intuitive to lockdown information to help you know if the system has been
modified.
Link: http://lkml.kernel.org/r/CAHk-=wj7fGPKUspr579Cii-w_y60PtRaiDgKuxVtBAMK0VNNkA@mail.gmail.com
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Diffstat (limited to 'kernel/trace/trace.c')
| -rw-r--r-- | kernel/trace/trace.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 26ee280f852b..2b4eff383505 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -17,6 +17,7 @@ #include <linux/stacktrace.h> #include <linux/writeback.h> #include <linux/kallsyms.h> +#include <linux/security.h> #include <linux/seq_file.h> #include <linux/notifier.h> #include <linux/irqflags.h> @@ -306,6 +307,12 @@ void trace_array_put(struct trace_array *this_tr) int tracing_check_open_get_tr(struct trace_array *tr) { + int ret; + + ret = security_locked_down(LOCKDOWN_TRACEFS); + if (ret) + return ret; + if (tracing_disabled) return -ENODEV; @@ -6813,6 +6820,7 @@ static int snapshot_raw_open(struct inode *inode, struct file *filp) struct ftrace_buffer_info *info; int ret; + /* The following checks for tracefs lockdown */ ret = tracing_buffers_open(inode, filp); if (ret < 0) return ret; |