![Kees Cook](/assets/img/avatar_default.png)
LoadPin's "enabled" setting is really about enforcement, not whether or not the LSM is using LSM hooks. Instead, split this out so that LSM enabling can be logically distinct from whether enforcement is happening (for example, the pinning happens when the LSM is enabled, but the pin is only checked when "enforce" is set). This allows LoadPin to continue to operate sanely in test environments once LSM enable/disable is centrally handled (i.e. we want LoadPin to be enabled separately from its enforcement). Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johansen@canonical.com>
200 lines
5.3 KiB
C
200 lines
5.3 KiB
C
/*
|
|
* Module and Firmware Pinning Security Module
|
|
*
|
|
* Copyright 2011-2016 Google Inc.
|
|
*
|
|
* Author: Kees Cook <keescook@chromium.org>
|
|
*
|
|
* This software is licensed under the terms of the GNU General Public
|
|
* License version 2, as published by the Free Software Foundation, and
|
|
* may be copied, distributed, and modified under those terms.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*/
|
|
|
|
#define pr_fmt(fmt) "LoadPin: " fmt
|
|
|
|
#include <linux/module.h>
|
|
#include <linux/fs.h>
|
|
#include <linux/lsm_hooks.h>
|
|
#include <linux/mount.h>
|
|
#include <linux/path.h>
|
|
#include <linux/sched.h> /* current */
|
|
#include <linux/string_helpers.h>
|
|
|
|
static void report_load(const char *origin, struct file *file, char *operation)
|
|
{
|
|
char *cmdline, *pathname;
|
|
|
|
pathname = kstrdup_quotable_file(file, GFP_KERNEL);
|
|
cmdline = kstrdup_quotable_cmdline(current, GFP_KERNEL);
|
|
|
|
pr_notice("%s %s obj=%s%s%s pid=%d cmdline=%s%s%s\n",
|
|
origin, operation,
|
|
(pathname && pathname[0] != '<') ? "\"" : "",
|
|
pathname,
|
|
(pathname && pathname[0] != '<') ? "\"" : "",
|
|
task_pid_nr(current),
|
|
cmdline ? "\"" : "", cmdline, cmdline ? "\"" : "");
|
|
|
|
kfree(cmdline);
|
|
kfree(pathname);
|
|
}
|
|
|
|
static int enforce = IS_ENABLED(CONFIG_SECURITY_LOADPIN_ENFORCE);
|
|
static struct super_block *pinned_root;
|
|
static DEFINE_SPINLOCK(pinned_root_spinlock);
|
|
|
|
#ifdef CONFIG_SYSCTL
|
|
static int zero;
|
|
static int one = 1;
|
|
|
|
static struct ctl_path loadpin_sysctl_path[] = {
|
|
{ .procname = "kernel", },
|
|
{ .procname = "loadpin", },
|
|
{ }
|
|
};
|
|
|
|
static struct ctl_table loadpin_sysctl_table[] = {
|
|
{
|
|
.procname = "enforce",
|
|
.data = &enforce,
|
|
.maxlen = sizeof(int),
|
|
.mode = 0644,
|
|
.proc_handler = proc_dointvec_minmax,
|
|
.extra1 = &zero,
|
|
.extra2 = &one,
|
|
},
|
|
{ }
|
|
};
|
|
|
|
/*
|
|
* This must be called after early kernel init, since then the rootdev
|
|
* is available.
|
|
*/
|
|
static void check_pinning_enforcement(struct super_block *mnt_sb)
|
|
{
|
|
bool ro = false;
|
|
|
|
/*
|
|
* If load pinning is not enforced via a read-only block
|
|
* device, allow sysctl to change modes for testing.
|
|
*/
|
|
if (mnt_sb->s_bdev) {
|
|
char bdev[BDEVNAME_SIZE];
|
|
|
|
ro = bdev_read_only(mnt_sb->s_bdev);
|
|
bdevname(mnt_sb->s_bdev, bdev);
|
|
pr_info("%s (%u:%u): %s\n", bdev,
|
|
MAJOR(mnt_sb->s_bdev->bd_dev),
|
|
MINOR(mnt_sb->s_bdev->bd_dev),
|
|
ro ? "read-only" : "writable");
|
|
} else
|
|
pr_info("mnt_sb lacks block device, treating as: writable\n");
|
|
|
|
if (!ro) {
|
|
if (!register_sysctl_paths(loadpin_sysctl_path,
|
|
loadpin_sysctl_table))
|
|
pr_notice("sysctl registration failed!\n");
|
|
else
|
|
pr_info("enforcement can be disabled.\n");
|
|
} else
|
|
pr_info("load pinning engaged.\n");
|
|
}
|
|
#else
|
|
static void check_pinning_enforcement(struct super_block *mnt_sb)
|
|
{
|
|
pr_info("load pinning engaged.\n");
|
|
}
|
|
#endif
|
|
|
|
static void loadpin_sb_free_security(struct super_block *mnt_sb)
|
|
{
|
|
/*
|
|
* When unmounting the filesystem we were using for load
|
|
* pinning, we acknowledge the superblock release, but make sure
|
|
* no other modules or firmware can be loaded.
|
|
*/
|
|
if (!IS_ERR_OR_NULL(pinned_root) && mnt_sb == pinned_root) {
|
|
pinned_root = ERR_PTR(-EIO);
|
|
pr_info("umount pinned fs: refusing further loads\n");
|
|
}
|
|
}
|
|
|
|
static int loadpin_read_file(struct file *file, enum kernel_read_file_id id)
|
|
{
|
|
struct super_block *load_root;
|
|
const char *origin = kernel_read_file_id_str(id);
|
|
|
|
/* This handles the older init_module API that has a NULL file. */
|
|
if (!file) {
|
|
if (!enforce) {
|
|
report_load(origin, NULL, "old-api-pinning-ignored");
|
|
return 0;
|
|
}
|
|
|
|
report_load(origin, NULL, "old-api-denied");
|
|
return -EPERM;
|
|
}
|
|
|
|
load_root = file->f_path.mnt->mnt_sb;
|
|
|
|
/* First loaded module/firmware defines the root for all others. */
|
|
spin_lock(&pinned_root_spinlock);
|
|
/*
|
|
* pinned_root is only NULL at startup. Otherwise, it is either
|
|
* a valid reference, or an ERR_PTR.
|
|
*/
|
|
if (!pinned_root) {
|
|
pinned_root = load_root;
|
|
/*
|
|
* Unlock now since it's only pinned_root we care about.
|
|
* In the worst case, we will (correctly) report pinning
|
|
* failures before we have announced that pinning is
|
|
* enforcing. This would be purely cosmetic.
|
|
*/
|
|
spin_unlock(&pinned_root_spinlock);
|
|
check_pinning_enforcement(pinned_root);
|
|
report_load(origin, file, "pinned");
|
|
} else {
|
|
spin_unlock(&pinned_root_spinlock);
|
|
}
|
|
|
|
if (IS_ERR_OR_NULL(pinned_root) || load_root != pinned_root) {
|
|
if (unlikely(!enforce)) {
|
|
report_load(origin, file, "pinning-ignored");
|
|
return 0;
|
|
}
|
|
|
|
report_load(origin, file, "denied");
|
|
return -EPERM;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int loadpin_load_data(enum kernel_load_data_id id)
|
|
{
|
|
return loadpin_read_file(NULL, (enum kernel_read_file_id) id);
|
|
}
|
|
|
|
static struct security_hook_list loadpin_hooks[] __lsm_ro_after_init = {
|
|
LSM_HOOK_INIT(sb_free_security, loadpin_sb_free_security),
|
|
LSM_HOOK_INIT(kernel_read_file, loadpin_read_file),
|
|
LSM_HOOK_INIT(kernel_load_data, loadpin_load_data),
|
|
};
|
|
|
|
void __init loadpin_add_hooks(void)
|
|
{
|
|
pr_info("ready to pin (currently %senforcing)\n",
|
|
enforce ? "" : "not ");
|
|
security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks), "loadpin");
|
|
}
|
|
|
|
/* Should not be mutable after boot, so not listed in sysfs (perm == 0). */
|
|
module_param(enforce, int, 0);
|
|
MODULE_PARM_DESC(enforce, "Enforce module/firmware pinning");
|