[PATCH V35 29/29] lockdown: Print current->comm in restriction messages

off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook --- fs/proc/kcore.c | 5 +++-- security/lockdown/lockdown.c | 8 ++-- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c index ee2c576cc94e..e2ed8e08cc7a 100

[PATCH V35 24/29] Lock down perf when in confidentiality mode

From: David Howells Disallow the use of certain perf facilities that might allow userspace to access kernel data. Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Arnaldo Carvalho de Melo --- include/linux

[PATCH V35 17/29] Prohibit PCMCIA CIS storage when the kernel is locked down

From: David Howells Prohibit replacement of the PCMCIA Card Information Structure when the kernel is locked down. Suggested-by: Dominik Brodowski Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook --- drivers/pcmcia/cistpl.c | 5 + include/linux

[PATCH V35 28/29] efi: Restrict efivar_ssdt_load when the kernel is locked down

efivar_ssdt_load allows the kernel to import arbitrary ACPI code from an EFI variable, which gives arbitrary code execution in ring 0. Prevent that when the kernel is locked down. Signed-off-by: Matthew Garrett Acked-by: Ard Biesheuvel Reviewed-by: Kees Cook Cc: Ard Biesheuvel Cc: linux

[PATCH V35 22/29] Lock down tracing and perf kprobes when in confidentiality mode

modules. Reported-by: Alexei Starovoitov Signed-off-by: David Howells Signed-off-by: Matthew Garrett Acked-by: Masami Hiramatsu Reviewed-by: Kees Cook Cc: Naveen N. Rao Cc: Anil S Keshavamurthy Cc: da...@davemloft.net Cc: Masami Hiramatsu --- include/linux/security.h | 1 + kernel

[PATCH V35 19/29] Lock down module params that specify hardware parameters (eg. ioport)

From: David Howells Provided an annotation for module parameters that specify hardware parameters (such as io ports, iomem addresses, irqs, dma channels, fixed dma buffers and other types). Suggested-by: Alan Cox Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees

[PATCH V35 11/29] PCI: Lock down BAR access when the kernel is locked down

From: Matthew Garrett Any hardware that can potentially generate DMA has to be locked down in order to avoid it being possible for an attacker to modify kernel code, allowing them to circumvent disabled module loading or module signing. Default to paranoid - in future we can potentially relax

[PATCH V35 05/29] Restrict /dev/{mem,kmem,port} when the kernel is locked down

From: Matthew Garrett Allowing users to read and write to core kernel memory makes it possible for the kernel to be subverted, avoiding module loading restrictions, and also to steal cryptographic information. Disallow /dev/mem and /dev/kmem from being opened this when the kernel has been

[PATCH V35 08/29] kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE

. KEXEC_SIG_FORCE disallows images without a valid signature. Signed-off-by: Jiri Bohac Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Jiri Bohac Reviewed-by: Dave Young cc: ke...@lists.infradead.org --- arch/x86/Kconfig | 20 + crypto

[PATCH V35 13/29] x86/msr: Restrict MSR access when the kernel is locked down

From: Matthew Garrett Writing to MSRs should not be allowed if the kernel is locked down, since it could lead to execution of arbitrary code in kernel mode. Based on a patch by Kees Cook. Signed-off-by: Matthew Garrett Signed-off-by: David Howells Acked-by: Kees Cook Reviewed-by: Thomas

[PATCH V35 12/29] x86: Lock down IO port access when the kernel is locked down

From: Matthew Garrett IO port access would permit users to gain access to PCI configuration registers, which in turn (on a lot of hardware) give access to MMIO register space. This would potentially permit root to trigger arbitrary DMA, so lock it down by default. This also implicitly locks

[PATCH V35 03/29] security: Add a static lockdown policy LSM

securityfs), boot time (via a kernel parameter) or build time (via a kconfig option). Based on initial code by David Howells. Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook Cc: David Howells --- .../admin-guide/kernel-parameters.txt | 9 + include/linux/security.h

[PATCH V35 04/29] Enforce module signatures if the kernel is locked down

(EKEYREJECTED) or a system error occurs (eg. ENOMEM), we return the error we got. Note that the X.509 code doesn't check for key expiry as the RTC might not be valid or might not have been transferred to the kernel's clock yet. [Modified by Matthew Garrett to remove the IMA integration

[PATCH V35 00/29] Kernel lockdown functionality

Minor updates to the previous patchset to take some review comments into account - no significant changes in functionality, other than that the eBPF patch now only disables the kernel read functions as requested.

[PATCH V35 01/29] security: Support early LSMs

are initialised in link order and cannot be overridden via boot parameters, and cannot make use of kmalloc() (since the allocator isn't initialised yet). Signed-off-by: Matthew Garrett Acked-by: Kees Cook --- include/asm-generic/vmlinux.lds.h | 8 - include/linux/lsm_hooks.h | 6

[PATCH V35 02/29] security: Add a "locked down" LSM hook

Add a mechanism to allow LSMs to make a policy decision around whether kernel functionality that would allow tampering with or examining the runtime state of the kernel should be permitted. Signed-off-by: Matthew Garrett Acked-by: Kees Cook --- include/linux/lsm_hooks.h | 2 ++ include/linux

Re: [PATCH V33 24/30] bpf: Restrict bpf when kernel lockdown is in confidentiality mode

On Thu, Jun 27, 2019 at 4:27 PM Andy Lutomirski wrote: > They're really quite similar in my mind. Certainly some things in the > "integrity" category give absolutely trivial control over the kernel > (e.g. modules) while others make it quite challenging (ioperm), but > the end result is very

Re: [PATCH V33 24/30] bpf: Restrict bpf when kernel lockdown is in confidentiality mode

On Thu, Jun 27, 2019 at 1:16 PM Stephen Smalley wrote: > That would only allow the LSM to further lock down the system above the > lockdown level set at boot, not grant exemptions for specific > functionality/interfaces required by the user or by a specific > process/program. You'd have to boot

Re: [PATCH V34 19/29] Lock down module params that specify hardware parameters (eg. ioport)

On Wed, Jun 26, 2019 at 6:49 PM Daniel Axtens wrote: > > Matthew Garrett writes: > > + if (kp->flags & KERNEL_PARAM_FL_HWPARAM && > > + security_locked_down(LOCKDOWN_MODULE_PARAMETERS)) > > + return false; > > + return t

Re: [PATCH V33 29/30] tracefs: Restrict tracefs when the kernel is locked down

On Wed, Jun 26, 2019 at 6:07 AM Steven Rostedt wrote: > > On Thu, 20 Jun 2019 18:19:40 -0700 > Matthew Garrett wrote: > > +static const struct file_operations tracefs_proxy_file_operations = { > > + .read = default_read_file, > > + .write

Re: [PATCH V34 00/29] Lockdown as an LSM

On Mon, Jun 24, 2019 at 4:01 PM James Morris wrote: > > On Fri, 21 Jun 2019, Matthew Garrett wrote: > > > Minor updates over V33 - security_is_locked_down renamed to > > security_locked_down, return value of security_locked_down is returned > > in most cases, one un

Re: [PATCH V34 23/29] bpf: Restrict bpf when kernel lockdown is in confidentiality mode

On Mon, Jun 24, 2019 at 2:22 PM Daniel Borkmann wrote: > Agree, for example, bpf_probe_write_user() can never write into > kernel memory (only user one). Just thinking out loud, wouldn't it > be cleaner and more generic to perform this check at the actual function > which performs the kernel

Re: [PATCH V34 23/29] bpf: Restrict bpf when kernel lockdown is in confidentiality mode

On Mon, Jun 24, 2019 at 1:09 PM Andy Lutomirski wrote: > I'm confused. I understand why we're restricting bpf_probe_read(). > Why are we restricting bpf_probe_write_user() and bpf_trace_printk(), > though? Hmm. I think the thinking here was around exfiltration mechanisms, but if the read is

Re: [PATCH V34 23/29] bpf: Restrict bpf when kernel lockdown is in confidentiality mode

On Mon, Jun 24, 2019 at 8:37 AM Daniel Borkmann wrote: > > On 06/22/2019 02:03 AM, Matthew Garrett wrote: > > From: David Howells > > > > There are some bpf functions can be used to read kernel memory: > > Nit: that Fixed. > > bpf_probe_read, bpf_p

[PATCH V34 14/29] ACPI: Limit access to custom_method when the kernel is locked down

From: Matthew Garrett custom_method effectively allows arbitrary access to system memory, making it possible for an attacker to circumvent restrictions on module loading. Disable it if the kernel is locked down. Signed-off-by: Matthew Garrett Signed-off-by: David Howells cc: linux

[PATCH V34 16/29] acpi: Disable ACPI table override if the kernel is locked down

uld disallow any unauthenticated changes to kernel space. ACPI tables contain code invoked by the kernel, so do not allow ACPI tables to be overridden if the kernel is locked down. Signed-off-by: Linn Crosetto Signed-off-by: David Howells Signed-off-by: Matthew Garrett cc: li

[PATCH V34 19/29] Lock down module params that specify hardware parameters (eg. ioport)

From: David Howells Provided an annotation for module parameters that specify hardware parameters (such as io ports, iomem addresses, irqs, dma channels, fixed dma buffers and other types). Suggested-by: Alan Cox Signed-off-by: David Howells Signed-off-by: Matthew Garrett --- include/linux

[PATCH V34 13/29] x86/msr: Restrict MSR access when the kernel is locked down

From: Matthew Garrett Writing to MSRs should not be allowed if the kernel is locked down, since it could lead to execution of arbitrary code in kernel mode. Based on a patch by Kees Cook. Signed-off-by: Matthew Garrett Signed-off-by: David Howells Acked-by: Kees Cook Reviewed-by: Thomas

[PATCH V34 22/29] Lock down tracing and perf kprobes when in confidentiality mode

modules. Reported-by: Alexei Starovoitov Signed-off-by: David Howells Signed-off-by: Matthew Garrett Cc: Naveen N. Rao Cc: Anil S Keshavamurthy Cc: da...@davemloft.net Cc: Masami Hiramatsu --- include/linux/security.h | 1 + kernel/trace/trace_kprobe.c | 5 + security/lockdown

[PATCH V34 27/29] tracefs: Restrict tracefs when the kernel is locked down

Tracefs may release more information about the kernel than desirable, so restrict it when the kernel is locked down in confidentiality mode by preventing open(). Signed-off-by: Matthew Garrett Cc: Steven Rostedt --- fs/tracefs/inode.c | 43

[PATCH V34 26/29] debugfs: Restrict debugfs when the kernel is locked down

, as there are 19 creation functions and ~1600 call sites (some of them in loops scanning tables). Signed-off-by: David Howells cc: Andy Shevchenko cc: acpi4asus-u...@lists.sourceforge.net cc: platform-driver-...@vger.kernel.org cc: Matthew Garrett cc: Thomas Gleixner Signed-off-by: Matthew Garrett

[PATCH V34 29/29] lockdown: Print current->comm in restriction messages

off-by: David Howells Signed-off-by: Matthew Garrett --- security/lockdown/lockdown.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c index 98f9ee0026d5..9ca6f442fbc7 100644 --- a/security/lockdown/lockdown.c +++ b/secur

[PATCH V34 28/29] efi: Restrict efivar_ssdt_load when the kernel is locked down

efivar_ssdt_load allows the kernel to import arbitrary ACPI code from an EFI variable, which gives arbitrary code execution in ring 0. Prevent that when the kernel is locked down. Signed-off-by: Matthew Garrett Cc: Ard Biesheuvel Cc: linux-...@vger.kernel.org --- drivers/firmware/efi/efi.c | 6

[PATCH V34 10/29] hibernate: Disable when the kernel is locked down

-by: David Howells Signed-off-by: Matthew Garrett Cc: r...@rjwysocki.net Cc: pa...@ucw.cz cc: linux...@vger.kernel.org --- include/linux/security.h | 1 + kernel/power/hibernate.c | 3 ++- security/lockdown/lockdown.c | 1 + 3 files changed, 4 insertions(+), 1 deletion(-) diff --git a/include

[PATCH V34 15/29] acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down

From: Josh Boyer This option allows userspace to pass the RSDP address to the kernel, which makes it possible for a user to modify the workings of hardware . Reject the option when the kernel is locked down. Signed-off-by: Josh Boyer Signed-off-by: David Howells Signed-off-by: Matthew

[PATCH V34 12/29] x86: Lock down IO port access when the kernel is locked down

From: Matthew Garrett IO port access would permit users to gain access to PCI configuration registers, which in turn (on a lot of hardware) give access to MMIO register space. This would potentially permit root to trigger arbitrary DMA, so lock it down by default. This also implicitly locks

[PATCH V34 06/29] kexec_load: Disable at runtime if the kernel is locked down

From: Matthew Garrett The kexec_load() syscall permits the loading and execution of arbitrary code in ring 0, which is something that lock-down is meant to prevent. It makes sense to disable kexec_load() in this situation. This does not affect kexec_file_load() syscall which can check

[PATCH V34 18/29] Lock down TIOCSSERIAL

. Reported-by: Greg Kroah-Hartman Signed-off-by: David Howells Signed-off-by: Matthew Garrett cc: Jiri Slaby Cc: linux-ser...@vger.kernel.org --- drivers/tty/serial/serial_core.c | 5 + include/linux/security.h | 1 + security/lockdown/lockdown.c | 1 + 3 files changed, 7 insertions

[PATCH V34 24/29] Lock down perf when in confidentiality mode

From: David Howells Disallow the use of certain perf facilities that might allow userspace to access kernel data. Signed-off-by: David Howells Signed-off-by: Matthew Garrett Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Arnaldo Carvalho de Melo --- include/linux/security.h | 1 + kernel

[PATCH V34 08/29] kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE

if in non-forcing mode. ] Signed-off-by: Jiri Bohac Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Jiri Bohac cc: ke...@lists.infradead.org --- arch/x86/Kconfig | 20 --- crypto/asymmetric_keys/verify_pefile.c | 4 ++- include/linux/kexec.h

[PATCH V34 23/29] bpf: Restrict bpf when kernel lockdown is in confidentiality mode

restriction. Disable them if the kernel has been locked down in confidentiality mode. Suggested-by: Alexei Starovoitov Signed-off-by: David Howells Signed-off-by: Matthew Garrett cc: net...@vger.kernel.org cc: Chun-Yi Lee cc: Alexei Starovoitov Cc: Daniel Borkmann --- include/linux

[PATCH V34 17/29] Prohibit PCMCIA CIS storage when the kernel is locked down

From: David Howells Prohibit replacement of the PCMCIA Card Information Structure when the kernel is locked down. Suggested-by: Dominik Brodowski Signed-off-by: David Howells Signed-off-by: Matthew Garrett --- drivers/pcmcia/cistpl.c | 5 + include/linux/security.h | 1

[PATCH V34 25/29] kexec: Allow kexec_file() with appropriate IMA policy when locked down

-by: Matthew Garrett Acked-by: Mimi Zohar Cc: Dmitry Kasatkin Cc: linux-integr...@vger.kernel.org --- include/linux/ima.h | 9 ++ kernel/kexec_file.c | 11 +-- security/integrity/ima/ima.h| 2 ++ security/integrity/ima/ima_main.c | 2

[PATCH V34 21/29] Lock down /proc/kcore

From: David Howells Disallow access to /proc/kcore when the kernel is locked down to prevent access to cryptographic data. This is limited to lockdown confidentiality mode and is still permitted in integrity mode. Signed-off-by: David Howells Signed-off-by: Matthew Garrett --- fs/proc

[PATCH V34 20/29] x86/mmiotrace: Lock down the testmmiotrace module

From: David Howells The testmmiotrace module shouldn't be permitted when the kernel is locked down as it can be used to arbitrarily read and write MMIO space. This is a runtime check rather than buildtime in order to allow configurations where the same kernel may be run in both locked down or

[PATCH V34 11/29] PCI: Lock down BAR access when the kernel is locked down

From: Matthew Garrett Any hardware that can potentially generate DMA has to be locked down in order to avoid it being possible for an attacker to modify kernel code, allowing them to circumvent disabled module loading or module signing. Default to paranoid - in future we can potentially relax

[PATCH V34 05/29] Restrict /dev/{mem,kmem,port} when the kernel is locked down

From: Matthew Garrett Allowing users to read and write to core kernel memory makes it possible for the kernel to be subverted, avoiding module loading restrictions, and also to steal cryptographic information. Disallow /dev/mem and /dev/kmem from being opened this when the kernel has been

[PATCH V34 03/29] security: Add a static lockdown policy LSM

securityfs), boot time (via a kernel parameter) or build time (via a kconfig option). Based on initial code by David Howells. Signed-off-by: Matthew Garrett Cc: David Howells --- .../admin-guide/kernel-parameters.txt | 9 + include/linux/security.h | 4 + security

[PATCH V34 04/29] Enforce module signatures if the kernel is locked down

(EKEYREJECTED) or a system error occurs (eg. ENOMEM), we return the error we got. Note that the X.509 code doesn't check for key expiry as the RTC might not be valid or might not have been transferred to the kernel's clock yet. [Modified by Matthew Garrett to remove the IMA integration

[PATCH V34 02/29] security: Add a "locked down" LSM hook

Add a mechanism to allow LSMs to make a policy decision around whether kernel functionality that would allow tampering with or examining the runtime state of the kernel should be permitted. Signed-off-by: Matthew Garrett --- include/linux/lsm_hooks.h | 2 ++ include/linux/security.h | 11

[PATCH V34 01/29] security: Support early LSMs

are initialised in link order and cannot be overridden via boot parameters, and cannot make use of kmalloc() (since the allocator isn't initialised yet). Signed-off-by: Matthew Garrett --- include/asm-generic/vmlinux.lds.h | 8 - include/linux/lsm_hooks.h | 6 include/linux

[PATCH V34 00/29] Lockdown as an LSM

Minor updates over V33 - security_is_locked_down renamed to security_locked_down, return value of security_locked_down is returned in most cases, one unnecessary patch was dropped, couple of minor nits fixed.

Re: [PATCH V33 03/30] security: Add a static lockdown policy LSM

On Fri, Jun 21, 2019 at 12:37 PM Matthew Garrett wrote: > I'll check, I'm bad at finding these new fangled things. Ah, I see - there's sysfs_match_string(), but that doesn't really work for this case because we'd still need to do another set of checks to see whether the level we

Re: [PATCH V33 24/30] bpf: Restrict bpf when kernel lockdown is in confidentiality mode

On Thu, Jun 20, 2019 at 10:22 PM Andy Lutomirski wrote: > On Thu, Jun 20, 2019 at 6:21 PM Matthew Garrett > wrote: > > --- a/security/lockdown/lockdown.c > > +++ b/security/lockdown/lockdown.c > > @@ -33,6 +33,7 @@ static char > > *lockdown_reasons[

Re: [PATCH V33 03/30] security: Add a static lockdown policy LSM

On Thu, Jun 20, 2019 at 8:44 PM Kees Cook wrote: > > On Thu, Jun 20, 2019 at 06:19:14PM -0700, Matthew Garrett wrote: > > +/* > > + * If you add to this, remember to extend lockdown_reasons in > > + * security/lockdown/lockdown.c. > > + */ > > Best to

Re: [PATCH V33 02/30] security: Add a "locked down" LSM hook

On Thu, Jun 20, 2019 at 8:23 PM Kees Cook wrote: > bikeshed: can this just be called "security_locked_down" without the > "is"? Sure.

Re: [PATCH V33 01/30] security: Support early LSMs

On Thu, Jun 20, 2019 at 10:23 PM Andy Lutomirski wrote: > > On Thu, Jun 20, 2019 at 6:22 PM Matthew Garrett > wrote: > > > > The lockdown module is intended to allow for kernels to be locked down > > early in boot - sufficiently early that we don't have the abilit

Re: [PATCH V33 01/30] security: Support early LSMs

On Thu, Jun 20, 2019 at 8:22 PM Kees Cook wrote: > > On Thu, Jun 20, 2019 at 06:19:12PM -0700, Matthew Garrett wrote: > > The lockdown module is intended to allow for kernels to be locked down > > early in boot - sufficiently early that we don't have the ability to > > km

[PATCH V33 01/30] security: Support early LSMs

-by: Matthew Garrett --- include/asm-generic/vmlinux.lds.h | 8 +- include/linux/lsm_hooks.h | 6 include/linux/security.h | 1 + init/main.c | 1 + security/security.c | 48 +-- 5 files changed, 54

[PATCH V33 05/30] Restrict /dev/{mem,kmem,port} when the kernel is locked down

From: Matthew Garrett Allowing users to read and write to core kernel memory makes it possible for the kernel to be subverted, avoiding module loading restrictions, and also to steal cryptographic information. Disallow /dev/mem and /dev/kmem from being opened this when the kernel has been

[PATCH V33 04/30] Enforce module signatures if the kernel is locked down

(EKEYREJECTED) or a system error occurs (eg. ENOMEM), we return the error we got. Note that the X.509 code doesn't check for key expiry as the RTC might not be valid or might not have been transferred to the kernel's clock yet. [Modified by Matthew Garrett to remove the IMA integration

[PATCH V33 09/30] kexec_file: Restrict at runtime if the kernel is locked down

lockdowns. Modified by Matthew Garrett to remove the IMA integration, which will be replaced by integrating with the IMA architecture policy patches.] Signed-off-by: Jiri Bohac Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Jiri Bohac cc: ke...@lists.infradead.org

[PATCH V33 15/30] ACPI: Limit access to custom_method when the kernel is locked down

From: Matthew Garrett custom_method effectively allows arbitrary access to system memory, making it possible for an attacker to circumvent restrictions on module loading. Disable it if the kernel is locked down. Signed-off-by: Matthew Garrett Signed-off-by: David Howells cc: linux

[PATCH V33 17/30] acpi: Disable ACPI table override if the kernel is locked down

uld disallow any unauthenticated changes to kernel space. ACPI tables contain code invoked by the kernel, so do not allow ACPI tables to be overridden if the kernel is locked down. Signed-off-by: Linn Crosetto Signed-off-by: David Howells Signed-off-by: Matthew Garrett cc: li

[PATCH V33 22/30] Lock down /proc/kcore

From: David Howells Disallow access to /proc/kcore when the kernel is locked down to prevent access to cryptographic data. This is limited to lockdown confidentiality mode and is still permitted in integrity mode. Signed-off-by: David Howells Signed-off-by: Matthew Garrett --- fs/proc

[PATCH V33 20/30] Lock down module params that specify hardware parameters (eg. ioport)

From: David Howells Provided an annotation for module parameters that specify hardware parameters (such as io ports, iomem addresses, irqs, dma channels, fixed dma buffers and other types). Suggested-by: Alan Cox Signed-off-by: David Howells Signed-off-by: Matthew Garrett --- include/linux

[PATCH V33 18/30] Prohibit PCMCIA CIS storage when the kernel is locked down

From: David Howells Prohibit replacement of the PCMCIA Card Information Structure when the kernel is locked down. Suggested-by: Dominik Brodowski Signed-off-by: David Howells Signed-off-by: Matthew Garrett --- drivers/pcmcia/cistpl.c | 4 include/linux/security.h | 1

[PATCH V33 21/30] x86/mmiotrace: Lock down the testmmiotrace module

From: David Howells The testmmiotrace module shouldn't be permitted when the kernel is locked down as it can be used to arbitrarily read and write MMIO space. This is a runtime check rather than buildtime in order to allow configurations where the same kernel may be run in both locked down or

[PATCH V33 25/30] Lock down perf when in confidentiality mode

From: David Howells Disallow the use of certain perf facilities that might allow userspace to access kernel data. Signed-off-by: David Howells Signed-off-by: Matthew Garrett Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Arnaldo Carvalho de Melo --- include/linux/security.h | 1 + kernel

[PATCH V33 26/30] kexec: Allow kexec_file() with appropriate IMA policy when locked down

-by: Matthew Garrett Acked-by: Mimi Zohar Cc: Dmitry Kasatkin Cc: linux-integr...@vger.kernel.org --- include/linux/ima.h | 9 ++ kernel/kexec_file.c | 7 +++- security/integrity/ima/ima.h| 2 ++ security/integrity/ima/ima_main.c | 2 +- security

[PATCH V33 23/30] Lock down tracing and perf kprobes when in confidentiality mode

modules. Reported-by: Alexei Starovoitov Signed-off-by: David Howells Signed-off-by: Matthew Garrett Cc: Naveen N. Rao Cc: Anil S Keshavamurthy Cc: da...@davemloft.net Cc: Masami Hiramatsu --- include/linux/security.h | 1 + kernel/trace/trace_kprobe.c | 4 security/lockdown

[PATCH V33 12/30] PCI: Lock down BAR access when the kernel is locked down

From: Matthew Garrett Any hardware that can potentially generate DMA has to be locked down in order to avoid it being possible for an attacker to modify kernel code, allowing them to circumvent disabled module loading or module signing. Default to paranoid - in future we can potentially relax

[PATCH V33 28/30] debugfs: Restrict debugfs when the kernel is locked down

, as there are 19 creation functions and ~1600 call sites (some of them in loops scanning tables). Signed-off-by: David Howells cc: Andy Shevchenko cc: acpi4asus-u...@lists.sourceforge.net cc: platform-driver-...@vger.kernel.org cc: Matthew Garrett cc: Thomas Gleixner Signed-off-by: Matthew Garrett

[PATCH V33 30/30] efi: Restrict efivar_ssdt_load when the kernel is locked down

efivar_ssdt_load allows the kernel to import arbitrary ACPI code from an EFI variable, which gives arbitrary code execution in ring 0. Prevent that when the kernel is locked down. Signed-off-by: Matthew Garrett Cc: Ard Biesheuvel Cc: linux-...@vger.kernel.org --- drivers/firmware/efi/efi.c | 4

[PATCH V33 29/30] tracefs: Restrict tracefs when the kernel is locked down

Tracefs may release more information about the kernel than desirable, so restrict it when the kernel is locked down in confidentiality mode by preventing open(). Signed-off-by: Matthew Garrett Cc: Steven Rostedt --- fs/tracefs/inode.c | 41

[PATCH V33 27/30] lockdown: Print current->comm in restriction messages

off-by: David Howells Signed-off-by: Matthew Garrett --- security/lockdown/lockdown.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c index 14edc475d75c..408f0048f8a2 100644 --- a/security/lockdown/lockdown.c +++ b/secur

[PATCH V33 24/30] bpf: Restrict bpf when kernel lockdown is in confidentiality mode

restriction. Disable them if the kernel has been locked down in confidentiality mode. Suggested-by: Alexei Starovoitov Signed-off-by: David Howells Signed-off-by: Matthew Garrett cc: net...@vger.kernel.org cc: Chun-Yi Lee cc: Alexei Starovoitov Cc: Daniel Borkmann --- include/linux

[PATCH V33 14/30] x86/msr: Restrict MSR access when the kernel is locked down

From: Matthew Garrett Writing to MSRs should not be allowed if the kernel is locked down, since it could lead to execution of arbitrary code in kernel mode. Based on a patch by Kees Cook. Signed-off-by: Matthew Garrett Signed-off-by: David Howells Acked-by: Kees Cook Reviewed-by: Thomas

[PATCH V33 19/30] Lock down TIOCSSERIAL

. Reported-by: Greg Kroah-Hartman Signed-off-by: David Howells Signed-off-by: Matthew Garrett cc: Jiri Slaby Cc: linux-ser...@vger.kernel.org --- drivers/tty/serial/serial_core.c | 7 +++ include/linux/security.h | 1 + security/lockdown/lockdown.c | 1 + 3 files changed, 9

[PATCH V33 11/30] uswsusp: Disable when the kernel is locked down

From: Matthew Garrett uswsusp allows a user process to dump and then restore kernel state, which makes it possible to modify the running kernel. Disable this if the kernel is locked down. Signed-off-by: David Howells Signed-off-by: Matthew Garrett cc: linux...@vger.kernel.org Cc: pa

[PATCH V33 16/30] acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down

From: Josh Boyer This option allows userspace to pass the RSDP address to the kernel, which makes it possible for a user to modify the workings of hardware . Reject the option when the kernel is locked down. Signed-off-by: Josh Boyer Signed-off-by: David Howells Signed-off-by: Matthew

[PATCH V33 13/30] x86: Lock down IO port access when the kernel is locked down

From: Matthew Garrett IO port access would permit users to gain access to PCI configuration registers, which in turn (on a lot of hardware) give access to MMIO register space. This would potentially permit root to trigger arbitrary DMA, so lock it down by default. This also implicitly locks

[PATCH V33 10/30] hibernate: Disable when the kernel is locked down

-by: David Howells Signed-off-by: Matthew Garrett Cc: r...@rjwysocki.net Cc: pa...@ucw.cz cc: linux...@vger.kernel.org --- include/linux/security.h | 1 + kernel/power/hibernate.c | 4 +++- security/lockdown/lockdown.c | 1 + 3 files changed, 5 insertions(+), 1 deletion(-) diff --git a/include

[PATCH V33 07/30] Copy secure_boot flag in boot params across kexec reboot

the secure_boot flag in original kernel. secure_boot flag in boot_params is set in EFI stub, but kexec bypasses the stub. Fixing this issue by copying secure_boot flag across kexec reboot. Signed-off-by: Dave Young Signed-off-by: David Howells Signed-off-by: Matthew Garrett cc: ke

[PATCH V33 03/30] security: Add a static lockdown policy LSM

securityfs), boot time (via a kernel parameter) or build time (via a kconfig option). Based on initial code by David Howells. Signed-off-by: Matthew Garrett Cc: David Howells --- .../admin-guide/kernel-parameters.txt | 9 + include/linux/security.h | 4 + security

[PATCH V33 06/30] kexec_load: Disable at runtime if the kernel is locked down

From: Matthew Garrett The kexec_load() syscall permits the loading and execution of arbitrary code in ring 0, which is something that lock-down is meant to prevent. It makes sense to disable kexec_load() in this situation. This does not affect kexec_file_load() syscall which can check

[PATCH V33 00/30] Lockdown as an LSM

Hi James, Let's see how this one goes. I've moved the lockdown code into an LSM hook and provided an internal enum of lockdown reasons that LSMs can either group or expose at whatever level of granularity is appropriate. I've also included a static LSM that mimics the behaviour of the existing

[PATCH V33 02/30] security: Add a "locked down" LSM hook

Add a mechanism to allow LSMs to make a policy decision around whether kernel functionality that would allow tampering with or examining the runtime state of the kernel should be permitted. Signed-off-by: Matthew Garrett --- include/linux/lsm_hooks.h | 2 ++ include/linux/security.h | 11

Re: [PATCH V4] mm: Allow userland to request that the kernel clear memory on release

On Mon, Apr 29, 2019 at 12:36 PM Matthew Garrett wrote: (snip) Any further feedback on this? Does it seem conceptually useful?

Re: [RFC] Turn lockdown into an LSM

On Tue, May 21, 2019 at 7:40 PM James Morris wrote: > An LSM could also potentially implement its own policy for the hook. That was my plan. Right now the hook just gets an ASCII description of the reason for the lockdown - that seems suboptimal for cases like SELinux. What information would you

[RFC] Turn lockdown into an LSM

Hi James, This is a quick attempt to integrate lockdown into the existing LSM framework. It adds a new lockdown security hook and an LSM that defines the existing coarse-grained policy, and also adds a new DEFINE_EARLY_LSM() definition in order to permit lockdown (and potentially other modules)

[RFC 1/2] security: Support early LSMs

-by: Matthew Garrett --- include/asm-generic/vmlinux.lds.h | 8 +- include/linux/lsm_hooks.h | 6 include/linux/security.h | 1 + init/main.c | 1 + security/security.c | 48 +-- 5 files changed, 54

[RFC 2/2] Add the ability to lock down access to the running kernel image

, fiddling with MSR registers and disallowing hibernation. Signed-off-by: David Howells Signed-off-by: Matthew Garrett --- Documentation/ABI/testing/lockdown| 19 +++ .../admin-guide/kernel-parameters.txt | 9 + Documentation/admin-guide/lockdown.rst| 60

[PATCH V7 1/4] tpm: Abstract crypto agile event size calculations

From: Matthew Garrett We need to calculate the size of crypto agile events in multiple locations, including in the EFI boot stub. The easiest way to do this is to put it in a header file as an inline and leave a wrapper to ensure we don't end up with multiple copies of it embedded

Re: [PATCH V32 01/27] Add the ability to lock down access to the running kernel image

On Thu, May 2, 2019 at 2:07 PM James Morris wrote: > One possible direction is to (as previously mentioned) assign IDs to each > callsite and be able to check this ID against a simple policy array > (allow/deny). The default policy choices could be reduced to 'all' or > 'none' during kconfig,

Re: [PATCH V32 01/27] Add the ability to lock down access to the running kernel image

Hi James, What's the best way forward with this? I'm still not entirely clear on how it can be implemented purely as an LSM, but if you have ideas on what sort of implementation you'd prefer I'm happy to work on that.

[PATCH V4] mm: Allow userland to request that the kernel clear memory on release

From: Matthew Garrett Applications that hold secrets and wish to avoid them leaking can use mlock() to prevent the page from being pushed out to swap and MADV_DONTDUMP to prevent it from being included in core dumps. Applications can also use atexit() handlers to overwrite secrets on application

Re: [PATCH V3] mm: Allow userland to request that the kernel clear memory on release

On Fri, Apr 26, 2019 at 12:45 AM Vlastimil Babka wrote: > > On 4/26/19 12:58 AM, Matthew Garrett wrote: > > Updated based on feedback from Jann - for now let's just prevent setting > > the flag on anything that has already mapped some pages, which avoids > > ch

Re: [PATCH V2] mm: Allow userland to request that the kernel clear memory on release

On Thu, Apr 25, 2019 at 10:25 PM Michal Hocko wrote: > > On Thu 25-04-19 13:39:01, Matthew Garrett wrote: > > Yes, given MADV_DONTDUMP doesn't imply mlock I thought it'd be more > > consistent to keep those independent. > > Do we want to fail madvise call on VMAs that ar

[PATCH V3] mm: Allow userland to request that the kernel clear memory on release

From: Matthew Garrett Applications that hold secrets and wish to avoid them leaking can use mlock() to prevent the page from being pushed out to swap and MADV_DONTDUMP to prevent it from being included in core dumps. Applications can also use atexit() handlers to overwrite secrets on application

<    1   2   3   4   5   6   7   8   9   10   >