From: David Howells <[email protected]> Disallow the creation of perf and ftrace kprobes when the kernel is locked down in confidentiality mode by preventing their registration. This prevents kprobes from being used to access kernel memory to steal crypto data, but continues to allow the use of kprobes from signed modules.
Reported-by: Alexei Starovoitov <[email protected]> Signed-off-by: David Howells <[email protected]> Signed-off-by: Matthew Garrett <[email protected]> Cc: Naveen N. Rao <[email protected]> Cc: Anil S Keshavamurthy <[email protected]> Cc: [email protected] Cc: Masami Hiramatsu <[email protected]> --- kernel/trace/trace_kprobe.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c index d5fb09ebba8b..5c70acd80344 100644 --- a/kernel/trace/trace_kprobe.c +++ b/kernel/trace/trace_kprobe.c @@ -420,6 +420,9 @@ static int __register_trace_kprobe(struct trace_kprobe *tk) { int i, ret; + if (kernel_is_locked_down("Use of kprobes", LOCKDOWN_CONFIDENTIALITY)) + return -EPERM; + if (trace_probe_is_registered(&tk->tp)) return -EINVAL; -- 2.21.0.392.gf8f6787159e-goog
