redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

tracing: Do not create directories if lockdown is in affect 

If lockdown is disabling tracing on boot up, it prevents the tracing files
from even bering created. But when that happens, there's several places that
will give a warning that the files were not created as that is usually a
sign of a bug.

Add in strategic locations where a check is made to see if tracing is
disabled by lockdown, and if it is, do not go further, and fail silently
(but print that tracing is disabled by lockdown, without doing a WARN_ON()).

Cc: Matthew Garrett <mjg59@google.com>
Fixes: 17911ff38a ("tracing: Add locked_down checks to the open calls of files created for tracefs")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
alistair/sunxi64-5.5-dsi
Steven Rostedt (VMware) 2019-12-02 16:25:27 -05:00
parent 6c3edaf9fd
commit a356646a56
2 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
kernel/trace/ring_buffer.c
View File

@ -11,6 +11,7 @@
#include <linux/trace_seq.h> #include <linux/trace_seq.h>
#include <linux/spinlock.h> #include <linux/spinlock.h>
#include <linux/irq_work.h> #include <linux/irq_work.h>
#include <linux/security.h>
#include <linux/uaccess.h> #include <linux/uaccess.h>
#include <linux/hardirq.h> #include <linux/hardirq.h>
#include <linux/kthread.h> /* for self test */ #include <linux/kthread.h> /* for self test */
@ -5068,6 +5069,11 @@ static __init int test_ringbuffer(void)
int cpu; int cpu;
int ret = 0; int ret = 0;
if (security_locked_down(LOCKDOWN_TRACEFS)) {
pr_warning("Lockdown is enabled, skipping ring buffer tests\n");
return 0;
}
pr_info("Running ring buffer tests...\n"); pr_info("Running ring buffer tests...\n");
buffer = ring_buffer_alloc(RB_TEST_BUFFER_SIZE, RB_FL_OVERWRITE); buffer = ring_buffer_alloc(RB_TEST_BUFFER_SIZE, RB_FL_OVERWRITE);

17
kernel/trace/trace.c
View File

@ -1888,6 +1888,12 @@ int __init register_tracer(struct tracer *type)
return -1; return -1;
} }
if (security_locked_down(LOCKDOWN_TRACEFS)) {
pr_warning("Can not register tracer %s due to lockdown\n",
type->name);
return -EPERM;
}
mutex_lock(&trace_types_lock); mutex_lock(&trace_types_lock);
tracing_selftest_running = true; tracing_selftest_running = true;
@ -8789,6 +8795,11 @@ struct dentry *tracing_init_dentry(void)
{ {
struct trace_array *tr = &global_trace; struct trace_array *tr = &global_trace;
if (security_locked_down(LOCKDOWN_TRACEFS)) {
pr_warning("Tracing disabled due to lockdown\n");
return ERR_PTR(-EPERM);
}
/* The top level trace array uses NULL as parent */ /* The top level trace array uses NULL as parent */
if (tr->dir) if (tr->dir)
return NULL; return NULL;
@ -9231,6 +9242,12 @@ __init static int tracer_alloc_buffers(void)
int ring_buf_size; int ring_buf_size;
int ret = -ENOMEM; int ret = -ENOMEM;
if (security_locked_down(LOCKDOWN_TRACEFS)) {
pr_warning("Tracing disabled due to lockdown\n");
return -EPERM;
}
/* /*
* Make sure we don't accidently add more trace options * Make sure we don't accidently add more trace options
* than we have bits for. * than we have bits for.