Lock down kprobes

RFC PATCH In review David Howells 3 participants 5 messages Nov 9, 2017 – Nov 10, 2017

Subsystems (2)

Security (LSM) kprobes

lore

Share & tools

lore

David Howells

author

2017-11-09 16:52 UTC #0 lore raw

RFC PATCH 1/1 Lock down kprobes

Hi,

I need to lock down kprobes under secure boot conditions as part of the patch series that can be found here:

https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/log/?h=efi-lock-down

Can you tell me that if the attached patch is sufficient to the cause?

Thanks,
David
---
commit ffb3484d6e0f1d625f8e84a6a19c139a28a52499

Author: David Howells <[email protected]>
Date:   Wed Nov 8 16:14:12 2017 +0000

Lock down kprobes

Disallow the creation of kprobes when the kernel is locked down by preventing their registration. This prevents kprobes from being used to access kernel memory, either to make modifications or to steal crypto data.

Reported-by Alexei Starovoitov <[email protected]>

Signed-off-by David Howells <[email protected]>

kernel/kprobes.c +3 -0

index a1606a4224e1..f06023b0936c 100644
@@ -1530,6 +1530,9 @@ int register_kprobe(struct kprobe *p)
 	struct module *probed_mod;
 	kprobe_opcode_t *addr;
 
+	if (kernel_is_locked_down("Use of kprobes"))
+		return -EPERM;
+
 	/* Adjust probe address from symbol */
 	addr = kprobe_addr(p);
 	if (IS_ERR(addr))

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

Ananth N Mavinakayanahalli

2017-11-09 17:30 UTC #1 lore raw

Quoted 8 lines · David Howells

Hi,
I need to lock down kprobes under secure boot conditions as part of the patch series that can be found here:
https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/log/?h=efi-lock-down
Can you tell me that if the attached patch is sufficient to the cause?

Yes, this patch will prevent any kprobe registration.

Ananth

Quoted 22 lines

Thanks,
David
---
commit ffb3484d6e0f1d625f8e84a6a19c139a28a52499
Author: David Howells <[email protected]>
Date:   Wed Nov 8 16:14:12 2017 +0000
Lock down kprobes
Disallow the creation of kprobes when the kernel is locked down by preventing their registration. This prevents kprobes from being used to access kernel memory, either to make modifications or to steal crypto data.
Reported-by Alexei Starovoitov <[email protected]>
Signed-off-by David Howells <[email protected]>
kernel/kprobes.c +0 -0
index a1606a4224e1..f06023b0936c 100644

kernel/kprobes.c int register_kprobe(struct kprobe *p) · line 1538

Quoted 9 lines

kernel/kprobes.c +3 -0

@@ -1530,6 +1530,9 @@ int register_kprobe(struct kprobe *p)
 	struct module *probed_mod;
 	kprobe_opcode_t *addr;
 
+	if (kernel_is_locked_down("Use of kprobes"))
+		return -EPERM;
+
 	/* Adjust probe address from symbol */
 	addr = kprobe_addr(p);
 	if (IS_ERR(addr))

David Howells

author

2017-11-09 21:54 UTC #2 lore raw

Quoted 1 line · Ananth N Mavinakayanahalli

Yes, this patch will prevent any kprobe registration.

Can I put that down as a Reviewed-by?

David
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

Ananth N Mavinakayanahalli

Reviewed-by

2017-11-10 00:38 UTC #3 lore raw

Quoted 5 lines · David Howells

Quoted 1 line · Ananth N Mavinakayanahalli
Yes, this patch will prevent any kprobe registration.
Can I put that down as a Reviewed-by?

Reviewed-by Ananth N Mavinakayanahalli <[email protected]>

Masami Hiramatsu

maintainer

2017-11-10 01:01 UTC #4 lore raw

In reply to David Howells

Hi David,

Quoted 6 lines · On Thu, 09 Nov 2017 16:52:05 +0000 David Howells <[email protected]> wrote:

Lock down kprobes
Disallow the creation of kprobes when the kernel is locked down by preventing their registration. This prevents kprobes from being used to access kernel memory, either to make modifications or to steal crypto data.

Is that locked-down flag changed while running the kernel, or only specified by boot parameter?
If that can happen while running, we have to take care of enabling/disabling unregistering etc. too.

Thank you,

Quoted 18 lines

Reported-by Alexei Starovoitov <[email protected]>

Signed-off-by David Howells <[email protected]>

kernel/kprobes.c +3 -0

index a1606a4224e1..f06023b0936c 100644
@@ -1530,6 +1530,9 @@ int register_kprobe(struct kprobe *p)
 	struct module *probed_mod;
 	kprobe_opcode_t *addr;
 
+	if (kernel_is_locked_down("Use of kprobes"))
+		return -EPERM;
+
 	/* Adjust probe address from symbol */
 	addr = kprobe_addr(p);
 	if (IS_ERR(addr))

Signature · 5 lines

Masami Hiramatsu <[email protected]>
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html