debugfs ACL

[Mikhail Gavrilov]

Hi folks.
Why I cannot read content of some debugfs files which are should be readable.
https://lists.freedesktop.org/archives/amd-gfx/2018-December/029918.html

[mikhail@localhost ~]$ sudo bash
[sudo] password for mikhail:
[root@localhost mikhail]# cd /sys/kernel/debug/dri/0
[root@localhost 0]# xxd -e amdgpu_gca_config
xxd: amdgpu_gca_config: Operation not permitted
[root@localhost 0]# getenforce
Enforcing
[root@localhost 0]# setenforce 0
[root@localhost 0]# xxd -e amdgpu_gca_config
xxd: amdgpu_gca_config: Operation not permitted
[root@localhost 0]#



--
Best Regards,
Mike Gavrilov.

[stan]

On Thu, 27 Dec 2018 13:51:19 +0500
Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com&gt; wrote:

>  Hi folks.
>  Why I cannot read content of some debugfs files which are should be
>  readable.
>  https://lists.freedesktop.org/archives/amd-gfx/2018-December/029918.html
>  
>  [mikhail@localhost ~]$ sudo bash
>  [sudo] password for mikhail:
>  [root@localhost mikhail]# cd /sys/kernel/debug/dri/0
>  [root@localhost 0]# xxd -e amdgpu_gca_config
>  xxd: amdgpu_gca_config: Operation not permitted
>  [root@localhost 0]# getenforce
>  Enforcing
>  [root@localhost 0]# setenforce 0
>  [root@localhost 0]# xxd -e amdgpu_gca_config
>  xxd: amdgpu_gca_config: Operation not permitted
>  [root@localhost 0]# 
No answer, just some further things to look at or try.  I can use xxd -e
on files in that directory without problem, though I don't have the
file you are looking for since I use radeon.

On my system everything in there is 444 permissions, except directories.
What does your system show for ls -nZ?

Can less open the file after warning you about binary data?  Can you
cat them into pipe to xxd?
cat amd_gca_config | xxd -e -

What if you direct the output to someplace like your home directory?
xxd -e amd_gca_config ~/amd_gca_config.hexdump
Maybe write isn't permitted in those directories.

[Mikhail Gavrilov]

>  No answer, just some further things to look at or try. I can use xxd
> -e
>  on files in that directory without problem, though I don't have the
>  file you are looking for since I use radeon. 
>  On my system everything in there is 444 permissions, except
> directories.
>  What does your system show for ls -nZ? 
# ls -nZ amdgpu_gca_config
-r--r--r--. 1 0 0 system_u:object_r:debugfs_t:s0 0 Dec 28 14:18 amdgpu_gca_config


>  Can less open the file after warning you about binary data? Can you
>  cat them into pipe to xxd?
>  cat amd_gca_config | xxd -e - 
# cat amdgpu_gca_config | xxd -e -
cat: amdgpu_gca_config: Operation not permitted


>  What if you direct the output to someplace like your home directory?
>  xxd -e amd_gca_config ~/amd_gca_config.hexdump
>  Maybe write isn't permitted in those directories. 
# xxd -e amdgpu_gca_config >  ~/amd_gca_config.hexdump
xxd: amdgpu_gca_config: Operation not permitted
[root@localhost 0]# echo 'foobar' >  ~/amd_gca_config.hexdump

[Dominik 'Rathann' Mierzejewski]

On Thursday, 27 December 2018 at 09:51, Mikhail Gavrilov wrote:
>  Hi folks.
>  Why I cannot read content of some debugfs files which are should be readable.
>  https://lists.freedesktop.org/archives/amd-gfx/2018-December/029918.html
>  
>  [mikhail@localhost ~]$ sudo bash
>  [sudo] password for mikhail:
>  [root@localhost mikhail]# cd /sys/kernel/debug/dri/0
>  [root@localhost 0]# xxd -e amdgpu_gca_config
>  xxd: amdgpu_gca_config: Operation not permitted
>  [root@localhost 0]# getenforce
>  Enforcing
>  [root@localhost 0]# setenforce 0
>  [root@localhost 0]# xxd -e amdgpu_gca_config
>  xxd: amdgpu_gca_config: Operation not permitted
>  [root@localhost 0]# 
Do you have SecureBoot enabled?

Regards,
Dominik
-- 
Fedora   https://getfedora.org  |  RPM Fusion  http://rpmfusion.org
There should be a science of discontent. People need hard times and
oppression to develop psychic muscles.
        -- from "Collected Sayings of Muad'Dib" by the Princess Irulan

[Mikhail Gavrilov]

>  Do you have SecureBoot enabled? 
I use "Other OS"
setting. This is considered as disabling SecureBoot?
If No I don't having another option in setup for completely disabling SecureBoot.

[Dominik 'Rathann' Mierzejewski]

On Friday, 28 December 2018 at 11:52, Mikhail Gavrilov wrote:
>  > Do you have SecureBoot enabled?
>  I use "Other OS" setting. This is considered as disabling SecureBoot?
>  If No I don't having another option in setup for completely disabling SecureBoot.
I have no idea. My firmware has SecureBoot: enabled/disabled.

journalctl -k -b 0 | grep secureboot

will show you what Linux kernel detected.

Regards,
Dominik
-- 
Fedora   https://getfedora.org  |  RPM Fusion  http://rpmfusion.org
There should be a science of discontent. People need hard times and
oppression to develop psychic muscles.
        -- from "Collected Sayings of Muad'Dib" by the Princess Irulan

[Mikhail Gavrilov]

>  I have no idea. My firmware has SecureBoot: enabled/disabled.
>  
>  journalctl -k -b 0 | grep secureboot
>  
>  will show you what Linux kernel detected.
>   
$ journalctl -k -b 0 | grep secureboot
Dec 28 14:18:45 localhost.localdomain kernel: secureboot: Secure boot disabled

Oh, it looks like Secure boot are disabled

[Mikhail Gavrilov]

I found that here blame patch 201 efi-lockdown.patch.
I was build kernel with fedpkg without this patch and problem was gone. 

# cat /sys/kernel/debug/dri/0/amdgpu_gca_config | xxd -e -
00000000: 00000003 00000004 00000004 00000010  ................
00000010: 00000001 00000004 00000010 00000100  ................
00000020: 00000020 00000008 00000020 00000100   ....... .......
00000030: 00000030 000004c0 00000000 0000ffff  0...............
00000040: 00000000 00000000 00000000 00000000  ................
00000050: 00000000 00000000 2a114042 00000010  ........B@.*....
00000060: 00000001 00000000 00fe9fcf 0000008d  ................
00000070: 00000001 0000687f 000000c1 00002308  .....h.......#..
00000080: 00001458                             X...

This patch needs fixing.

[Dan Horák]

On Mon, 07 Jan 2019 14:36:16 -0000
"Mikhail Gavrilov" <mikhail.v.gavrilov(a)gmail.com&gt; wrote:

>  I found that here blame patch 201 efi-lockdown.patch.
>  I was build kernel with fedpkg without this patch and problem was
>  gone. 
>  
>  # cat /sys/kernel/debug/dri/0/amdgpu_gca_config | xxd -e -
>  00000000: 00000003 00000004 00000004 00000010  ................
>  00000010: 00000001 00000004 00000010 00000100  ................
>  00000020: 00000020 00000008 00000020 00000100   ....... .......
>  00000030: 00000030 000004c0 00000000 0000ffff  0...............
>  00000040: 00000000 00000000 00000000 00000000  ................
>  00000050: 00000000 00000000 2a114042 00000010  ........B@.*....
>  00000060: 00000001 00000000 00fe9fcf 0000008d  ................
>  00000070: 00000001 0000687f 000000c1 00002308  .....h.......#..
>  00000080: 00001458                             X...
>  
>  This patch needs fixing. 
I guess you experience
https://bugzilla.redhat.com/show_bug.cgi?id=1658675
- contains a proposed fix.


		Dan

[Mikhail Gavrilov]

I builded vanila kernel by this instruction:
https://fedoraproject.org/wiki/Building_a_custom_kernel
On vanila kernel I am able access to files which are restricted on Fedora kernel.
So I think some Fedora patch is culprit here.

Is anyone here who has these patches added?

<pre>
# cat /sys/kernel/debug/dri/0/amdgpu_gca_config | xxd -e -
00000000: 00000003 00000004 00000004 00000010  ................
00000010: 00000001 00000004 00000010 00000100  ................
00000020: 00000020 00000008 00000020 00000100   ....... .......
00000030: 00000030 000004c0 00000000 0000ffff  0...............
00000040: 00000000 00000000 00000000 00000000  ................
00000050: 00000000 00000000 2a114042 00000010  ........B@.*....
00000060: 00000001 00000000 00fe9fcf 0000008d  ................
00000070: 00000001 0000687f 000000c1 00002308  .....h.......#..
00000080: 00001458                             X...
</pre>