Re: [PATCH 25/27] debugfs: Restrict debugfs when the kernel is locked down

2019-03-25 Thread Greg Kroah-Hartman
On Mon, Mar 25, 2019 at 05:38:09PM -0700, Matthew Garrett wrote: > On Mon, Mar 25, 2019 at 5:35 PM Greg Kroah-Hartman > wrote: > > On Mon, Mar 25, 2019 at 03:09:52PM -0700, Matthew Garrett wrote: > > > Normal device interaction should be done through configfs, sysfs or a > > > miscdev, not debugfs

Re: [PATCH 25/27] debugfs: Restrict debugfs when the kernel is locked down

2019-03-25 Thread Matthew Garrett
On Mon, Mar 25, 2019 at 5:35 PM Greg Kroah-Hartman wrote: > On Mon, Mar 25, 2019 at 03:09:52PM -0700, Matthew Garrett wrote: > > Normal device interaction should be done through configfs, sysfs or a > > miscdev, not debugfs. > > Then why not just not allow debugfs at all if it is such a "big > pro

Re: [PATCH 25/27] debugfs: Restrict debugfs when the kernel is locked down

2019-03-25 Thread Greg Kroah-Hartman
On Mon, Mar 25, 2019 at 03:09:52PM -0700, Matthew Garrett wrote: > From: David Howells > > Disallow opening of debugfs files that might be used to muck around when > the kernel is locked down as various drivers give raw access to hardware > through debugfs. Given the effort of auditing all 2000