1 files changed, 30 insertions, 2 deletions

diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
index 042b688ed124..7b975dbb2bb4 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -26,6 +26,7 @@
 #include <linux/parser.h>
 #include <linux/magic.h>
 #include <linux/slab.h>
+#include <linux/security.h>
 
 #include "internal.h"
 
@@ -35,6 +36,32 @@ static struct vfsmount *debugfs_mount;
 static int debugfs_mount_count;
 static bool debugfs_registered;
 
+/*
+ * Don't allow access attributes to be changed whilst the kernel is locked down
+ * so that we can use the file mode as part of a heuristic to determine whether
+ * to lock down individual files.
+ */
+static int debugfs_setattr(struct dentry *dentry, struct iattr *ia)
+{
+        int ret = security_locked_down(LOCKDOWN_DEBUGFS);
+
+        if (ret && (ia->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID)))
+                return ret;
+        return simple_setattr(dentry, ia);
+}
+
+static const struct inode_operations debugfs_file_inode_operations = {
+        .setattr        = debugfs_setattr,
+};
+static const struct inode_operations debugfs_dir_inode_operations = {
+        .lookup         = simple_lookup,
+        .setattr        = debugfs_setattr,
+};
+static const struct inode_operations debugfs_symlink_inode_operations = {
+        .get_link       = simple_get_link,
+        .setattr        = debugfs_setattr,
+};
+
 static struct inode *debugfs_get_inode(struct super_block *sb)
 {
         struct inode *inode = new_inode(sb);
@@ -369,6 +396,7 @@ static struct dentry *__debugfs_create_file(const char *name, umode_t mode,
         inode->i_mode = mode;
         inode->i_private = data;
 
+        inode->i_op = &debugfs_file_inode_operations;
         inode->i_fop = proxy_fops;
         dentry->d_fsdata = (void *)((unsigned long)real_fops |
                                 DEBUGFS_FSDATA_IS_REAL_FOPS_BIT);
@@ -532,7 +560,7 @@ struct dentry *debugfs_create_dir(const char *name, struct dentry *parent)
         }
 
         inode->i_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO;
-        inode->i_op = &simple_dir_inode_operations;
+        inode->i_op = &debugfs_dir_inode_operations;
         inode->i_fop = &simple_dir_operations;
 
         /* directory inodes start off with i_nlink == 2 (for "." entry) */
@@ -632,7 +660,7 @@ struct dentry *debugfs_create_symlink(const char *name, struct dentry *parent,
                 return failed_creating(dentry);
         }
         inode->i_mode = S_IFLNK | S_IRWXUGO;
-        inode->i_op = &simple_symlink_inode_operations;
+        inode->i_op = &debugfs_symlink_inode_operations;
         inode->i_link = link;
         d_instantiate(dentry, inode);
         return end_creating(dentry);