Re: [PATCH 22/27] Lock down kprobes
On Mon, 25 Mar 2019 15:09:49 -0700
Matthew Garrett wrote:
> From: David Howells
>
> Disallow the creation of kprobes when the kernel is locked down by
> preventing their registration. This prevents kprobes from being used to
> access kernel memory, either to make modifications or to steal crypto data.
Hmm, if you enforce signature check of modules, those modules
should be allowed to use kprobes?
I think we should introduce some kind of trust inheritance from
signed (trusted) modules.
Thank you,
>
> Reported-by: Alexei Starovoitov
> Signed-off-by: David Howells
> Signed-off-by: Matthew Garrett
> Cc: Naveen N. Rao
> Cc: Anil S Keshavamurthy
> Cc: da...@davemloft.net
> Cc: Masami Hiramatsu
> ---
> kernel/kprobes.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/kernel/kprobes.c b/kernel/kprobes.c
> index f4ddfdd2d07e..6f66cca8e2c6 100644
> --- a/kernel/kprobes.c
> +++ b/kernel/kprobes.c
> @@ -1552,6 +1552,9 @@ int register_kprobe(struct kprobe *p)
> struct module *probed_mod;
> kprobe_opcode_t *addr;
>
> + if (kernel_is_locked_down("Use of kprobes"))
> + return -EPERM;
> +
> /* Adjust probe address from symbol */
> addr = kprobe_addr(p);
> if (IS_ERR(addr))
> --
> 2.21.0.392.gf8f6787159e-goog
>
--
Masami Hiramatsu
Re: [PATCH 22/27] Lock down kprobes
On Tue, Mar 26, 2019 at 5:30 AM Masami Hiramatsu wrote: > > On Mon, 25 Mar 2019 15:09:49 -0700 > Matthew Garrett wrote: > > > From: David Howells > > > > Disallow the creation of kprobes when the kernel is locked down by > > preventing their registration. This prevents kprobes from being used to > > access kernel memory, either to make modifications or to steal crypto data. > > Hmm, if you enforce signature check of modules, those modules > should be allowed to use kprobes? > I think we should introduce some kind of trust inheritance from > signed (trusted) modules. Is there any way to install a kprobe /without/ it coming from a module? The presumption in lockdown mode is that module signing is enforced, so I'll admit to not being entirely clear on why this patch is needed in that case.
Re: [PATCH 22/27] Lock down kprobes
On Tue, 26 Mar 2019 10:41:23 -0700 Matthew Garrett wrote: > On Tue, Mar 26, 2019 at 5:30 AM Masami Hiramatsu wrote: > > > > On Mon, 25 Mar 2019 15:09:49 -0700 > > Matthew Garrett wrote: > > > > > From: David Howells > > > > > > Disallow the creation of kprobes when the kernel is locked down by > > > preventing their registration. This prevents kprobes from being used to > > > access kernel memory, either to make modifications or to steal crypto > > > data. > > > > Hmm, if you enforce signature check of modules, those modules > > should be allowed to use kprobes? > > I think we should introduce some kind of trust inheritance from > > signed (trusted) modules. > > Is there any way to install a kprobe /without/ it coming from a > module? The presumption in lockdown mode is that module signing is > enforced, so I'll admit to not being entirely clear on why this patch > is needed in that case. Yes, there are 2 paths, ftrace and perf(bpf). If you want to disable ftrace path (which start from user's input via tracefs), this should be done in trace_kprobe_create()@kernel/trace/trace_kprobe.c. If you want to disable both, __register_trace_kprobe()@kernel/trace/trace_kprobe.c is the best place. Thank you, -- Masami Hiramatsu
