2

When I attempt to read or modify the kernel dynamic_debug settings, I encounter a permissions issue.

root@roberto:/sys/kernel/debug/dynamic_debug# cat control
cat: control: Operation not permitted

I'm not seeing any apparmor audit messages related to this and the classic UNIX permissions look fine.

root@roberto:/sys/kernel/debug/dynamic_debug# ll
total 0
drwxr-xr-x  2 root root 0 Aug 29 21:23 ./
drwx------ 40 root root 0 Aug 29 21:23 ../
-rw-r--r--  1 root root 0 Aug 29 21:23 control

There don't appear to be any weird ACLs:

root@roberto:/sys/kernel/debug/dynamic_debug# getfacl control 
# file: control
# owner: root
# group: root
user::rw-
group::r--
other::r--

I'm not much of an expert on linux capabilities, but capsh --print and cat /proc/<pid>/status both seem to imply that all capabilities are enabled.

I'm running Ubuntu server 18.04 with the hardware enablement kernel.

cbaker@roberto:~$ uname -a
Linux roberto 5.0.0-25-generic #26~18.04.1-Ubuntu SMP Thu Aug 1 13:51:02 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

I am able to add the dyndbg flag to the modprobe conf files in order to enable dynamic debug on individual basis. The results appear in dmesg as expected.

Any ideas on what might be causing the debugfs control node to fail? I'm leaning toward this being some custom patch that Ubuntu has applied to the kernel or possibly a hidden/builtin apparmor profile that doesn't create audit messages.

3
  • See github.com/waltinator/pathlld
    – waltinator
    Commented Aug 30, 2019 at 20:27
  • Nice idea with checking the mount permissions, but those are all OK. I can definitely read and write some attributes in the debugfs, but not this particular one.
    – Chris Baker
    Commented Sep 1, 2019 at 0:01
  • I've done some checking and I think I can rule out any interference from linux capabilities(7). Since I'm running as root, capsh --print shows all capabilities are enabled. This is corroborated by the effective capabilities shown for my shell in /proc: CapEff: 0000003fffffffff
    – Chris Baker
    Commented Sep 1, 2019 at 0:17

1 Answer 1

Reset to default
0

I believe you should see the following line in dmesg:

[1933752.889994] Lockdown: bash: debugfs is restricted; see man kernel_lockdown.7

If this is the case debugfs is simply unavailable even for root user.

For reference:

1
  • Thanks, I don't think I was seeing this message in k5.0, but it is showing up now in k5.3.
    – Chris Baker
    Commented Feb 2, 2020 at 0:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .