^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /* Lock down the kernel
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) * Copyright (C) 2016 Red Hat, Inc. All Rights Reserved.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * Written by David Howells (dhowells@redhat.com)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) * This program is free software; you can redistribute it and/or
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) * modify it under the terms of the GNU General Public Licence
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) * as published by the Free Software Foundation; either version
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) * 2 of the Licence, or (at your option) any later version.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) #include <linux/security.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) #include <linux/export.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) #include <linux/lsm_hooks.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) static enum lockdown_reason kernel_locked_down;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) static const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) [LOCKDOWN_NONE] = "none",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) [LOCKDOWN_MODULE_SIGNATURE] = "unsigned module loading",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) [LOCKDOWN_DEV_MEM] = "/dev/mem,kmem,port",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) [LOCKDOWN_EFI_TEST] = "/dev/efi_test access",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) [LOCKDOWN_KEXEC] = "kexec of unsigned images",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) [LOCKDOWN_HIBERNATION] = "hibernation",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) [LOCKDOWN_PCI_ACCESS] = "direct PCI access",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) [LOCKDOWN_IOPORT] = "raw io port access",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) [LOCKDOWN_MSR] = "raw MSR access",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) [LOCKDOWN_ACPI_TABLES] = "modifying ACPI tables",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) [LOCKDOWN_PCMCIA_CIS] = "direct PCMCIA CIS storage",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) [LOCKDOWN_TIOCSSERIAL] = "reconfiguration of serial port IO",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) [LOCKDOWN_MODULE_PARAMETERS] = "unsafe module parameters",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) [LOCKDOWN_MMIOTRACE] = "unsafe mmio",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) [LOCKDOWN_DEBUGFS] = "debugfs access",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) [LOCKDOWN_XMON_WR] = "xmon write access",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) [LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) [LOCKDOWN_INTEGRITY_MAX] = "integrity",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) [LOCKDOWN_KCORE] = "/proc/kcore access",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) [LOCKDOWN_KPROBES] = "use of kprobes",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) [LOCKDOWN_BPF_READ] = "use of bpf to read kernel RAM",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) [LOCKDOWN_PERF] = "unsafe use of perf",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) [LOCKDOWN_TRACEFS] = "use of tracefs",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) [LOCKDOWN_XMON_RW] = "xmon read and write access",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) [LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) static const enum lockdown_reason lockdown_levels[] = {LOCKDOWN_NONE,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) LOCKDOWN_INTEGRITY_MAX,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) LOCKDOWN_CONFIDENTIALITY_MAX};
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) * Put the kernel into lock-down mode.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) static int lock_kernel_down(const char *where, enum lockdown_reason level)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) if (kernel_locked_down >= level)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) return -EPERM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) kernel_locked_down = level;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) pr_notice("Kernel is locked down from %s; see man kernel_lockdown.7\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) where);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) static int __init lockdown_param(char *level)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) if (!level)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) if (strcmp(level, "integrity") == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) lock_kernel_down("command line", LOCKDOWN_INTEGRITY_MAX);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) else if (strcmp(level, "confidentiality") == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) lock_kernel_down("command line", LOCKDOWN_CONFIDENTIALITY_MAX);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) early_param("lockdown", lockdown_param);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) * lockdown_is_locked_down - Find out if the kernel is locked down
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) * @what: Tag to use in notice generated if lockdown is in effect
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) static int lockdown_is_locked_down(enum lockdown_reason what)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) if (WARN(what >= LOCKDOWN_CONFIDENTIALITY_MAX,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) "Invalid lockdown reason"))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) return -EPERM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) if (kernel_locked_down >= what) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) if (lockdown_reasons[what])
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) pr_notice("Lockdown: %s: %s is restricted; see man kernel_lockdown.7\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) current->comm, lockdown_reasons[what]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) return -EPERM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) static struct security_hook_list lockdown_hooks[] __lsm_ro_after_init = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) LSM_HOOK_INIT(locked_down, lockdown_is_locked_down),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) static int __init lockdown_lsm_init(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) #if defined(CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) lock_kernel_down("Kernel configuration", LOCKDOWN_INTEGRITY_MAX);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) #elif defined(CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) lock_kernel_down("Kernel configuration", LOCKDOWN_CONFIDENTIALITY_MAX);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) security_add_hooks(lockdown_hooks, ARRAY_SIZE(lockdown_hooks),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) "lockdown");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) static ssize_t lockdown_read(struct file *filp, char __user *buf, size_t count,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) char temp[80];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) int i, offset = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) for (i = 0; i < ARRAY_SIZE(lockdown_levels); i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) enum lockdown_reason level = lockdown_levels[i];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) if (lockdown_reasons[level]) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) const char *label = lockdown_reasons[level];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) if (kernel_locked_down == level)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) offset += sprintf(temp+offset, "[%s] ", label);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) offset += sprintf(temp+offset, "%s ", label);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) /* Convert the last space to a newline if needed. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) if (offset > 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) temp[offset-1] = '\n';
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) return simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) static ssize_t lockdown_write(struct file *file, const char __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) size_t n, loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) char *state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) int i, len, err = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) state = memdup_user_nul(buf, n);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) if (IS_ERR(state))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) return PTR_ERR(state);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) len = strlen(state);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) if (len && state[len-1] == '\n') {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) state[len-1] = '\0';
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) len--;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) for (i = 0; i < ARRAY_SIZE(lockdown_levels); i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) enum lockdown_reason level = lockdown_levels[i];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) const char *label = lockdown_reasons[level];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) if (label && !strcmp(state, label))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) err = lock_kernel_down("securityfs", level);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) kfree(state);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) return err ? err : n;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) static const struct file_operations lockdown_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) .read = lockdown_read,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) .write = lockdown_write,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) static int __init lockdown_secfs_init(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) struct dentry *dentry;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) dentry = securityfs_create_file("lockdown", 0644, NULL, NULL,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) &lockdown_ops);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) return PTR_ERR_OR_ZERO(dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) core_initcall(lockdown_secfs_init);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) #ifdef CONFIG_SECURITY_LOCKDOWN_LSM_EARLY
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) DEFINE_EARLY_LSM(lockdown) = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) #else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) DEFINE_LSM(lockdown) = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193) .name = "lockdown",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) .init = lockdown_lsm_init,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) };
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags