[PATCH V38 22/29] Lock down tracing and perf kprobes when in confidentiality mode

modules. Reported-by: Alexei Starovoitov Signed-off-by: David Howells Signed-off-by: Matthew Garrett Acked-by: Masami Hiramatsu Reviewed-by: Kees Cook Cc: Naveen N. Rao Cc: Anil S Keshavamurthy Cc: da...@davemloft.net Cc: Masami Hiramatsu --- include/linux/security.h | 1 + kernel

[PATCH V38 23/29] bpf: Restrict bpf when kernel lockdown is in confidentiality mode

From: David Howells bpf_read() and bpf_read_str() could potentially be abused to (eg) allow private keys in kernel memory to be leaked. Disable them if the kernel has been locked down in confidentiality mode. Suggested-by: Alexei Starovoitov Signed-off-by: Matthew Garrett Reviewed-by: Kees

[PATCH V38 29/29] lockdown: Print current->comm in restriction messages

off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook --- fs/proc/kcore.c | 5 +++-- security/lockdown/lockdown.c | 8 ++-- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c index ee2c576cc94e..e2ed8e08cc7a 100

[PATCH V38 26/29] debugfs: Restrict debugfs when the kernel is locked down

, as there are 19 creation functions and ~1600 call sites (some of them in loops scanning tables). Signed-off-by: David Howells cc: Andy Shevchenko cc: acpi4asus-u...@lists.sourceforge.net cc: platform-driver-...@vger.kernel.org cc: Matthew Garrett cc: Thomas Gleixner Cc: Greg KH Cc: Rafael J. Wysocki

[PATCH V38 27/29] tracefs: Restrict tracefs when the kernel is locked down

Tracefs may release more information about the kernel than desirable, so restrict it when the kernel is locked down in confidentiality mode by preventing open(). Signed-off-by: Matthew Garrett Reviewed-by: Steven Rostedt (VMware) --- fs/tracefs/inode.c | 40

[PATCH V38 20/29] x86/mmiotrace: Lock down the testmmiotrace module

From: David Howells The testmmiotrace module shouldn't be permitted when the kernel is locked down as it can be used to arbitrarily read and write MMIO space. This is a runtime check rather than buildtime in order to allow configurations where the same kernel may be run in both locked down or

[PATCH V38 25/29] kexec: Allow kexec_file() with appropriate IMA policy when locked down

-by: Matthew Garrett Acked-by: Mimi Zohar Cc: Dmitry Kasatkin Cc: linux-integr...@vger.kernel.org --- include/linux/ima.h | 9 ++ kernel/kexec_file.c | 12 +-- security/integrity/ima/ima.h| 2 ++ security/integrity/ima/ima_main.c | 2

[PATCH V38 21/29] Lock down /proc/kcore

From: David Howells Disallow access to /proc/kcore when the kernel is locked down to prevent access to cryptographic data. This is limited to lockdown confidentiality mode and is still permitted in integrity mode. Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees

[PATCH V38 24/29] Lock down perf when in confidentiality mode

From: David Howells Disallow the use of certain perf facilities that might allow userspace to access kernel data. Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Arnaldo Carvalho de Melo --- include/linux

[PATCH V38 05/29] Restrict /dev/{mem,kmem,port} when the kernel is locked down

From: Matthew Garrett Allowing users to read and write to core kernel memory makes it possible for the kernel to be subverted, avoiding module loading restrictions, and also to steal cryptographic information. Disallow /dev/mem and /dev/kmem from being opened this when the kernel has been

[PATCH V38 13/29] x86/msr: Restrict MSR access when the kernel is locked down

From: Matthew Garrett Writing to MSRs should not be allowed if the kernel is locked down, since it could lead to execution of arbitrary code in kernel mode. Based on a patch by Kees Cook. Signed-off-by: Matthew Garrett Signed-off-by: David Howells Acked-by: Kees Cook Reviewed-by: Thomas

[PATCH V38 16/29] acpi: Disable ACPI table override if the kernel is locked down

uld disallow any unauthenticated changes to kernel space. ACPI tables contain code invoked by the kernel, so do not allow ACPI tables to be overridden if the kernel is locked down. Signed-off-by: Linn Crosetto Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook

[PATCH V38 00/29] security: Add support for locking down the kernel

Fixed an unused function parameter in patch 19, otherwise identical to V37.

[PATCH V38 01/29] security: Support early LSMs

are initialised in link order and cannot be overridden via boot parameters, and cannot make use of kmalloc() (since the allocator isn't initialised yet). Signed-off-by: Matthew Garrett Acked-by: Kees Cook Acked-by: Casey Schaufler --- include/asm-generic/vmlinux.lds.h | 8 - include/linux

[PATCH V38 04/29] Enforce module signatures if the kernel is locked down

(EKEYREJECTED) or a system error occurs (eg. ENOMEM), we return the error we got. Note that the X.509 code doesn't check for key expiry as the RTC might not be valid or might not have been transferred to the kernel's clock yet. [Modified by Matthew Garrett to remove the IMA integration

[PATCH V38 19/29] Lock down module params that specify hardware parameters (eg. ioport)

From: David Howells Provided an annotation for module parameters that specify hardware parameters (such as io ports, iomem addresses, irqs, dma channels, fixed dma buffers and other types). Suggested-by: Alan Cox Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees

[PATCH V38 07/29] Copy secure_boot flag in boot params across kexec reboot

the secure_boot flag in original kernel. secure_boot flag in boot_params is set in EFI stub, but kexec bypasses the stub. Fixing this issue by copying secure_boot flag across kexec reboot. Signed-off-by: Dave Young Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook

[PATCH V38 03/29] security: Add a static lockdown policy LSM

securityfs), boot time (via a kernel parameter) or build time (via a kconfig option). Based on initial code by David Howells. Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook Cc: David Howells --- .../admin-guide/kernel-parameters.txt | 9 + include/linux/security.h

[PATCH V38 12/29] x86: Lock down IO port access when the kernel is locked down

From: Matthew Garrett IO port access would permit users to gain access to PCI configuration registers, which in turn (on a lot of hardware) give access to MMIO register space. This would potentially permit root to trigger arbitrary DMA, so lock it down by default. This also implicitly locks

[PATCH V38 18/29] Lock down TIOCSSERIAL

. Reported-by: Greg Kroah-Hartman Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook cc: Jiri Slaby Cc: linux-ser...@vger.kernel.org --- drivers/tty/serial/serial_core.c | 5 + include/linux/security.h | 1 + security/lockdown/lockdown.c | 1 + 3

[PATCH V38 02/29] security: Add a "locked down" LSM hook

Add a mechanism to allow LSMs to make a policy decision around whether kernel functionality that would allow tampering with or examining the runtime state of the kernel should be permitted. Signed-off-by: Matthew Garrett Acked-by: Kees Cook Acked-by: Casey Schaufler --- include/linux

[PATCH V38 09/29] kexec_file: Restrict at runtime if the kernel is locked down

lockdowns. Modified by Matthew Garrett to remove the IMA integration, which will be replaced by integrating with the IMA architecture policy patches.] Signed-off-by: Jiri Bohac Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Jiri Bohac Reviewed-by: Kees Cook cc: ke

Re: [PATCH V37 19/29] Lock down module params that specify hardware parameters (eg. ioport)

On Thu, Aug 1, 2019 at 9:19 AM Jessica Yu wrote: > Hm, I don't think the doing parameter ended up being used in this function? Thanks for catching that, I'll fix.

Re: [PATCH V37 04/29] Enforce module signatures if the kernel is locked down

On Thu, Aug 1, 2019 at 7:22 AM Jessica Yu wrote: > Apologies if this was addressed in another patch in your series (I've > only skimmed the first few), but what should happen if the kernel is > locked down, but CONFIG_MODULE_SIG=n? Or shouldn't > CONFIG_SECURITY_LOCKDOWN_LSM > depend on

[PATCH V37 01/29] security: Support early LSMs

are initialised in link order and cannot be overridden via boot parameters, and cannot make use of kmalloc() (since the allocator isn't initialised yet). Signed-off-by: Matthew Garrett Acked-by: Kees Cook Acked-by: Casey Schaufler --- include/asm-generic/vmlinux.lds.h | 8 - include/linux

[PATCH V37 05/29] Restrict /dev/{mem,kmem,port} when the kernel is locked down

From: Matthew Garrett Allowing users to read and write to core kernel memory makes it possible for the kernel to be subverted, avoiding module loading restrictions, and also to steal cryptographic information. Disallow /dev/mem and /dev/kmem from being opened this when the kernel has been

[PATCH V37 15/29] acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down

in the kernel proper if lockdown is not enabled. If lockdown is enabled and an RSDP is provided on the command line, this will only be used when parsing SRAT (which shouldn't permit kernel code execution) and will be ignored in the rest of the kernel. (Modified by Matthew Garrett in order to handle

[PATCH V37 19/29] Lock down module params that specify hardware parameters (eg. ioport)

From: David Howells Provided an annotation for module parameters that specify hardware parameters (such as io ports, iomem addresses, irqs, dma channels, fixed dma buffers and other types). Suggested-by: Alan Cox Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees

[PATCH V37 21/29] Lock down /proc/kcore

From: David Howells Disallow access to /proc/kcore when the kernel is locked down to prevent access to cryptographic data. This is limited to lockdown confidentiality mode and is still permitted in integrity mode. Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees

[PATCH V37 17/29] Prohibit PCMCIA CIS storage when the kernel is locked down

From: David Howells Prohibit replacement of the PCMCIA Card Information Structure when the kernel is locked down. Suggested-by: Dominik Brodowski Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook --- drivers/pcmcia/cistpl.c | 5 + include/linux

[PATCH V37 13/29] x86/msr: Restrict MSR access when the kernel is locked down

From: Matthew Garrett Writing to MSRs should not be allowed if the kernel is locked down, since it could lead to execution of arbitrary code in kernel mode. Based on a patch by Kees Cook. Signed-off-by: Matthew Garrett Signed-off-by: David Howells Acked-by: Kees Cook Reviewed-by: Thomas

[PATCH V37 06/29] kexec_load: Disable at runtime if the kernel is locked down

From: Matthew Garrett The kexec_load() syscall permits the loading and execution of arbitrary code in ring 0, which is something that lock-down is meant to prevent. It makes sense to disable kexec_load() in this situation. This does not affect kexec_file_load() syscall which can check

[PATCH V37 16/29] acpi: Disable ACPI table override if the kernel is locked down

uld disallow any unauthenticated changes to kernel space. ACPI tables contain code invoked by the kernel, so do not allow ACPI tables to be overridden if the kernel is locked down. Signed-off-by: Linn Crosetto Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook

[PATCH V37 27/29] tracefs: Restrict tracefs when the kernel is locked down

Tracefs may release more information about the kernel than desirable, so restrict it when the kernel is locked down in confidentiality mode by preventing open(). Signed-off-by: Matthew Garrett Reviewed-by: Steven Rostedt (VMware) --- fs/tracefs/inode.c | 40

[PATCH V37 25/29] kexec: Allow kexec_file() with appropriate IMA policy when locked down

-by: Matthew Garrett Acked-by: Mimi Zohar Cc: Dmitry Kasatkin Cc: linux-integr...@vger.kernel.org --- include/linux/ima.h | 9 ++ kernel/kexec_file.c | 12 +-- security/integrity/ima/ima.h| 2 ++ security/integrity/ima/ima_main.c | 2

[PATCH V37 26/29] debugfs: Restrict debugfs when the kernel is locked down

, as there are 19 creation functions and ~1600 call sites (some of them in loops scanning tables). Signed-off-by: David Howells cc: Andy Shevchenko cc: acpi4asus-u...@lists.sourceforge.net cc: platform-driver-...@vger.kernel.org cc: Matthew Garrett cc: Thomas Gleixner Cc: Greg KH Cc: Rafael J. Wysocki

[PATCH V37 29/29] lockdown: Print current->comm in restriction messages

off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook --- fs/proc/kcore.c | 5 +++-- security/lockdown/lockdown.c | 8 ++-- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c index ee2c576cc94e..e2ed8e08cc7a 100

[PATCH V37 24/29] Lock down perf when in confidentiality mode

From: David Howells Disallow the use of certain perf facilities that might allow userspace to access kernel data. Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Arnaldo Carvalho de Melo --- include/linux

[PATCH V37 11/29] PCI: Lock down BAR access when the kernel is locked down

From: Matthew Garrett Any hardware that can potentially generate DMA has to be locked down in order to avoid it being possible for an attacker to modify kernel code, allowing them to circumvent disabled module loading or module signing. Default to paranoid - in future we can potentially relax

[PATCH V37 18/29] Lock down TIOCSSERIAL

. Reported-by: Greg Kroah-Hartman Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook cc: Jiri Slaby Cc: linux-ser...@vger.kernel.org --- drivers/tty/serial/serial_core.c | 5 + include/linux/security.h | 1 + security/lockdown/lockdown.c | 1 + 3

[PATCH V37 20/29] x86/mmiotrace: Lock down the testmmiotrace module

From: David Howells The testmmiotrace module shouldn't be permitted when the kernel is locked down as it can be used to arbitrarily read and write MMIO space. This is a runtime check rather than buildtime in order to allow configurations where the same kernel may be run in both locked down or

[PATCH V37 22/29] Lock down tracing and perf kprobes when in confidentiality mode

modules. Reported-by: Alexei Starovoitov Signed-off-by: David Howells Signed-off-by: Matthew Garrett Acked-by: Masami Hiramatsu Reviewed-by: Kees Cook Cc: Naveen N. Rao Cc: Anil S Keshavamurthy Cc: da...@davemloft.net Cc: Masami Hiramatsu --- include/linux/security.h | 1 + kernel

[PATCH V37 23/29] bpf: Restrict bpf when kernel lockdown is in confidentiality mode

From: David Howells bpf_read() and bpf_read_str() could potentially be abused to (eg) allow private keys in kernel memory to be leaked. Disable them if the kernel has been locked down in confidentiality mode. Suggested-by: Alexei Starovoitov Signed-off-by: Matthew Garrett Reviewed-by: Kees

[PATCH V37 14/29] ACPI: Limit access to custom_method when the kernel is locked down

From: Matthew Garrett custom_method effectively allows arbitrary access to system memory, making it possible for an attacker to circumvent restrictions on module loading. Disable it if the kernel is locked down. Signed-off-by: Matthew Garrett Signed-off-by: David Howells Reviewed-by: Kees

[PATCH V37 08/29] kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE

. KEXEC_SIG_FORCE disallows images without a valid signature. Signed-off-by: Jiri Bohac Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Jiri Bohac Reviewed-by: Dave Young cc: ke...@lists.infradead.org --- arch/x86/Kconfig | 20 + crypto

[PATCH V37 09/29] kexec_file: Restrict at runtime if the kernel is locked down

lockdowns. Modified by Matthew Garrett to remove the IMA integration, which will be replaced by integrating with the IMA architecture policy patches.] Signed-off-by: Jiri Bohac Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Jiri Bohac Reviewed-by: Kees Cook cc: ke

[PATCH V37 00/29] security: Add support for locking down the kernel

A minor fix to the tracefs patch, some Acks and reviews added to the SOB chain, and rebased on next/master (there were a couple of minor fixes needed to align that).

[PATCH V37 03/29] security: Add a static lockdown policy LSM

securityfs), boot time (via a kernel parameter) or build time (via a kconfig option). Based on initial code by David Howells. Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook Cc: David Howells --- .../admin-guide/kernel-parameters.txt | 9 + include/linux/security.h

[PATCH V37 10/29] hibernate: Disable when the kernel is locked down

-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook Cc: r...@rjwysocki.net Cc: pa...@ucw.cz cc: linux...@vger.kernel.org --- include/linux/security.h | 1 + kernel/power/hibernate.c | 3 ++- security/lockdown/lockdown.c | 1 + 3 files changed, 4 insertions(+), 1 deletion

[PATCH V37 12/29] x86: Lock down IO port access when the kernel is locked down

From: Matthew Garrett IO port access would permit users to gain access to PCI configuration registers, which in turn (on a lot of hardware) give access to MMIO register space. This would potentially permit root to trigger arbitrary DMA, so lock it down by default. This also implicitly locks

[PATCH V37 07/29] Copy secure_boot flag in boot params across kexec reboot

the secure_boot flag in original kernel. secure_boot flag in boot_params is set in EFI stub, but kexec bypasses the stub. Fixing this issue by copying secure_boot flag across kexec reboot. Signed-off-by: Dave Young Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook

[PATCH V37 04/29] Enforce module signatures if the kernel is locked down

(EKEYREJECTED) or a system error occurs (eg. ENOMEM), we return the error we got. Note that the X.509 code doesn't check for key expiry as the RTC might not be valid or might not have been transferred to the kernel's clock yet. [Modified by Matthew Garrett to remove the IMA integration

[PATCH V37 02/29] security: Add a "locked down" LSM hook

Add a mechanism to allow LSMs to make a policy decision around whether kernel functionality that would allow tampering with or examining the runtime state of the kernel should be permitted. Signed-off-by: Matthew Garrett Acked-by: Kees Cook Acked-by: Casey Schaufler --- include/linux

[PATCH] tracefs: Restrict tracefs when the kernel is locked down

Tracefs may release more information about the kernel than desirable, so restrict it when the kernel is locked down in confidentiality mode by preventing open(). Signed-off-by: Matthew Garrett Cc: Steven Rostedt --- Added the iput() fs/tracefs/inode.c | 40

Re: [PATCH V36 19/29] Lock down module params that specify hardware parameters (eg. ioport)

On Thu, Jul 18, 2019 at 12:45 PM Matthew Garrett wrote: > > From: David Howells > > Provided an annotation for module parameters that specify hardware > parameters (such as io ports, iomem addresses, irqs, dma channels, fixed > dma buffers and other types). > > Suggeste

Re: [PATCH V36 23/29] bpf: Restrict bpf when kernel lockdown is in confidentiality mode

On Thu, Jul 18, 2019 at 12:45 PM Matthew Garrett wrote: > bpf_read() and bpf_read_str() could potentially be abused to (eg) allow > private keys in kernel memory to be leaked. Disable them if the kernel > has been locked down in confidentiality mode. > > Suggested-by: Alexei Starov

[PATCH V36 08/29] kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE

. KEXEC_SIG_FORCE disallows images without a valid signature. Signed-off-by: Jiri Bohac Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Jiri Bohac Reviewed-by: Dave Young cc: ke...@lists.infradead.org --- arch/x86/Kconfig | 20 + crypto

[PATCH V36 17/29] Prohibit PCMCIA CIS storage when the kernel is locked down

From: David Howells Prohibit replacement of the PCMCIA Card Information Structure when the kernel is locked down. Suggested-by: Dominik Brodowski Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook --- drivers/pcmcia/cistpl.c | 5 + include/linux

[PATCH V36 16/29] acpi: Disable ACPI table override if the kernel is locked down

uld disallow any unauthenticated changes to kernel space. ACPI tables contain code invoked by the kernel, so do not allow ACPI tables to be overridden if the kernel is locked down. Signed-off-by: Linn Crosetto Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook

[PATCH V36 19/29] Lock down module params that specify hardware parameters (eg. ioport)

From: David Howells Provided an annotation for module parameters that specify hardware parameters (such as io ports, iomem addresses, irqs, dma channels, fixed dma buffers and other types). Suggested-by: Alan Cox Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees

[PATCH V36 10/29] hibernate: Disable when the kernel is locked down

-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook Cc: r...@rjwysocki.net Cc: pa...@ucw.cz cc: linux...@vger.kernel.org --- include/linux/security.h | 1 + kernel/power/hibernate.c | 3 ++- security/lockdown/lockdown.c | 1 + 3 files changed, 4 insertions(+), 1 deletion

[PATCH V36 15/29] acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down

in the kernel proper if lockdown is not enabled. If lockdown is enabled and an RSDP is provided on the command line, this will only be used when parsing SRAT (which shouldn't permit kernel code execution) and will be ignored in the rest of the kernel. (Modified by Matthew Garrett in order to handle

[PATCH V36 27/29] tracefs: Restrict tracefs when the kernel is locked down

Tracefs may release more information about the kernel than desirable, so restrict it when the kernel is locked down in confidentiality mode by preventing open(). Signed-off-by: Matthew Garrett Cc: Steven Rostedt --- fs/tracefs/inode.c | 38

[PATCH V36 28/29] efi: Restrict efivar_ssdt_load when the kernel is locked down

efivar_ssdt_load allows the kernel to import arbitrary ACPI code from an EFI variable, which gives arbitrary code execution in ring 0. Prevent that when the kernel is locked down. Signed-off-by: Matthew Garrett Acked-by: Ard Biesheuvel Reviewed-by: Kees Cook Cc: Ard Biesheuvel Cc: linux

[PATCH V36 29/29] lockdown: Print current->comm in restriction messages

off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook --- fs/proc/kcore.c | 5 +++-- security/lockdown/lockdown.c | 8 ++-- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c index ee2c576cc94e..e2ed8e08cc7a 100

[PATCH V36 26/29] debugfs: Restrict debugfs when the kernel is locked down

, as there are 19 creation functions and ~1600 call sites (some of them in loops scanning tables). Signed-off-by: David Howells cc: Andy Shevchenko cc: acpi4asus-u...@lists.sourceforge.net cc: platform-driver-...@vger.kernel.org cc: Matthew Garrett cc: Thomas Gleixner Cc: Greg KH Cc: Rafael J. Wysocki

[PATCH V36 25/29] kexec: Allow kexec_file() with appropriate IMA policy when locked down

-by: Matthew Garrett Acked-by: Mimi Zohar Cc: Dmitry Kasatkin Cc: linux-integr...@vger.kernel.org --- include/linux/ima.h | 9 ++ kernel/kexec_file.c | 12 +-- security/integrity/ima/ima.h| 2 ++ security/integrity/ima/ima_main.c | 2

[PATCH V36 05/29] Restrict /dev/{mem,kmem,port} when the kernel is locked down

From: Matthew Garrett Allowing users to read and write to core kernel memory makes it possible for the kernel to be subverted, avoiding module loading restrictions, and also to steal cryptographic information. Disallow /dev/mem and /dev/kmem from being opened this when the kernel has been

[PATCH V36 06/29] kexec_load: Disable at runtime if the kernel is locked down

From: Matthew Garrett The kexec_load() syscall permits the loading and execution of arbitrary code in ring 0, which is something that lock-down is meant to prevent. It makes sense to disable kexec_load() in this situation. This does not affect kexec_file_load() syscall which can check

[PATCH V36 18/29] Lock down TIOCSSERIAL

. Reported-by: Greg Kroah-Hartman Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook cc: Jiri Slaby Cc: linux-ser...@vger.kernel.org --- drivers/tty/serial/serial_core.c | 5 + include/linux/security.h | 1 + security/lockdown/lockdown.c | 1 + 3

[PATCH V36 11/29] PCI: Lock down BAR access when the kernel is locked down

From: Matthew Garrett Any hardware that can potentially generate DMA has to be locked down in order to avoid it being possible for an attacker to modify kernel code, allowing them to circumvent disabled module loading or module signing. Default to paranoid - in future we can potentially relax

[PATCH V36 24/29] Lock down perf when in confidentiality mode

From: David Howells Disallow the use of certain perf facilities that might allow userspace to access kernel data. Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Arnaldo Carvalho de Melo --- include/linux

[PATCH V36 20/29] x86/mmiotrace: Lock down the testmmiotrace module

From: David Howells The testmmiotrace module shouldn't be permitted when the kernel is locked down as it can be used to arbitrarily read and write MMIO space. This is a runtime check rather than buildtime in order to allow configurations where the same kernel may be run in both locked down or

[PATCH V36 14/29] ACPI: Limit access to custom_method when the kernel is locked down

From: Matthew Garrett custom_method effectively allows arbitrary access to system memory, making it possible for an attacker to circumvent restrictions on module loading. Disable it if the kernel is locked down. Signed-off-by: Matthew Garrett Signed-off-by: David Howells Reviewed-by: Kees

[PATCH V36 23/29] bpf: Restrict bpf when kernel lockdown is in confidentiality mode

From: David Howells bpf_read() and bpf_read_str() could potentially be abused to (eg) allow private keys in kernel memory to be leaked. Disable them if the kernel has been locked down in confidentiality mode. Suggested-by: Alexei Starovoitov Signed-off-by: Matthew Garrett cc: net

[PATCH V36 22/29] Lock down tracing and perf kprobes when in confidentiality mode

modules. Reported-by: Alexei Starovoitov Signed-off-by: David Howells Signed-off-by: Matthew Garrett Acked-by: Masami Hiramatsu Reviewed-by: Kees Cook Cc: Naveen N. Rao Cc: Anil S Keshavamurthy Cc: da...@davemloft.net Cc: Masami Hiramatsu --- include/linux/security.h | 1 + kernel

[PATCH V36 21/29] Lock down /proc/kcore

From: David Howells Disallow access to /proc/kcore when the kernel is locked down to prevent access to cryptographic data. This is limited to lockdown confidentiality mode and is still permitted in integrity mode. Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees

[PATCH V36 13/29] x86/msr: Restrict MSR access when the kernel is locked down

From: Matthew Garrett Writing to MSRs should not be allowed if the kernel is locked down, since it could lead to execution of arbitrary code in kernel mode. Based on a patch by Kees Cook. Signed-off-by: Matthew Garrett Signed-off-by: David Howells Acked-by: Kees Cook Reviewed-by: Thomas

[PATCH V36 12/29] x86: Lock down IO port access when the kernel is locked down

From: Matthew Garrett IO port access would permit users to gain access to PCI configuration registers, which in turn (on a lot of hardware) give access to MMIO register space. This would potentially permit root to trigger arbitrary DMA, so lock it down by default. This also implicitly locks

[PATCH V36 09/29] kexec_file: Restrict at runtime if the kernel is locked down

lockdowns. Modified by Matthew Garrett to remove the IMA integration, which will be replaced by integrating with the IMA architecture policy patches.] Signed-off-by: Jiri Bohac Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Jiri Bohac Reviewed-by: Kees Cook cc: ke

[PATCH V36 07/29] Copy secure_boot flag in boot params across kexec reboot

the secure_boot flag in original kernel. secure_boot flag in boot_params is set in EFI stub, but kexec bypasses the stub. Fixing this issue by copying secure_boot flag across kexec reboot. Signed-off-by: Dave Young Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook

[PATCH V36 00/29] security: Add kernel lockdown functionality

Minor changes to the previous set, other than a significant rework of the "Ignore acpi_rsdp kernel param" patch to deal with the early parsing of that parameter under certain circumstances.

[PATCH V36 03/29] security: Add a static lockdown policy LSM

securityfs), boot time (via a kernel parameter) or build time (via a kconfig option). Based on initial code by David Howells. Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook Cc: David Howells --- .../admin-guide/kernel-parameters.txt | 9 + include/linux/security.h

[PATCH V36 04/29] Enforce module signatures if the kernel is locked down

(EKEYREJECTED) or a system error occurs (eg. ENOMEM), we return the error we got. Note that the X.509 code doesn't check for key expiry as the RTC might not be valid or might not have been transferred to the kernel's clock yet. [Modified by Matthew Garrett to remove the IMA integration

[PATCH V36 02/29] security: Add a "locked down" LSM hook

Add a mechanism to allow LSMs to make a policy decision around whether kernel functionality that would allow tampering with or examining the runtime state of the kernel should be permitted. Signed-off-by: Matthew Garrett Acked-by: Kees Cook --- include/linux/lsm_hooks.h | 2 ++ include/linux

[PATCH V36 01/29] security: Support early LSMs

are initialised in link order and cannot be overridden via boot parameters, and cannot make use of kmalloc() (since the allocator isn't initialised yet). Signed-off-by: Matthew Garrett Acked-by: Kees Cook --- include/asm-generic/vmlinux.lds.h | 8 - include/linux/lsm_hooks.h | 6

Re: [PATCH V35 27/29] tracefs: Restrict tracefs when the kernel is locked down

On Tue, Jul 16, 2019 at 4:14 PM Steven Rostedt wrote: > Small nit, but please add this as the first declaration, to keep the > "upside-down x-mas tree" look. I know some of the other functions in > this file don't follow that (which should be cleaned up some day), but > I'd like to avoid adding

Re: [PATCH V35 15/29] acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down

On Mon, Jul 15, 2019 at 7:59 PM Dave Young wrote: > I'm very sorry I noticed this late, but have to say this will not work for > X86 with latest kernel code. No problem, thank you for catching this! I'll update the patch and send a new version.

Re: [PATCH V35 23/29] bpf: Restrict bpf when kernel lockdown is in confidentiality mode

On Mon, Jul 15, 2019 at 3:54 PM Daniel Borkmann wrote: > Hmm, does security_locked_down() ever return a code > 0 or why do you > have the double check on return code? If not, then for clarity the > ret code from security_locked_down() should be checked as 'ret < 0' > as well and out label should

[PATCH V35 10/29] hibernate: Disable when the kernel is locked down

-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook Cc: r...@rjwysocki.net Cc: pa...@ucw.cz cc: linux...@vger.kernel.org --- include/linux/security.h | 1 + kernel/power/hibernate.c | 3 ++- security/lockdown/lockdown.c | 1 + 3 files changed, 4 insertions(+), 1 deletion

[PATCH V35 16/29] acpi: Disable ACPI table override if the kernel is locked down

uld disallow any unauthenticated changes to kernel space. ACPI tables contain code invoked by the kernel, so do not allow ACPI tables to be overridden if the kernel is locked down. Signed-off-by: Linn Crosetto Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook

[PATCH V35 14/29] ACPI: Limit access to custom_method when the kernel is locked down

From: Matthew Garrett custom_method effectively allows arbitrary access to system memory, making it possible for an attacker to circumvent restrictions on module loading. Disable it if the kernel is locked down. Signed-off-by: Matthew Garrett Signed-off-by: David Howells Reviewed-by: Kees

[PATCH V35 18/29] Lock down TIOCSSERIAL

. Reported-by: Greg Kroah-Hartman Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees Cook cc: Jiri Slaby Cc: linux-ser...@vger.kernel.org --- drivers/tty/serial/serial_core.c | 5 + include/linux/security.h | 1 + security/lockdown/lockdown.c | 1 + 3

[PATCH V35 21/29] Lock down /proc/kcore

From: David Howells Disallow access to /proc/kcore when the kernel is locked down to prevent access to cryptographic data. This is limited to lockdown confidentiality mode and is still permitted in integrity mode. Signed-off-by: David Howells Signed-off-by: Matthew Garrett Reviewed-by: Kees

[PATCH V35 15/29] acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down

From: Josh Boyer This option allows userspace to pass the RSDP address to the kernel, which makes it possible for a user to modify the workings of hardware . Reject the option when the kernel is locked down. Signed-off-by: Josh Boyer Signed-off-by: David Howells Signed-off-by: Matthew

[PATCH V35 23/29] bpf: Restrict bpf when kernel lockdown is in confidentiality mode

From: David Howells bpf_read() and bpf_read_str() could potentially be abused to (eg) allow private keys in kernel memory to be leaked. Disable them if the kernel has been locked down in confidentiality mode. Suggested-by: Alexei Starovoitov Signed-off-by: Matthew Garrett cc: net

[PATCH V35 20/29] x86/mmiotrace: Lock down the testmmiotrace module

From: David Howells The testmmiotrace module shouldn't be permitted when the kernel is locked down as it can be used to arbitrarily read and write MMIO space. This is a runtime check rather than buildtime in order to allow configurations where the same kernel may be run in both locked down or

[PATCH V35 25/29] kexec: Allow kexec_file() with appropriate IMA policy when locked down

-by: Matthew Garrett Acked-by: Mimi Zohar Cc: Dmitry Kasatkin Cc: linux-integr...@vger.kernel.org --- include/linux/ima.h | 9 ++ kernel/kexec_file.c | 12 +-- security/integrity/ima/ima.h| 2 ++ security/integrity/ima/ima_main.c | 2

[PATCH V35 27/29] tracefs: Restrict tracefs when the kernel is locked down

Tracefs may release more information about the kernel than desirable, so restrict it when the kernel is locked down in confidentiality mode by preventing open(). Signed-off-by: Matthew Garrett Cc: Steven Rostedt --- fs/tracefs/inode.c | 38

[PATCH V35 26/29] debugfs: Restrict debugfs when the kernel is locked down

, as there are 19 creation functions and ~1600 call sites (some of them in loops scanning tables). Signed-off-by: David Howells cc: Andy Shevchenko cc: acpi4asus-u...@lists.sourceforge.net cc: platform-driver-...@vger.kernel.org cc: Matthew Garrett cc: Thomas Gleixner Signed-off-by: Matthew Garrett

<    1   2   3   4   5   6   7   8   9   10   >