| From d4c59d5f40366dbb0350445623e0d89377dbd2e5 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 4 Jan 2022 18:05:05 +0100 |
| Subject: debugfs: lockdown: Allow reading debugfs files that are not world |
| readable |
| |
| From: Michal Suchanek <msuchanek@suse.de> |
| |
| [ Upstream commit 358fcf5ddbec4e6706405847d6a666f5933a6c25 ] |
| |
| When the kernel is locked down the kernel allows reading only debugfs |
| files with mode 444. Mode 400 is also valid but is not allowed. |
| |
| Make the 444 into a mask. |
| |
| Fixes: 5496197f9b08 ("debugfs: Restrict debugfs when the kernel is locked down") |
| Signed-off-by: Michal Suchanek <msuchanek@suse.de> |
| Link: https://lore.kernel.org/r/20220104170505.10248-1-msuchanek@suse.de |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| fs/debugfs/file.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c |
| index a32c5c7dcfd89..da87615ad69a7 100644 |
| --- a/fs/debugfs/file.c |
| +++ b/fs/debugfs/file.c |
| @@ -146,7 +146,7 @@ static int debugfs_locked_down(struct inode *inode, |
| struct file *filp, |
| const struct file_operations *real_fops) |
| { |
| - if ((inode->i_mode & 07777) == 0444 && |
| + if ((inode->i_mode & 07777 & ~0444) == 0 && |
| !(filp->f_mode & FMODE_WRITE) && |
| !real_fops->unlocked_ioctl && |
| !real_fops->compat_ioctl && |
| -- |
| 2.34.1 |
| |
