tracing: Do not create tracefs files if tracefs lockdown is in effect
authorSteven Rostedt (VMware) <rostedt@goodmis.org>
Sat, 12 Oct 2019 00:41:41 +0000 (20:41 -0400)
committerSteven Rostedt (VMware) <rostedt@goodmis.org>
Sun, 13 Oct 2019 00:49:07 +0000 (20:49 -0400)
If on boot up, lockdown is activated for tracefs, don't even bother creating
the files. This can also prevent instances from being created if lockdown is
in effect.

Link: http://lkml.kernel.org/r/CAHk-=whC6Ji=fWnjh2+eS4b15TnbsS4VPVtvBOwCy1jjEG_JHQ@mail.gmail.com
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
fs/tracefs/inode.c

index eeeae0475da9d0cc15b5b6fe363fd77404e481b9..0caa151cae4ee101d13cd218b695b98787b730ad 100644 (file)
@@ -16,6 +16,7 @@
 #include <linux/namei.h>
 #include <linux/tracefs.h>
 #include <linux/fsnotify.h>
+#include <linux/security.h>
 #include <linux/seq_file.h>
 #include <linux/parser.h>
 #include <linux/magic.h>
@@ -390,6 +391,9 @@ struct dentry *tracefs_create_file(const char *name, umode_t mode,
        struct dentry *dentry;
        struct inode *inode;
 
+       if (security_locked_down(LOCKDOWN_TRACEFS))
+               return NULL;
+
        if (!(mode & S_IFMT))
                mode |= S_IFREG;
        BUG_ON(!S_ISREG(mode));