From patchwork Wed Jan 9 20:52:35 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kamal Mostafa X-Patchwork-Id: 1022622 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=canonical.com Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 43ZhCj6Hhsz9sN8; Thu, 10 Jan 2019 07:52:49 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1ghKqA-0006Y6-QB; Wed, 09 Jan 2019 20:52:42 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtps (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:128) (Exim 4.86_2) (envelope-from ) id 1ghKq8-0006Xg-9K for kernel-team@lists.ubuntu.com; Wed, 09 Jan 2019 20:52:40 +0000 Received: from 1.general.kamal.us.vpn ([10.172.68.52] helo=fourier) by youngberry.canonical.com with esmtpsa (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.76) (envelope-from ) id 1ghKq7-0004a4-T3 for kernel-team@lists.ubuntu.com; Wed, 09 Jan 2019 20:52:40 +0000 Received: from kamal by fourier with local (Exim 4.90_1) (envelope-from ) id 1ghKq5-00054I-Gk for kernel-team@lists.ubuntu.com; Wed, 09 Jan 2019 12:52:37 -0800 From: Kamal Mostafa To: kernel-team@lists.ubuntu.com Subject: [SRU][PATCH 1/1][C, D, u] UBUNTU: SAUCE: debugfs: avoid EPERM when no open file operation defined Date: Wed, 9 Jan 2019 12:52:35 -0800 Message-Id: <20190109205235.19437-2-kamal@canonical.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20190109205235.19437-1-kamal@canonical.com> References: <20190109205235.19437-1-kamal@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Vasily Gorbik BugLink: https://bugs.launchpad.net/bugs/1807686 With "debugfs: Restrict debugfs when the kernel is locked down" return code "r" is unconditionally set to -EPERM, which stays like that until function return if no "open" file operation defined, effectivelly resulting in "Operation not permitted" for all such files despite kernel lock down status or CONFIG_LOCK_DOWN_KERNEL being enabled. In particular this breaks 2 debugfs files on s390: /sys/kernel/debug/s390_hypfs/diag_304 /sys/kernel/debug/s390_hypfs/diag_204 To address that set EPERM return code only when debugfs_is_locked_down returns true. Fixes: 3fc322605158 ("debugfs: Restrict debugfs when the kernel is locked down") Signed-off-by: Vasily Gorbik Reference: https://lore.kernel.org/patchwork/patch/1015495/ Fixes: a1ba65da9cea ("UBUNTU: SAUCE: (efi-lockdown) debugfs: Restrict debugfs when the kernel is locked down") Signed-off-by: Kamal Mostafa Acked-by: Tyler Hicks Acked-by: Seth Forshee --- fs/debugfs/file.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c index c33042c1eff3..3a5033ff9ec7 100644 --- a/fs/debugfs/file.c +++ b/fs/debugfs/file.c @@ -167,9 +167,10 @@ static int open_proxy_open(struct inode *inode, struct file *filp) real_fops = debugfs_real_fops(filp); - r = -EPERM; - if (debugfs_is_locked_down(inode, filp, real_fops)) + if (debugfs_is_locked_down(inode, filp, real_fops)) { + r = -EPERM; goto out; + } real_fops = fops_get(real_fops); if (!real_fops) { @@ -296,9 +297,10 @@ static int full_proxy_open(struct inode *inode, struct file *filp) return r == -EIO ? -ENOENT : r; real_fops = debugfs_real_fops(filp); - r = -EPERM; - if (debugfs_is_locked_down(inode, filp, real_fops)) + if (debugfs_is_locked_down(inode, filp, real_fops)) { + r = -EPERM; goto out; + } real_fops = fops_get(real_fops); if (!real_fops) {