diff options
Diffstat (limited to 'efi-lockdown.patch')
| -rw-r--r-- | efi-lockdown.patch | 1643 |
1 files changed, 973 insertions, 670 deletions
diff --git a/efi-lockdown.patch b/efi-lockdown.patch index e04878458..4ac65fd5d 100644 --- a/efi-lockdown.patch +++ b/efi-lockdown.patch @@ -1,53 +1,7 @@ -From df7d76ae50f18d4465e59fdf7f19d3df44906cb5 Mon Sep 17 00:00:00 2001 -From: Josh Boyer <jwboyer@fedoraproject.org> -Date: Mon, 21 Nov 2016 23:55:55 +0000 -Subject: [PATCH 07/32] efi: Add EFI_SECURE_BOOT bit - -UEFI machines can be booted in Secure Boot mode. Add a EFI_SECURE_BOOT bit -that can be passed to efi_enabled() to find out whether secure boot is -enabled. - -This will be used by the SysRq+x handler, registered by the x86 arch, to find -out whether secure boot mode is enabled so that it can be disabled. - -Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> -Signed-off-by: David Howells <dhowells@redhat.com> ---- - arch/x86/kernel/setup.c | 1 + - include/linux/efi.h | 1 + - 2 files changed, 2 insertions(+) - -diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index 69780ed..447905e 100644 ---- a/arch/x86/kernel/setup.c -+++ b/arch/x86/kernel/setup.c -@@ -1182,6 +1182,7 @@ void __init setup_arch(char **cmdline_p) - pr_info("Secure boot disabled\n"); - break; - case efi_secureboot_mode_enabled: -+ set_bit(EFI_SECURE_BOOT, &efi.flags); - pr_info("Secure boot enabled\n"); - break; - default: -diff --git a/include/linux/efi.h b/include/linux/efi.h -index 94d34e0..6049600 100644 ---- a/include/linux/efi.h -+++ b/include/linux/efi.h -@@ -1069,6 +1069,7 @@ extern int __init efi_setup_pcdp_console(char *); - #define EFI_DBG 8 /* Print additional debug info at runtime */ - #define EFI_NX_PE_DATA 9 /* Can runtime data regions be mapped non-executable? */ - #define EFI_MEM_ATTR 10 /* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */ -+#define EFI_SECURE_BOOT 11 /* Are we in Secure Boot mode? */ - - #ifdef CONFIG_EFI - /* --- -2.7.4 - -From f05a90c19a9613d8d50597319ed91f691e25b689 Mon Sep 17 00:00:00 2001 +From 646ac5c07196bc3680e34188e55c8cc3565f65e7 Mon Sep 17 00:00:00 2001 From: David Howells <dhowells@redhat.com> -Date: Mon, 21 Nov 2016 23:36:17 +0000 -Subject: [PATCH 09/32] Add the ability to lock down access to the running +Date: Wed, 24 May 2017 14:56:00 +0100 +Subject: [PATCH 01/26] Add the ability to lock down access to the running kernel image Provide a single call to allow kernel code to determine whether the system @@ -57,64 +11,70 @@ modules that aren't validly signed with a key we recognise, fiddling with MSR registers and disallowing hibernation, Signed-off-by: David Howells <dhowells@redhat.com> +Acked-by: James Morris <james.l.morris@oracle.com> --- - include/linux/kernel.h | 9 +++++++++ - include/linux/security.h | 11 +++++++++++ - security/Kconfig | 15 +++++++++++++++ + include/linux/kernel.h | 17 ++++++++++++++ + include/linux/security.h | 8 +++++++ + security/Kconfig | 8 +++++++ security/Makefile | 3 +++ - security/lock_down.c | 40 ++++++++++++++++++++++++++++++++++++++++ - 5 files changed, 78 insertions(+) + security/lock_down.c | 60 ++++++++++++++++++++++++++++++++++++++++++++++++ + 5 files changed, 96 insertions(+) create mode 100644 security/lock_down.c diff --git a/include/linux/kernel.h b/include/linux/kernel.h -index cb09238..3cd3be9 100644 +index 0ad4c3044cf9..362da2e4bf53 100644 --- a/include/linux/kernel.h +++ b/include/linux/kernel.h -@@ -273,6 +273,15 @@ extern int oops_may_print(void); - void do_exit(long error_code) __noreturn; - void complete_and_exit(struct completion *, long) __noreturn; - +@@ -287,6 +287,23 @@ static inline void refcount_error_report(struct pt_regs *regs, const char *err) + { } + #endif + +#ifdef CONFIG_LOCK_DOWN_KERNEL -+extern bool kernel_is_locked_down(void); ++extern bool __kernel_is_locked_down(const char *what, bool first); +#else -+static inline bool kernel_is_locked_down(void) ++static inline bool __kernel_is_locked_down(const char *what, bool first) +{ + return false; +} +#endif + ++#define kernel_is_locked_down(what) \ ++ ({ \ ++ static bool message_given; \ ++ bool locked_down = __kernel_is_locked_down(what, !message_given); \ ++ message_given = true; \ ++ locked_down; \ ++ }) ++ /* Internal, do not use. */ int __must_check _kstrtoul(const char *s, unsigned int base, unsigned long *res); int __must_check _kstrtol(const char *s, unsigned int base, long *res); diff --git a/include/linux/security.h b/include/linux/security.h -index d3868f2..187b74b 100644 +index ce6265960d6c..310775476b68 100644 --- a/include/linux/security.h +++ b/include/linux/security.h -@@ -1679,5 +1679,16 @@ static inline void free_secdata(void *secdata) +@@ -1753,5 +1753,13 @@ static inline void free_secdata(void *secdata) { } #endif /* CONFIG_SECURITY */ - + +#ifdef CONFIG_LOCK_DOWN_KERNEL -+extern void lock_kernel_down(void); -+#ifdef CONFIG_ALLOW_LOCKDOWN_LIFT -+extern void lift_kernel_lockdown(void); -+#endif ++extern void __init init_lockdown(void); +#else -+static inline void lock_kernel_down(void) ++static inline void __init init_lockdown(void) +{ +} +#endif + #endif /* ! __LINUX_SECURITY_H */ - + diff --git a/security/Kconfig b/security/Kconfig -index d900f47..d9b391d 100644 +index e8e449444e65..8e01fd59ae7e 100644 --- a/security/Kconfig +++ b/security/Kconfig -@@ -193,6 +193,21 @@ config STATIC_USERMODEHELPER_PATH +@@ -205,6 +205,14 @@ config STATIC_USERMODEHELPER_PATH If you wish for all usermode helper programs to be disabled, specify an empty string here (i.e. ""). - + +config LOCK_DOWN_KERNEL + bool "Allow the kernel to be 'locked down'" + help @@ -123,18 +83,11 @@ index d900f47..d9b391d 100644 + turns off various features that might otherwise allow access to the + kernel image (eg. setting MSR registers). + -+config ALLOW_LOCKDOWN_LIFT -+ bool -+ help -+ Allow the lockdown on a kernel to be lifted, thereby restoring the -+ ability of userspace to access the kernel image (eg. by SysRq+x under -+ x86). -+ source security/selinux/Kconfig source security/smack/Kconfig source security/tomoyo/Kconfig diff --git a/security/Makefile b/security/Makefile -index f2d71cd..8c4a43e 100644 +index f2d71cdb8e19..8c4a43e3d4e0 100644 --- a/security/Makefile +++ b/security/Makefile @@ -29,3 +29,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_cgroup.o @@ -146,10 +99,10 @@ index f2d71cd..8c4a43e 100644 +obj-$(CONFIG_LOCK_DOWN_KERNEL) += lock_down.o diff --git a/security/lock_down.c b/security/lock_down.c new file mode 100644 -index 0000000..5788c60 +index 000000000000..d8595c0e6673 --- /dev/null +++ b/security/lock_down.c -@@ -0,0 +1,40 @@ +@@ -0,0 +1,60 @@ +/* Lock down the kernel + * + * Copyright (C) 2016 Red Hat, Inc. All Rights Reserved. @@ -164,282 +117,110 @@ index 0000000..5788c60 +#include <linux/security.h> +#include <linux/export.h> + -+static __read_mostly bool kernel_locked_down; ++static __ro_after_init bool kernel_locked_down; + +/* + * Put the kernel into lock-down mode. + */ -+void lock_kernel_down(void) ++static void __init lock_kernel_down(const char *where) +{ -+ kernel_locked_down = true; ++ if (!kernel_locked_down) { ++ kernel_locked_down = true; ++ pr_notice("Kernel is locked down from %s; see man kernel_lockdown.7\n", ++ where); ++ } +} + ++static int __init lockdown_param(char *ignored) ++{ ++ lock_kernel_down("command line"); ++ return 0; ++} ++ ++early_param("lockdown", lockdown_param); ++ +/* -+ * Take the kernel out of lockdown mode. ++ * Lock the kernel down from very early in the arch setup. This must happen ++ * prior to things like ACPI being initialised. + */ -+void lift_kernel_lockdown(void) ++void __init init_lockdown(void) +{ -+ kernel_locked_down = false; ++#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT ++ if (efi_enabled(EFI_SECURE_BOOT)) ++ lock_kernel_down("EFI secure boot"); ++#endif +} + +/** + * kernel_is_locked_down - Find out if the kernel is locked down ++ * @what: Tag to use in notice generated if lockdown is in effect + */ -+bool kernel_is_locked_down(void) ++bool __kernel_is_locked_down(const char *what, bool first) +{ ++ if (what && first && kernel_locked_down) ++ pr_notice("Lockdown: %s is restricted; see man kernel_lockdown.7\n", ++ what); + return kernel_locked_down; +} -+EXPORT_SYMBOL(kernel_is_locked_down); ++EXPORT_SYMBOL(__kernel_is_locked_down); -- -2.7.4 - -From fb6feb38e297260d050fc477c72683ac51d07ae3 Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Mon, 21 Nov 2016 23:55:55 +0000 -Subject: [PATCH 10/32] efi: Lock down the kernel if booted in secure boot mode +2.13.6 -UEFI Secure Boot provides a mechanism for ensuring that the firmware will -only load signed bootloaders and kernels. Certain use cases may also -require that all kernel modules also be signed. Add a configuration option -that to lock down the kernel - which includes requiring validly signed -modules - if the kernel is secure-booted. - -Signed-off-by: David Howells <dhowells@redhat.com> ---- - arch/x86/Kconfig | 12 ++++++++++++ - arch/x86/kernel/setup.c | 8 +++++++- - 2 files changed, 19 insertions(+), 1 deletion(-) - -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 874c123..a315974 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -1816,6 +1816,18 @@ config EFI_MIXED - - If unsure, say N. - -+config EFI_SECURE_BOOT_LOCK_DOWN -+ def_bool n -+ depends on EFI -+ prompt "Lock down the kernel when UEFI Secure Boot is enabled" -+ ---help--- -+ UEFI Secure Boot provides a mechanism for ensuring that the firmware -+ will only load signed bootloaders and kernels. Certain use cases may -+ also require that all kernel modules also be signed and that -+ userspace is prevented from directly changing the running kernel -+ image. Say Y here to automatically lock down the kernel when a -+ system boots with UEFI Secure Boot enabled. -+ - config SECCOMP - def_bool y - prompt "Enable seccomp to safely compute untrusted bytecode" -diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index 447905e..d44e60e 100644 ---- a/arch/x86/kernel/setup.c -+++ b/arch/x86/kernel/setup.c -@@ -69,6 +69,7 @@ - #include <linux/crash_dump.h> - #include <linux/tboot.h> - #include <linux/jiffies.h> -+#include <linux/security.h> - - #include <linux/usb/xhci-dbgp.h> - #include <video/edid.h> -@@ -1183,7 +1184,12 @@ void __init setup_arch(char **cmdline_p) - break; - case efi_secureboot_mode_enabled: - set_bit(EFI_SECURE_BOOT, &efi.flags); -- pr_info("Secure boot enabled\n"); -+ if (IS_ENABLED(CONFIG_EFI_SECURE_BOOT_LOCK_DOWN)) { -+ lock_kernel_down(); -+ pr_info("Secure boot enabled and kernel locked down\n"); -+ } else { -+ pr_info("Secure boot enabled\n"); -+ } - break; - default: - pr_info("Secure boot could not be determined\n"); --- -2.7.4 +From 2c46467f43bc54324de5474a8355f98c692309e4 Mon Sep 17 00:00:00 2001 +From: Kyle McMartin <kyle@redhat.com> +Date: Wed, 18 Oct 2017 14:02:25 +0100 +Subject: [PATCH 02/26] Add a SysRq option to lift kernel lockdown -From 7182f2f5b254d6dc6d3105d2f99219a76adf9de0 Mon Sep 17 00:00:00 2001 -From: David Howells <dhowells@redhat.com> -Date: Wed, 23 Nov 2016 13:22:22 +0000 -Subject: [PATCH 11/32] Enforce module signatures if the kernel is locked down +Make an option to provide a sysrq key that will lift the kernel lockdown, +thereby allowing the running kernel image to be accessed and modified. -If the kernel is locked down, require that all modules have valid -signatures that we can verify. +On x86_64 this is triggered with SysRq+x, but this key may not be available +on all arches, so it is set by setting LOCKDOWN_LIFT_KEY in asm/setup.h. +Signed-off-by: Kyle McMartin <kyle@redhat.com> Signed-off-by: David Howells <dhowells@redhat.com> +cc: x86@kernel.org --- - kernel/module.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/kernel/module.c b/kernel/module.c -index 7eba6de..3331f2e 100644 ---- a/kernel/module.c -+++ b/kernel/module.c -@@ -2756,7 +2756,7 @@ static int module_sig_check(struct load_info *info, int flags) - } - - /* Not having a signature is only an error if we're strict. */ -- if (err == -ENOKEY && !sig_enforce) -+ if (err == -ENOKEY && !sig_enforce && !kernel_is_locked_down()) - err = 0; - - return err; --- -2.7.4 - -From 7e97c58bcd0b4c082b889fb093a2779147532b9f Mon Sep 17 00:00:00 2001 -From: Matthew Garrett <matthew.garrett@nebula.com> -Date: Tue, 22 Nov 2016 08:46:16 +0000 -Subject: [PATCH 12/32] Restrict /dev/mem and /dev/kmem when the kernel is - locked down - -Allowing users to write to address space makes it possible for the kernel to -be subverted, avoiding module loading restrictions. Prevent this when the -kernel has been locked down. - -Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com> -Signed-off-by: David Howells <dhowells@redhat.com> ---- - drivers/char/mem.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/drivers/char/mem.c b/drivers/char/mem.c -index 6d9cc2d..f814404 100644 ---- a/drivers/char/mem.c -+++ b/drivers/char/mem.c -@@ -163,6 +163,9 @@ static ssize_t write_mem(struct file *file, const char __user *buf, - if (p != *ppos) - return -EFBIG; - -+ if (kernel_is_locked_down()) -+ return -EPERM; + arch/x86/include/asm/setup.h | 2 ++ + drivers/input/misc/uinput.c | 1 + + drivers/tty/sysrq.c | 19 ++++++++++++------ + include/linux/input.h | 5 +++++ + include/linux/sysrq.h | 8 +++++++- + kernel/debug/kdb/kdb_main.c | 2 +- + security/Kconfig | 8 ++++++++ + security/lock_down.c | 47 ++++++++++++++++++++++++++++++++++++++++++++ + 8 files changed, 84 insertions(+), 8 deletions(-) + +diff --git a/arch/x86/include/asm/setup.h b/arch/x86/include/asm/setup.h +index a65cf544686a..863f77582c09 100644 +--- a/arch/x86/include/asm/setup.h ++++ b/arch/x86/include/asm/setup.h +@@ -8,6 +8,8 @@ + #include <linux/linkage.h> + #include <asm/page_types.h> + ++#define LOCKDOWN_LIFT_KEY 'x' + - if (!valid_phys_addr_range(p, count)) - return -EFAULT; - -@@ -513,6 +516,9 @@ static ssize_t write_kmem(struct file *file, const char __user *buf, - char *kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */ - int err = 0; - -+ if (kernel_is_locked_down()) -+ return -EPERM; -+ - if (p < (unsigned long) high_memory) { - unsigned long to_write = min_t(unsigned long, count, - (unsigned long)high_memory - p); --- -2.7.4 - -From b83b68a9a13120664eaabf21a7b3ff0b065bd5b2 Mon Sep 17 00:00:00 2001 -From: Kyle McMartin <kyle@redhat.com> -Date: Mon, 21 Nov 2016 23:55:56 +0000 -Subject: [PATCH 13/32] Add a sysrq option to exit secure boot mode - -Make sysrq+x exit secure boot mode on x86_64, thereby allowing the running -kernel image to be modified. This lifts the lockdown. + #ifdef __i386__ -Signed-off-by: David Howells <dhowells@redhat.com> ---- - arch/x86/Kconfig | 10 ++++++++++ - arch/x86/kernel/setup.c | 31 +++++++++++++++++++++++++++++++ - drivers/input/misc/uinput.c | 1 + - drivers/tty/sysrq.c | 19 +++++++++++++------ - include/linux/input.h | 5 +++++ - include/linux/sysrq.h | 8 +++++++- - kernel/debug/kdb/kdb_main.c | 2 +- - 7 files changed, 68 insertions(+), 8 deletions(-) - -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index a315974..6931e68 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -1828,6 +1828,16 @@ config EFI_SECURE_BOOT_LOCK_DOWN - image. Say Y here to automatically lock down the kernel when a - system boots with UEFI Secure Boot enabled. - -+config EFI_ALLOW_SECURE_BOOT_EXIT -+ def_bool n -+ depends on EFI_SECURE_BOOT_LOCK_DOWN && MAGIC_SYSRQ -+ select ALLOW_LOCKDOWN_LIFT -+ prompt "Allow secure boot mode to be exited with SysRq+x on a keyboard" -+ ---help--- -+ Allow secure boot mode to be exited and the kernel lockdown lifted by -+ typing SysRq+x on a keyboard attached to the system (not permitted -+ through procfs). -+ - config SECCOMP - def_bool y - prompt "Enable seccomp to safely compute untrusted bytecode" -diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index d44e60e..f7635d0 100644 ---- a/arch/x86/kernel/setup.c -+++ b/arch/x86/kernel/setup.c -@@ -71,6 +71,11 @@ - #include <linux/jiffies.h> - #include <linux/security.h> - -+#include <linux/fips.h> -+#include <linux/cred.h> -+#include <linux/sysrq.h> -+#include <linux/init_task.h> -+ - #include <linux/usb/xhci-dbgp.h> - #include <video/edid.h> - -@@ -1328,6 +1333,32 @@ void __init i386_reserve_resources(void) - - #endif /* CONFIG_X86_32 */ - -+#ifdef CONFIG_EFI_ALLOW_SECURE_BOOT_EXIT -+ -+static void sysrq_handle_secure_boot(int key) -+{ -+ if (!efi_enabled(EFI_SECURE_BOOT)) -+ return; -+ -+ pr_info("Secure boot disabled\n"); -+ lift_kernel_lockdown(); -+} -+static struct sysrq_key_op secure_boot_sysrq_op = { -+ .handler = sysrq_handle_secure_boot, -+ .help_msg = "unSB(x)", -+ .action_msg = "Disabling Secure Boot restrictions", -+ .enable_mask = SYSRQ_DISABLE_USERSPACE, -+}; -+static int __init secure_boot_sysrq(void) -+{ -+ if (efi_enabled(EFI_SECURE_BOOT)) -+ register_sysrq_key('x', &secure_boot_sysrq_op); -+ return 0; -+} -+late_initcall(secure_boot_sysrq); -+#endif /*CONFIG_EFI_ALLOW_SECURE_BOOT_EXIT*/ -+ -+ - static struct notifier_block kernel_offset_notifier = { - .notifier_call = dump_kernel_offset - }; + #include <linux/pfn.h> diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c -index 022be0e..4a054a5 100644 +index 443151de90c6..45a1f5460805 100644 --- a/drivers/input/misc/uinput.c +++ b/drivers/input/misc/uinput.c -@@ -387,6 +387,7 @@ static int uinput_allocate_device(struct uinput_device *udev) +@@ -408,6 +408,7 @@ static int uinput_allocate_device(struct uinput_device *udev) if (!udev->dev) return -ENOMEM; - + + udev->dev->flags |= INPUTDEV_FLAGS_SYNTHETIC; udev->dev->event = uinput_dev_event; input_set_drvdata(udev->dev, udev); - + diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c -index 7113674..e1addc3 100644 +index 3ffc1ce29023..8b766dbad6dd 100644 --- a/drivers/tty/sysrq.c +++ b/drivers/tty/sysrq.c -@@ -479,6 +479,7 @@ static struct sysrq_key_op *sysrq_key_table[36] = { +@@ -481,6 +481,7 @@ static struct sysrq_key_op *sysrq_key_table[36] = { /* x: May be registered on mips for TLB dump */ /* x: May be registered on ppc/powerpc for xmon */ /* x: May be registered on sparc64 for global PMU dump */ @@ -447,17 +228,17 @@ index 7113674..e1addc3 100644 NULL, /* x */ /* y: May be registered on sparc64 for global register dump */ NULL, /* y */ -@@ -522,7 +523,7 @@ static void __sysrq_put_key_op(int key, struct sysrq_key_op *op_p) +@@ -524,7 +525,7 @@ static void __sysrq_put_key_op(int key, struct sysrq_key_op *op_p) sysrq_key_table[i] = op_p; } - + -void __handle_sysrq(int key, bool check_mask) +void __handle_sysrq(int key, unsigned int from) { struct sysrq_key_op *op_p; int orig_log_level; -@@ -542,11 +543,15 @@ void __handle_sysrq(int key, bool check_mask) - +@@ -544,11 +545,15 @@ void __handle_sysrq(int key, bool check_mask) + op_p = __sysrq_get_key_op(key); if (op_p) { + /* Ban synthetic events from some sysrq functionality */ @@ -473,7 +254,7 @@ index 7113674..e1addc3 100644 pr_cont("%s\n", op_p->action_msg); console_loglevel = orig_log_level; op_p->handler(key); -@@ -578,7 +583,7 @@ void __handle_sysrq(int key, bool check_mask) +@@ -580,7 +585,7 @@ void __handle_sysrq(int key, bool check_mask) void handle_sysrq(int key) { if (sysrq_on()) @@ -481,18 +262,18 @@ index 7113674..e1addc3 100644 + __handle_sysrq(key, SYSRQ_FROM_KERNEL); } EXPORT_SYMBOL(handle_sysrq); - -@@ -659,7 +664,7 @@ static void sysrq_do_reset(unsigned long _state) + +@@ -661,7 +666,7 @@ static void sysrq_do_reset(unsigned long _state) static void sysrq_handle_reset_request(struct sysrq_state *state) { if (state->reset_requested) - __handle_sysrq(sysrq_xlate[KEY_B], false); + __handle_sysrq(sysrq_xlate[KEY_B], SYSRQ_FROM_KERNEL); - + if (sysrq_reset_downtime_ms) mod_timer(&state->keyreset_timer, -@@ -810,8 +815,10 @@ static bool sysrq_handle_keypress(struct sysrq_state *sysrq, - +@@ -812,8 +817,10 @@ static bool sysrq_handle_keypress(struct sysrq_state *sysrq, + default: if (sysrq->active && value && value != 2) { + int from = sysrq->handle.dev->flags & INPUTDEV_FLAGS_SYNTHETIC ? @@ -503,17 +284,17 @@ index 7113674..e1addc3 100644 } break; } -@@ -1095,7 +1102,7 @@ static ssize_t write_sysrq_trigger(struct file *file, const char __user *buf, - +@@ -1097,7 +1104,7 @@ static ssize_t write_sysrq_trigger(struct file *file, const char __user *buf, + if (get_user(c, buf)) return -EFAULT; - __handle_sysrq(c, false); + __handle_sysrq(c, SYSRQ_FROM_PROC); } - + return count; diff --git a/include/linux/input.h b/include/linux/input.h -index a65e3b2..8b03571 100644 +index fb5e23c7ed98..9d2b45a21ade 100644 --- a/include/linux/input.h +++ b/include/linux/input.h @@ -42,6 +42,7 @@ struct input_value { @@ -527,29 +308,29 @@ index a65e3b2..8b03571 100644 @@ -124,6 +125,8 @@ struct input_dev { const char *uniq; struct input_id id; - + + unsigned int flags; + unsigned long propbit[BITS_TO_LONGS(INPUT_PROP_CNT)]; - + unsigned long evbit[BITS_TO_LONGS(EV_CNT)]; @@ -190,6 +193,8 @@ struct input_dev { }; #define to_input_dev(d) container_of(d, struct input_dev, dev) - + +#define INPUTDEV_FLAGS_SYNTHETIC 0x000000001 + /* * Verify that we are in sync with input_device_id mod_devicetable.h #defines */ diff --git a/include/linux/sysrq.h b/include/linux/sysrq.h -index 387fa7d..f7c52a9 100644 +index 387fa7d05c98..f7c52a9ea394 100644 --- a/include/linux/sysrq.h +++ b/include/linux/sysrq.h @@ -28,6 +28,8 @@ #define SYSRQ_ENABLE_BOOT 0x0080 #define SYSRQ_ENABLE_RTNICE 0x0100 - + +#define SYSRQ_DISABLE_USERSPACE 0x00010000 + struct sysrq_key_op { @@ -558,7 +339,7 @@ index 387fa7d..f7c52a9 100644 @@ -42,8 +44,12 @@ struct sysrq_key_op { * are available -- else NULL's). */ - + +#define SYSRQ_FROM_KERNEL 0x0001 +#define SYSRQ_FROM_PROC 0x0002 +#define SYSRQ_FROM_SYNTHETIC 0x0004 @@ -570,25 +351,179 @@ index 387fa7d..f7c52a9 100644 int unregister_sysrq_key(int key, struct sysrq_key_op *op); struct sysrq_key_op *__sysrq_get_key_op(int key); diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c -index ca18391..c4524b8 100644 +index c8146d53ca67..b480cadf9272 100644 --- a/kernel/debug/kdb/kdb_main.c +++ b/kernel/debug/kdb/kdb_main.c -@@ -1967,7 +1967,7 @@ static int kdb_sr(int argc, const char **argv) +@@ -1970,7 +1970,7 @@ static int kdb_sr(int argc, const char **argv) return KDB_ARGCOUNT; - + kdb_trap_printk++; - __handle_sysrq(*argv[1], check_mask); + __handle_sysrq(*argv[1], check_mask ? SYSRQ_FROM_KERNEL : 0); kdb_trap_printk--; - + return 0; +diff --git a/security/Kconfig b/security/Kconfig +index 8e01fd59ae7e..453cc89c198a 100644 +--- a/security/Kconfig ++++ b/security/Kconfig +@@ -213,6 +213,14 @@ config LOCK_DOWN_KERNEL + turns off various features that might otherwise allow access to the + kernel image (eg. setting MSR registers). + ++config ALLOW_LOCKDOWN_LIFT_BY_SYSRQ ++ bool "Allow the kernel lockdown to be lifted by SysRq" ++ depends on LOCK_DOWN_KERNEL && MAGIC_SYSRQ ++ help ++ Allow the lockdown on a kernel to be lifted, by pressing a SysRq key ++ combination on a wired keyboard. ++ ++ + source security/selinux/Kconfig + source security/smack/Kconfig + source security/tomoyo/Kconfig +diff --git a/security/lock_down.c b/security/lock_down.c +index d8595c0e6673..2c6b00f0c229 100644 +--- a/security/lock_down.c ++++ b/security/lock_down.c +@@ -11,8 +11,14 @@ + + #include <linux/security.h> + #include <linux/export.h> ++#include <linux/sysrq.h> ++#include <asm/setup.h> + ++#ifdef CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ ++static __read_mostly bool kernel_locked_down; ++#else + static __ro_after_init bool kernel_locked_down; ++#endif + + /* + * Put the kernel into lock-down mode. +@@ -58,3 +64,44 @@ bool __kernel_is_locked_down(const char *what, bool first) + return kernel_locked_down; + } + EXPORT_SYMBOL(__kernel_is_locked_down); ++ ++#ifdef CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ ++ ++/* ++ * Take the kernel out of lockdown mode. ++ */ ++static void lift_kernel_lockdown(void) ++{ ++ pr_notice("Lifting lockdown\n"); ++ kernel_locked_down = false; ++} ++ ++/* ++ * Allow lockdown to be lifted by pressing something like SysRq+x (and not by ++ * echoing the appropriate letter into the sysrq-trigger file). ++ */ ++static void sysrq_handle_lockdown_lift(int key) ++{ ++ if (kernel_locked_down) ++ lift_kernel_lockdown(); ++} ++ ++static struct sysrq_key_op lockdown_lift_sysrq_op = { ++ .handler = sysrq_handle_lockdown_lift, ++ .help_msg = "unSB(x)", ++ .action_msg = "Disabling Secure Boot restrictions", ++ .enable_mask = SYSRQ_DISABLE_USERSPACE, ++}; ++ ++static int __init lockdown_lift_sysrq(void) ++{ ++ if (kernel_locked_down) { ++ lockdown_lift_sysrq_op.help_msg[5] = LOCKDOWN_LIFT_KEY; ++ register_sysrq_key(LOCKDOWN_LIFT_KEY, &lockdown_lift_sysrq_op); ++ } ++ return 0; ++} ++ ++late_initcall(lockdown_lift_sysrq); ++ ++#endif /* CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ */ +-- +2.13.6 + +From 4c389db9daee3a3a444339a7d789de1d9366f736 Mon Sep 17 00:00:00 2001 +From: David Howells <dhowells@redhat.com> +Date: Wed, 24 May 2017 14:56:01 +0100 +Subject: [PATCH 03/26] Enforce module signatures if the kernel is locked down + +If the kernel is locked down, require that all modules have valid +signatures that we can verify. + +Signed-off-by: David Howells <dhowells@redhat.com> +Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com> +Reviewed-by: James Morris <james.l.morris@oracle.com> +--- + kernel/module.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/kernel/module.c b/kernel/module.c +index de66ec825992..3d9a3270c179 100644 +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -2781,7 +2781,8 @@ static int module_sig_check(struct load_info *info, int flags) + } + + /* Not having a signature is only an error if we're strict. */ +- if (err == -ENOKEY && !sig_enforce) ++ if (err == -ENOKEY && !sig_enforce && ++ !kernel_is_locked_down("Loading of unsigned modules")) + err = 0; + + return err; -- -2.7.4 +2.13.6 -From 8884bd44932e595323fcddfb09c2a2a586134cdf Mon Sep 17 00:00:00 2001 +From 59312c44aa46939a14b3fbfeb510f94b4a73c8a1 Mon Sep 17 00:00:00 2001 From: Matthew Garrett <matthew.garrett@nebula.com> -Date: Tue, 22 Nov 2016 08:46:15 +0000 -Subject: [PATCH 14/32] kexec: Disable at runtime if the kernel is locked down +Date: Wed, 24 May 2017 14:56:02 +0100 +Subject: [PATCH 04/26] Restrict /dev/{mem,kmem,port} when the kernel is locked + down + +Allowing users to read and write to core kernel memory makes it possible +for the kernel to be subverted, avoiding module loading restrictions, and +also to steal cryptographic information. + +Disallow /dev/mem and /dev/kmem from being opened this when the kernel has +been locked down to prevent this. + +Also disallow /dev/port from being opened to prevent raw ioport access and +thus DMA from being used to accomplish the same thing. + +Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com> +Signed-off-by: David Howells <dhowells@redhat.com> +Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com> +--- + drivers/char/mem.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/char/mem.c b/drivers/char/mem.c +index 593a8818aca9..0ce5ac0a5c6b 100644 +--- a/drivers/char/mem.c ++++ b/drivers/char/mem.c +@@ -762,6 +762,8 @@ static loff_t memory_lseek(struct file *file, loff_t offset, int orig) + + static int open_port(struct inode *inode, struct file *filp) + { ++ if (kernel_is_locked_down("/dev/mem,kmem,port")) ++ return -EPERM; + return capable(CAP_SYS_RAWIO) ? 0 : -EPERM; + } + +-- +2.13.6 + +From 6304f16efd61e66701f4b331e95da3cafb5f5f76 Mon Sep 17 00:00:00 2001 +From: Matthew Garrett <matthew.garrett@nebula.com> +Date: Wed, 24 May 2017 14:56:02 +0100 +Subject: [PATCH 05/26] kexec: Disable at runtime if the kernel is locked down kexec permits the loading and execution of arbitrary code in ring 0, which is something that lock-down is meant to prevent. It makes sense to disable @@ -599,22 +534,26 @@ image to be booted. Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com> Signed-off-by: David Howells <dhowells@redhat.com> +Acked-by: Dave Young <dyoung@redhat.com> +Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com> +Reviewed-by: James Morris <james.l.morris@oracle.com> +cc: kexec@lists.infradead.org --- kernel/kexec.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/kernel/kexec.c b/kernel/kexec.c -index 980936a..46de8e6 100644 +index e62ec4dc6620..7dadfed9b676 100644 --- a/kernel/kexec.c +++ b/kernel/kexec.c -@@ -194,6 +194,13 @@ SYSCALL_DEFINE4(kexec_load, unsigned long, entry, unsigned long, nr_segments, +@@ -202,6 +202,13 @@ SYSCALL_DEFINE4(kexec_load, unsigned long, entry, unsigned long, nr_segments, return -EPERM; - + /* + * kexec can be used to circumvent module loading restrictions, so + * prevent loading in that case + */ -+ if (kernel_is_locked_down()) ++ if (kernel_is_locked_down("kexec of unsigned images")) + return -EPERM; + + /* @@ -622,12 +561,12 @@ index 980936a..46de8e6 100644 * This leaves us room for future extensions. */ -- -2.7.4 +2.13.6 -From cace563d1743c3d2faf1e46bd4df8e63e2310207 Mon Sep 17 00:00:00 2001 +From cd00079900870855cea3573253a95c331ccab523 Mon Sep 17 00:00:00 2001 From: Dave Young <dyoung@redhat.com> -Date: Tue, 22 Nov 2016 08:46:15 +0000 -Subject: [PATCH 15/32] Copy secure_boot flag in boot params across kexec +Date: Wed, 24 May 2017 14:56:02 +0100 +Subject: [PATCH 06/26] Copy secure_boot flag in boot params across kexec reboot Kexec reboot in case secure boot being enabled does not keep the secure @@ -643,68 +582,73 @@ stub. Fixing this issue by copying secure_boot flag across kexec reboot. Signed-off-by: Dave Young <dyoung@redhat.com> Signed-off-by: David Howells <dhowells@redhat.com> +Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com> +cc: kexec@lists.infradead.org --- arch/x86/kernel/kexec-bzimage64.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c -index d0a814a..3551bca 100644 +index fb095ba0c02f..7d0fac5bcbbe 100644 --- a/arch/x86/kernel/kexec-bzimage64.c +++ b/arch/x86/kernel/kexec-bzimage64.c @@ -179,6 +179,7 @@ setup_efi_state(struct boot_params *params, unsigned long params_load_addr, if (efi_enabled(EFI_OLD_MEMMAP)) return 0; - + + params->secure_boot = boot_params.secure_boot; ei->efi_loader_signature = current_ei->efi_loader_signature; ei->efi_systab = current_ei->efi_systab; ei->efi_systab_hi = current_ei->efi_systab_hi; -- -2.7.4 +2.13.6 -From 08a3467acbc28bb469d1eebd0f5fd40b944d984a Mon Sep 17 00:00:00 2001 -From: "Lee, Chun-Yi" <joeyli.kernel@gmail.com> -Date: Wed, 23 Nov 2016 13:49:19 +0000 -Subject: [PATCH 16/32] kexec_file: Disable at runtime if securelevel has been - set +From de2ac5da82fc55156134820ba32095710b935ad5 Mon Sep 17 00:00:00 2001 +From: Chun-Yi Lee <joeyli.kernel@gmail.com> +Date: Wed, 24 May 2017 14:56:03 +0100 +Subject: [PATCH 07/26] kexec_file: Disable at runtime if the kernel is locked + down -When KEXEC_VERIFY_SIG is not enabled, kernel should not loads image -through kexec_file systemcall if securelevel has been set. +When KEXEC_VERIFY_SIG is not enabled, kernel should not load images +through kexec_file systemcall if the kernel is locked down. This code was showed in Matthew's patch but not in git: https://lkml.org/lkml/2015/3/13/778 Cc: Matthew Garrett <mjg59@srcf.ucam.org> -Signed-off-by: Lee, Chun-Yi <jlee@suse.com> +Signed-off-by: Chun-Yi Lee <jlee@suse.com> Signed-off-by: David Howells <dhowells@redhat.com> +Reviewed-by: James Morris <james.l.morris@oracle.com> +cc: kexec@lists.infradead.org --- - kernel/kexec_file.c | 6 ++++++ - 1 file changed, 6 insertions(+) + kernel/kexec_file.c | 7 +++++++ + 1 file changed, 7 insertions(+) diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c -index b56a558..003cade 100644 +index 9f48f4412297..ff6523f2dcc2 100644 --- a/kernel/kexec_file.c +++ b/kernel/kexec_file.c -@@ -268,6 +268,12 @@ SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd, +@@ -255,6 +255,13 @@ SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd, if (!capable(CAP_SYS_BOOT) || kexec_load_disabled) return -EPERM; - + + /* Don't permit images to be loaded into trusted kernels if we're not + * going to verify the signature on them + */ -+ if (!IS_ENABLED(CONFIG_KEXEC_VERIFY_SIG) && kernel_is_locked_down()) ++ if (!IS_ENABLED(CONFIG_KEXEC_VERIFY_SIG) && ++ kernel_is_locked_down("kexec of unsigned images")) + return -EPERM; + /* Make sure we have a legal set of flags */ if (flags != (flags & KEXEC_FILE_FLAGS)) return -EINVAL; -- -2.7.4 +2.13.6 -From 925fd10d7a99a6f999dde76daf2b1ef1238b251a Mon Sep 17 00:00:00 2001 +From ba823f2b5125605fcbac150fe27e622fd224ea61 Mon Sep 17 00:00:00 2001 From: Josh Boyer <jwboyer@fedoraproject.org> -Date: Tue, 22 Nov 2016 08:46:15 +0000 -Subject: [PATCH 17/32] hibernate: Disable when the kernel is locked down +Date: Wed, 24 May 2017 14:56:03 +0100 +Subject: [PATCH 08/26] hibernate: Disable when the kernel is locked down There is currently no way to verify the resume image when returning from hibernate. This might compromise the signed modules trust model, @@ -713,30 +657,32 @@ kernel is locked down. Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org> Signed-off-by: David Howells <dhowells@redhat.com> +Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com> +cc: linux-pm@vger.kernel.org --- kernel/power/hibernate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c -index 86385af..1629798 100644 +index a5c36e9c56a6..f2eafefeec50 100644 --- a/kernel/power/hibernate.c +++ b/kernel/power/hibernate.c -@@ -67,7 +67,7 @@ static const struct platform_hibernation_ops *hibernation_ops; - +@@ -70,7 +70,7 @@ static const struct platform_hibernation_ops *hibernation_ops; + bool hibernation_available(void) { - return (nohibernate == 0); -+ return nohibernate == 0 && !kernel_is_locked_down(); ++ return nohibernate == 0 && !kernel_is_locked_down("Hibernation"); } - + /** -- -2.7.4 +2.13.6 -From b14fb5fcd60c84a09a15bd7ec974b6fbce68335c Mon Sep 17 00:00:00 2001 +From 9e78666a6153d72c3e50160a30ead699ba508d8f Mon Sep 17 00:00:00 2001 From: Matthew Garrett <mjg59@srcf.ucam.org> -Date: Wed, 23 Nov 2016 13:28:17 +0000 -Subject: [PATCH 18/32] uswsusp: Disable when the kernel is locked down +Date: Wed, 24 May 2017 14:56:03 +0100 +Subject: [PATCH 09/26] uswsusp: Disable when the kernel is locked down uswsusp allows a user process to dump and then restore kernel state, which makes it possible to modify the running kernel. Disable this if the kernel @@ -744,31 +690,34 @@ is locked down. Signed-off-by: Matthew Garrett <mjg59@srcf.ucam.org> Signed-off-by: David Howells <dhowells@redhat.com> +Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com> +Reviewed-by: James Morris <james.l.morris@oracle.com> +cc: linux-pm@vger.kernel.org --- kernel/power/user.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/power/user.c b/kernel/power/user.c -index 22df9f7..e4b926d 100644 +index 22df9f7ff672..678ade9decfe 100644 --- a/kernel/power/user.c +++ b/kernel/power/user.c @@ -52,6 +52,9 @@ static int snapshot_open(struct inode *inode, struct file *filp) if (!hibernation_available()) return -EPERM; - -+ if (kernel_is_locked_down()) + ++ if (kernel_is_locked_down("/dev/snapshot")) + return -EPERM; + lock_system_sleep(); - + if (!atomic_add_unless(&snapshot_device_available, -1, 0)) { -- -2.7.4 +2.13.6 -From d8167273e7562e5aa866d2b65e25bb1962de972c Mon Sep 17 00:00:00 2001 +From 334fa071b01ced7f48b2920208addfb1eab5d0fe Mon Sep 17 00:00:00 2001 From: Matthew Garrett <matthew.garrett@nebula.com> -Date: Tue, 22 Nov 2016 08:46:15 +0000 -Subject: [PATCH 19/32] PCI: Lock down BAR access when the kernel is locked +Date: Wed, 24 May 2017 14:56:03 +0100 +Subject: [PATCH 10/26] PCI: Lock down BAR access when the kernel is locked down Any hardware that can potentially generate DMA has to be locked down in @@ -779,55 +728,58 @@ sufficiently IOMMU-isolated devices. Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com> Signed-off-by: David Howells <dhowells@redhat.com> +Acked-by: Bjorn Helgaas <bhelgaas@google.com> +Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com> +cc: linux-pci@vger.kernel.org --- drivers/pci/pci-sysfs.c | 9 +++++++++ - drivers/pci/proc.c | 8 +++++++- - drivers/pci/syscall.c | 2 +- - 3 files changed, 17 insertions(+), 2 deletions(-) + drivers/pci/proc.c | 9 ++++++++- + drivers/pci/syscall.c | 3 ++- + 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c -index 0666287..b10992c 100644 +index 1eecfa301f7f..e1a3b0e765c2 100644 --- a/drivers/pci/pci-sysfs.c +++ b/drivers/pci/pci-sysfs.c -@@ -718,6 +718,9 @@ static ssize_t pci_write_config(struct file *filp, struct kobject *kobj, +@@ -881,6 +881,9 @@ static ssize_t pci_write_config(struct file *filp, struct kobject *kobj, loff_t init_off = off; u8 *data = (u8 *) buf; - -+ if (kernel_is_locked_down()) + ++ if (kernel_is_locked_down("Direct PCI access")) + return -EPERM; + if (off > dev->cfg_size) return 0; if (off + count > dev->cfg_size) { -@@ -1009,6 +1012,9 @@ static int pci_mmap_resource(struct kobject *kobj, struct bin_attribute *attr, +@@ -1175,6 +1178,9 @@ static int pci_mmap_resource(struct kobject *kobj, struct bin_attribute *attr, enum pci_mmap_state mmap_type; struct resource *res = &pdev->resource[bar]; - -+ if (kernel_is_locked_down()) + ++ if (kernel_is_locked_down("Direct PCI access")) + return -EPERM; + if (res->flags & IORESOURCE_MEM && iomem_is_exclusive(res->start)) return -EINVAL; - -@@ -1108,6 +1114,9 @@ static ssize_t pci_write_resource_io(struct file *filp, struct kobject *kobj, + +@@ -1255,6 +1261,9 @@ static ssize_t pci_write_resource_io(struct file *filp, struct kobject *kobj, struct bin_attribute *attr, char *buf, loff_t off, size_t count) { -+ if (kernel_is_locked_down()) ++ if (kernel_is_locked_down("Direct PCI access")) + return -EPERM; + return pci_resource_io(filp, kobj, attr, buf, off, count, true); } - + diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c -index f82710a..139d6f0 100644 +index 098360d7ff81..a6c53d855daa 100644 --- a/drivers/pci/proc.c +++ b/drivers/pci/proc.c @@ -116,6 +116,9 @@ static ssize_t proc_bus_pci_write(struct file *file, const char __user *buf, int size = dev->cfg_size; int cnt; - -+ if (kernel_is_locked_down()) + ++ if (kernel_is_locked_down("Direct PCI access")) + return -EPERM; + if (pos >= size) @@ -836,42 +788,44 @@ index f82710a..139d6f0 100644 @@ -195,6 +198,9 @@ static long proc_bus_pci_ioctl(struct file *file, unsigned int cmd, #endif /* HAVE_PCI_MMAP */ int ret = 0; - -+ if (kernel_is_locked_down()) + ++ if (kernel_is_locked_down("Direct PCI access")) + return -EPERM; + switch (cmd) { case PCIIOC_CONTROLLER: ret = pci_domain_nr(dev->bus); -@@ -233,7 +239,7 @@ static int proc_bus_pci_mmap(struct file *file, struct vm_area_struct *vma) +@@ -236,7 +242,8 @@ static int proc_bus_pci_mmap(struct file *file, struct vm_area_struct *vma) struct pci_filp_private *fpriv = file->private_data; int i, ret, write_combine = 0, res_bit = IORESOURCE_MEM; - + - if (!capable(CAP_SYS_RAWIO)) -+ if (!capable(CAP_SYS_RAWIO) || kernel_is_locked_down()) ++ if (!capable(CAP_SYS_RAWIO) || ++ kernel_is_locked_down("Direct PCI access")) return -EPERM; - + if (fpriv->mmap_state == pci_mmap_io) { diff --git a/drivers/pci/syscall.c b/drivers/pci/syscall.c -index 9bf993e..c095247 100644 +index 9bf993e1f71e..afa01cc3ceec 100644 --- a/drivers/pci/syscall.c +++ b/drivers/pci/syscall.c -@@ -92,7 +92,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn, +@@ -92,7 +92,8 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn, u32 dword; int err = 0; - + - if (!capable(CAP_SYS_ADMIN)) -+ if (!capable(CAP_SYS_ADMIN) || kernel_is_locked_down()) ++ if (!capable(CAP_SYS_ADMIN) || ++ kernel_is_locked_down("Direct PCI access")) return -EPERM; - + dev = pci_get_bus_and_slot(bus, dfn); -- -2.7.4 +2.13.6 -From 169d13e0c5240ac6aad13aace5ecbdb3de2cfada Mon Sep 17 00:00:00 2001 +From 7e608c45ac2ab6c8e125aaf3993b8257352ac631 Mon Sep 17 00:00:00 2001 From: Matthew Garrett <matthew.garrett@nebula.com> -Date: Tue, 22 Nov 2016 08:46:16 +0000 -Subject: [PATCH 20/32] x86: Lock down IO port access when the kernel is locked +Date: Wed, 24 May 2017 14:56:04 +0100 +Subject: [PATCH 11/26] x86: Lock down IO port access when the kernel is locked down IO port access would permit users to gain access to PCI configuration @@ -884,97 +838,98 @@ KDDISABIO console ioctls. Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com> Signed-off-by: David Howells <dhowells@redhat.com> +Reviewed-by: Thomas Gleixner <tglx@linutronix.de> +Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com> +cc: x86@kernel.org --- - arch/x86/kernel/ioport.c | 4 ++-- - drivers/char/mem.c | 2 ++ - 2 files changed, 4 insertions(+), 2 deletions(-) + arch/x86/kernel/ioport.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c -index b01bc8517..4ccaace 100644 +index 9c3cf0944bce..2c0f058651c5 100644 --- a/arch/x86/kernel/ioport.c +++ b/arch/x86/kernel/ioport.c -@@ -29,7 +29,7 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on) - +@@ -30,7 +30,8 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on) + if ((from + num <= from) || (from + num > IO_BITMAP_BITS)) return -EINVAL; - if (turn_on && !capable(CAP_SYS_RAWIO)) -+ if (turn_on && (!capable(CAP_SYS_RAWIO) || kernel_is_locked_down())) ++ if (turn_on && (!capable(CAP_SYS_RAWIO) || ++ kernel_is_locked_down("ioperm"))) return -EPERM; - + /* -@@ -113,7 +113,7 @@ SYSCALL_DEFINE1(iopl, unsigned int, level) +@@ -120,7 +121,8 @@ SYSCALL_DEFINE1(iopl, unsigned int, level) return -EINVAL; /* Trying to gain more privileges? */ if (level > old) { - if (!capable(CAP_SYS_RAWIO)) -+ if (!capable(CAP_SYS_RAWIO) || kernel_is_locked_down()) ++ if (!capable(CAP_SYS_RAWIO) || ++ kernel_is_locked_down("iopl")) return -EPERM; } regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | -diff --git a/drivers/char/mem.c b/drivers/char/mem.c -index f814404..9afebb6 100644 ---- a/drivers/char/mem.c -+++ b/drivers/char/mem.c -@@ -741,6 +741,8 @@ static loff_t memory_lseek(struct file *file, loff_t offset, int orig) - - static int open_port(struct inode *inode, struct file *filp) - { -+ if (kernel_is_locked_down()) -+ return -EPERM; - return capable(CAP_SYS_RAWIO) ? 0 : -EPERM; - } - -- -2.7.4 +2.13.6 -From efd24f7e9af624b62f39efce4f60b31f0ca643d8 Mon Sep 17 00:00:00 2001 +From 2644bf492568e3733bc841112c6e8628a6e01b8e Mon Sep 17 00:00:00 2001 From: Matthew Garrett <matthew.garrett@nebula.com> -Date: Tue, 22 Nov 2016 08:46:17 +0000 -Subject: [PATCH 21/32] x86: Restrict MSR access when the kernel is locked down +Date: Wed, 24 May 2017 14:56:04 +0100 +Subject: [PATCH 12/26] x86/msr: Restrict MSR access when the kernel is locked + down Writing to MSRs should not be allowed if the kernel is locked down, since it could lead to execution of arbitrary code in kernel mode. Based on a patch by Kees Cook. -Cc: Kees Cook <keescook@chromium.org> +MSR accesses are logged for the purposes of building up a whitelist as per +Alan Cox's suggestion. + Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com> Signed-off-by: David Howells <dhowells@redhat.com> +Acked-by: Kees Cook <keescook@chromium.org> +Reviewed-by: Thomas Gleixner <tglx@linutronix.de> +Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com> +cc: x86@kernel.org --- - arch/x86/kernel/msr.c | 7 +++++++ - 1 file changed, 7 insertions(+) + arch/x86/kernel/msr.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) diff --git a/arch/x86/kernel/msr.c b/arch/x86/kernel/msr.c -index ef68880..fbcce02 100644 +index ef688804f80d..dfb61d358196 100644 --- a/arch/x86/kernel/msr.c +++ b/arch/x86/kernel/msr.c -@@ -84,6 +84,9 @@ static ssize_t msr_write(struct file *file, const char __user *buf, +@@ -84,6 +84,11 @@ static ssize_t msr_write(struct file *file, const char __user *buf, int err = 0; ssize_t bytes = 0; - -+ if (kernel_is_locked_down()) + ++ if (kernel_is_locked_down("Direct MSR access")) { ++ pr_info("Direct access to MSR %x\n", reg); + return -EPERM; ++ } + if (count % 8) return -EINVAL; /* Invalid chunk size */ - -@@ -131,6 +134,10 @@ static long msr_ioctl(struct file *file, unsigned int ioc, unsigned long arg) - err = -EBADF; + +@@ -135,6 +140,11 @@ static long msr_ioctl(struct file *file, unsigned int ioc, unsigned long arg) + err = -EFAULT; break; } -+ if (kernel_is_locked_down()) { ++ if (kernel_is_locked_down("Direct MSR access")) { ++ pr_info("Direct access to MSR %x\n", regs[1]); /* Display %ecx */ + err = -EPERM; + break; + } - if (copy_from_user(®s, uregs, sizeof regs)) { - err = -EFAULT; + err = wrmsr_safe_regs_on_cpu(cpu, regs); + if (err) break; -- -2.7.4 +2.13.6 -From 62ebdffbcb0726b98562e9f1173a6d5967755764 Mon Sep 17 00:00:00 2001 +From e6850fffe186e252cc94e8747e589076e215ca1a Mon Sep 17 00:00:00 2001 From: Matthew Garrett <matthew.garrett@nebula.com> -Date: Tue, 22 Nov 2016 08:46:16 +0000 -Subject: [PATCH 22/32] asus-wmi: Restrict debugfs interface when the kernel is +Date: Wed, 24 May 2017 14:56:04 +0100 +Subject: [PATCH 13/26] asus-wmi: Restrict debugfs interface when the kernel is locked down We have no way of validating what all of the Asus WMI methods do on a given @@ -985,51 +940,54 @@ kernel is locked down. Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com> Signed-off-by: David Howells <dhowells@redhat.com> +Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com> +cc: acpi4asus-user@lists.sourceforge.net +cc: platform-driver-x86@vger.kernel.org --- drivers/platform/x86/asus-wmi.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c -index 43cb680..9be3e08 100644 +index 48e1541dc8d4..ef5587469337 100644 --- a/drivers/platform/x86/asus-wmi.c +++ b/drivers/platform/x86/asus-wmi.c -@@ -1898,6 +1898,9 @@ static int show_dsts(struct seq_file *m, void *data) +@@ -1905,6 +1905,9 @@ static int show_dsts(struct seq_file *m, void *data) int err; u32 retval = -1; - -+ if (kernel_is_locked_down()) + ++ if (kernel_is_locked_down("Asus WMI")) + return -EPERM; + err = asus_wmi_get_devstate(asus, asus->debug.dev_id, &retval); - + if (err < 0) -@@ -1914,6 +1917,9 @@ static int show_devs(struct seq_file *m, void *data) +@@ -1921,6 +1924,9 @@ static int show_devs(struct seq_file *m, void *data) int err; u32 retval = -1; - -+ if (kernel_is_locked_down()) + ++ if (kernel_is_locked_down("Asus WMI")) + return -EPERM; + err = asus_wmi_set_devstate(asus->debug.dev_id, asus->debug.ctrl_param, &retval); - -@@ -1938,6 +1944,9 @@ static int show_call(struct seq_file *m, void *data) + +@@ -1945,6 +1951,9 @@ static int show_call(struct seq_file *m, void *data) union acpi_object *obj; acpi_status status; - -+ if (kernel_is_locked_down()) + ++ if (kernel_is_locked_down("Asus WMI")) + return -EPERM; + status = wmi_evaluate_method(ASUS_WMI_MGMT_GUID, - 1, asus->debug.method_id, + 0, asus->debug.method_id, &input, &output); -- -2.7.4 +2.13.6 -From 31f493d03dde1854fa9e540f87a751fbeeb41cb9 Mon Sep 17 00:00:00 2001 +From 6dda2a4dbc8bb80efaa55aba6d54382e986305c5 Mon Sep 17 00:00:00 2001 From: Matthew Garrett <matthew.garrett@nebula.com> -Date: Tue, 22 Nov 2016 08:46:16 +0000 -Subject: [PATCH 23/32] ACPI: Limit access to custom_method when the kernel is +Date: Wed, 24 May 2017 14:56:04 +0100 +Subject: [PATCH 14/26] ACPI: Limit access to custom_method when the kernel is locked down custom_method effectively allows arbitrary access to system memory, making @@ -1038,63 +996,68 @@ Disable it if the kernel is locked down. Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com> Signed-off-by: David Howells <dhowells@redhat.com> +Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com> +cc: linux-acpi@vger.kernel.org --- drivers/acpi/custom_method.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/acpi/custom_method.c b/drivers/acpi/custom_method.c -index c68e724..e4d721c 100644 +index c68e72414a67..b33fba70ec51 100644 --- a/drivers/acpi/custom_method.c +++ b/drivers/acpi/custom_method.c @@ -29,6 +29,9 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf, struct acpi_table_header table; acpi_status status; - -+ if (kernel_is_locked_down()) + ++ if (kernel_is_locked_down("ACPI custom methods")) + return -EPERM; + if (!(*ppos)) { /* parse the table header to get the table length */ if (count <= sizeof(struct acpi_table_header)) -- -2.7.4 +2.13.6 -From 1dec5dc62c78f78b9efe44aac3d6119d97b67017 Mon Sep 17 00:00:00 2001 +From 64caa33410f85663cf0a65e4c09b8b8d28a219ad Mon Sep 17 00:00:00 2001 From: Josh Boyer <jwboyer@redhat.com> -Date: Tue, 22 Nov 2016 08:46:16 +0000 -Subject: [PATCH 24/32] acpi: Ignore acpi_rsdp kernel param when the kernel has +Date: Wed, 24 May 2017 14:56:05 +0100 +Subject: [PATCH 15/26] acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down This option allows userspace to pass the RSDP address to the kernel, which -makes it possible for a user to circumvent any restrictions imposed on -loading modules. Ignore the option when the kernel is locked down. +makes it possible for a user to modify the workings of hardware . Reject +the option when the kernel is locked down. Signed-off-by: Josh Boyer <jwboyer@redhat.com> Signed-off-by: David Howells <dhowells@redhat.com> +Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com> +cc: Dave Young <dyoung@redhat.com> +cc: linux-acpi@vger.kernel.org --- drivers/acpi/osl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c -index db78d35..d4d4ba3 100644 +index db78d353bab1..36c6527c1b0a 100644 --- a/drivers/acpi/osl.c +++ b/drivers/acpi/osl.c @@ -192,7 +192,7 @@ acpi_physical_address __init acpi_os_get_root_pointer(void) acpi_physical_address pa = 0; - + #ifdef CONFIG_KEXEC - if (acpi_rsdp) -+ if (acpi_rsdp && !kernel_is_locked_down()) ++ if (acpi_rsdp && !kernel_is_locked_down("ACPI RSDP specification")) return acpi_rsdp; #endif - + -- -2.7.4 +2.13.6 -From 96eaf04100d7365d93f898013175351c7d2702a6 Mon Sep 17 00:00:00 2001 +From d87ce06969f2d4da0c864e8a4cf6c820d950cd1f Mon Sep 17 00:00:00 2001 From: Linn Crosetto <linn@hpe.com> -Date: Wed, 23 Nov 2016 13:32:27 +0000 -Subject: [PATCH 25/32] acpi: Disable ACPI table override if the kernel is +Date: Wed, 24 May 2017 14:56:05 +0100 +Subject: [PATCH 16/26] acpi: Disable ACPI table override if the kernel is locked down From the kernel documentation (initrd_table_override.txt): @@ -1109,19 +1072,21 @@ so do not allow ACPI tables to be overridden if the kernel is locked down. Signed-off-by: Linn Crosetto <linn@hpe.com> Signed-off-by: David Howells <dhowells@redhat.com> +Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com> +cc: linux-acpi@vger.kernel.org --- drivers/acpi/tables.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/acpi/tables.c b/drivers/acpi/tables.c -index 2604189..601096d 100644 +index 80ce2a7d224b..5cc13c42daf9 100644 --- a/drivers/acpi/tables.c +++ b/drivers/acpi/tables.c -@@ -542,6 +542,11 @@ void __init acpi_table_upgrade(void) +@@ -526,6 +526,11 @@ void __init acpi_table_upgrade(void) if (table_nr == 0) return; - -+ if (kernel_is_locked_down()) { + ++ if (kernel_is_locked_down("ACPI table override")) { + pr_notice("kernel is locked down, ignoring table override\n"); + return; + } @@ -1130,12 +1095,12 @@ index 2604189..601096d 100644 memblock_find_in_range(0, ACPI_TABLE_UPGRADE_MAX_PHYS, all_tables_size, PAGE_SIZE); -- -2.7.4 +2.13.6 -From 521979b819b853f7578ba8edef8b33bc2077026d Mon Sep 17 00:00:00 2001 +From 547e2ca9cbfd420a15dd70e1c1c24b7040f88058 Mon Sep 17 00:00:00 2001 From: Linn Crosetto <linn@hpe.com> -Date: Wed, 23 Nov 2016 13:39:41 +0000 -Subject: [PATCH 26/32] acpi: Disable APEI error injection if the kernel is +Date: Wed, 24 May 2017 14:56:05 +0100 +Subject: [PATCH 17/26] acpi: Disable APEI error injection if the kernel is locked down ACPI provides an error injection mechanism, EINJ, for debugging and testing @@ -1155,146 +1120,33 @@ the kernel is locked down. Signed-off-by: Linn Crosetto <linn@hpe.com> Signed-off-by: David Howells <dhowells@redhat.com> +Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com> +cc: linux-acpi@vger.kernel.org --- drivers/acpi/apei/einj.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/acpi/apei/einj.c b/drivers/acpi/apei/einj.c -index ec50c32..e082718 100644 +index b38737c83a24..6d71e1e97b20 100644 --- a/drivers/acpi/apei/einj.c +++ b/drivers/acpi/apei/einj.c @@ -518,6 +518,9 @@ static int einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2, int rc; u64 base_addr, size; - -+ if (kernel_is_locked_down()) + ++ if (kernel_is_locked_down("ACPI error injection")) + return -EPERM; + /* If user manually set "flags", make sure it is legal */ if (flags && (flags & ~(SETWA_FLAGS_APICID|SETWA_FLAGS_MEM|SETWA_FLAGS_PCIE_SBDF))) -- -2.7.4 - -From fe597dad1cba83345d62c4079c0d8861c426698c Mon Sep 17 00:00:00 2001 -From: Matthew Garrett <mjg59@coreos.com> -Date: Wed, 23 Nov 2016 13:41:23 +0000 -Subject: [PATCH 27/32] Enable cold boot attack mitigation - ---- - arch/x86/boot/compressed/eboot.c | 28 ++++++++++++++++++++++++++++ - 1 file changed, 28 insertions(+) - -diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c -index 801c7a1..ef9409b 100644 ---- a/arch/x86/boot/compressed/eboot.c -+++ b/arch/x86/boot/compressed/eboot.c -@@ -604,6 +604,31 @@ void setup_graphics(struct boot_params *boot_params) - } - } - -+#define MEMORY_ONLY_RESET_CONTROL_GUID \ -+ EFI_GUID (0xe20939be, 0x32d4, 0x41be, 0xa1, 0x50, 0x89, 0x7f, 0x85, 0xd4, 0x98, 0x29) -+ -+static void enable_reset_attack_mitigation(void) -+{ -+ static const efi_guid_t var_guid = MEMORY_ONLY_RESET_CONTROL_GUID; -+ static const efi_char16_t MemoryOverwriteRequestControl_name[] = { -+ 'M', 'e', 'm', 'o', 'r', 'y', -+ 'O', 'v', 'e', 'r', 'w', 'r', 'i', 't', 'e', -+ 'R', 'e', 'q', 'u', 'e', 's', 't', -+ 'C', 'o', 'n', 't', 'r', 'o', 'l', -+ 0 -+ }; -+ u8 val = 1; -+ -+ /* Ignore the return value here - there's not really a lot we can do */ -+ efi_call_runtime(set_variable, -+ (efi_char16_t *)MemoryOverwriteRequestControl_name, -+ (efi_guid_t *)&var_guid, -+ EFI_VARIABLE_NON_VOLATILE | -+ EFI_VARIABLE_BOOTSERVICE_ACCESS | -+ EFI_VARIABLE_RUNTIME_ACCESS, -+ sizeof(val), val); -+} -+ - /* - * Because the x86 boot code expects to be passed a boot_params we - * need to create one ourselves (usually the bootloader would create -@@ -988,6 +1013,9 @@ struct boot_params *efi_main(struct efi_config *c, - else - setup_boot_services32(efi_early); - -+ /* Ask the firmware to clear memory if we don't have a clean shutdown */ -+ enable_reset_attack_mitigation(); -+ - /* - * If the boot loader gave us a value for secure_boot then we use that, - * otherwise we ask the BIOS. --- -2.7.4 - -From 04fac895731801bc6cb26a6061f1c353c80a866c Mon Sep 17 00:00:00 2001 -From: "Lee, Chun-Yi" <jlee@suse.com> -Date: Wed, 23 Nov 2016 13:52:16 +0000 -Subject: [PATCH 28/32] bpf: Restrict kernel image access functions when the - kernel is locked down - -There are some bpf functions can be used to read kernel memory: -bpf_probe_read, bpf_probe_write_user and bpf_trace_printk. These allow -private keys in kernel memory (e.g. the hibernation image signing key) to -be read by an eBPF program. Prohibit those functions when the kernel is -locked down. - -Signed-off-by: Lee, Chun-Yi <jlee@suse.com> -Signed-off-by: David Howells <dhowells@redhat.com> ---- - kernel/trace/bpf_trace.c | 11 +++++++++++ - 1 file changed, 11 insertions(+) - -diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c -index cee9802..7fde851 100644 ---- a/kernel/trace/bpf_trace.c -+++ b/kernel/trace/bpf_trace.c -@@ -65,6 +65,11 @@ BPF_CALL_3(bpf_probe_read, void *, dst, u32, size, const void *, unsafe_ptr) - { - int ret; - -+ if (kernel_is_locked_down()) { -+ memset(dst, 0, size); -+ return -EPERM; -+ } -+ - ret = probe_kernel_read(dst, unsafe_ptr, size); - if (unlikely(ret < 0)) - memset(dst, 0, size); -@@ -84,6 +89,9 @@ static const struct bpf_func_proto bpf_probe_read_proto = { - BPF_CALL_3(bpf_probe_write_user, void *, unsafe_ptr, const void *, src, - u32, size) - { -+ if (kernel_is_locked_down()) -+ return -EPERM; -+ - /* - * Ensure we're in user context which is safe for the helper to - * run. This helper has no business in a kthread. -@@ -143,6 +151,9 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt, u32, fmt_size, u64, arg1, - if (fmt[--fmt_size] != 0) - return -EINVAL; - -+ if (kernel_is_locked_down()) -+ return __trace_printk(1, fmt, 0, 0, 0); -+ - /* check format string for allowed specifiers */ - for (i = 0; i < fmt_size; i++) { - if ((!isprint(fmt[i]) && !isspace(fmt[i])) || !isascii(fmt[i])) --- -2.7.4 +2.13.6 -From 707d0e14c2c0d6c3139ff4bcb16ee22c462b4304 Mon Sep 17 00:00:00 2001 +From abbf8de44feab5f50b316d6491926d8d9029cb49 Mon Sep 17 00:00:00 2001 From: David Howells <dhowells@redhat.com> -Date: Tue, 22 Nov 2016 10:10:34 +0000 -Subject: [PATCH 29/32] scsi: Lock down the eata driver +Date: Wed, 24 May 2017 14:56:06 +0100 +Subject: [PATCH 18/26] scsi: Lock down the eata driver When the kernel is running in secure boot mode, we lock down the kernel to prevent userspace from modifying the running kernel image. Whilst this @@ -1306,75 +1158,73 @@ The eata driver takes a single string parameter that contains a slew of settings, including hardware resource configuration. Prohibit use of the parameter if the kernel is locked down. -Suggested-by: One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> +Suggested-by: Alan Cox <gnomes@lxorguk.ukuu.org.uk> Signed-off-by: David Howells <dhowells@redhat.com> cc: Dario Ballabio <ballabio_dario@emc.com> cc: "James E.J. Bottomley" <jejb@linux.vnet.ibm.com> cc: "Martin K. Petersen" <martin.petersen@oracle.com> cc: linux-scsi@vger.kernel.org --- - drivers/scsi/eata.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) + drivers/scsi/eata.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/eata.c b/drivers/scsi/eata.c -index 227dd2c..5c036d10 100644 +index 6501c330d8c8..72fceaa8f3da 100644 --- a/drivers/scsi/eata.c +++ b/drivers/scsi/eata.c -@@ -1552,8 +1552,13 @@ static int eata2x_detect(struct scsi_host_template *tpnt) - +@@ -1552,8 +1552,11 @@ static int eata2x_detect(struct scsi_host_template *tpnt) + tpnt->proc_name = "eata2x"; - + - if (strlen(boot_options)) + if (strlen(boot_options)) { -+ if (kernel_is_locked_down()) { -+ pr_err("Command line-specified device addresses, irqs and dma channels are not permitted when the kernel is locked down\n"); ++ if (kernel_is_locked_down("Command line-specified device addresses, irqs and dma channels")) + return -EPERM; -+ } option_setup(boot_options); + } - + #if defined(MODULE) /* io_port could have been modified when loading as a module */ -- -2.7.4 +2.13.6 -From 07e05e0b7d806a05eba55092630bb75a92311344 Mon Sep 17 00:00:00 2001 +From 116b02dff661d497c10099862b8b86e6cd2262ae Mon Sep 17 00:00:00 2001 From: David Howells <dhowells@redhat.com> -Date: Fri, 25 Nov 2016 14:37:45 +0000 -Subject: [PATCH 30/32] Prohibit PCMCIA CIS storage when the kernel is locked +Date: Wed, 24 May 2017 14:56:06 +0100 +Subject: [PATCH 19/26] Prohibit PCMCIA CIS storage when the kernel is locked down Prohibit replacement of the PCMCIA Card Information Structure when the kernel is locked down. +Suggested-by: Dominik Brodowski <linux@dominikbrodowski.net> Signed-off-by: David Howells <dhowells@redhat.com> +cc: linux-pcmcia@lists.infradead.org --- - drivers/pcmcia/cistpl.c | 5 +++++ - 1 file changed, 5 insertions(+) + drivers/pcmcia/cistpl.c | 3 +++ + 1 file changed, 3 insertions(+) diff --git a/drivers/pcmcia/cistpl.c b/drivers/pcmcia/cistpl.c -index 55ef7d1..193e4f7 100644 +index 55ef7d1fd8da..b7a0e42eeb25 100644 --- a/drivers/pcmcia/cistpl.c +++ b/drivers/pcmcia/cistpl.c -@@ -1578,6 +1578,11 @@ static ssize_t pccard_store_cis(struct file *filp, struct kobject *kobj, +@@ -1578,6 +1578,9 @@ static ssize_t pccard_store_cis(struct file *filp, struct kobject *kobj, struct pcmcia_socket *s; int error; - -+ if (kernel_is_locked_down()) { -+ pr_err("Direct CIS storage isn't permitted when the kernel is locked down\n"); + ++ if (kernel_is_locked_down("Direct PCMCIA CIS storage")) + return -EPERM; -+ } + s = to_socket(container_of(kobj, struct device, kobj)); - + if (off) -- -2.7.4 +2.13.6 -From cf1e877adbe35c5f72a9d85570b494aa3f35be6a Mon Sep 17 00:00:00 2001 +From f3dc03aa368cfde123bc1b60bda287091c9d43b4 Mon Sep 17 00:00:00 2001 From: David Howells <dhowells@redhat.com> -Date: Wed, 7 Dec 2016 10:28:39 +0000 -Subject: [PATCH 31/32] Lock down TIOCSSERIAL +Date: Wed, 24 May 2017 14:56:06 +0100 +Subject: [PATCH 20/26] Lock down TIOCSSERIAL Lock down TIOCSSERIAL as that can be used to change the ioport and irq settings on a serial port. This only appears to be an issue for the serial @@ -1383,20 +1233,21 @@ ignore attempts to change port/irq or give an error. Reported-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: David Howells <dhowells@redhat.com> +cc: Jiri Slaby <jslaby@suse.com> --- drivers/tty/serial/serial_core.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c -index 9939c3d..7c040e2 100644 +index 3a14cccbd7ff..41f0922ad842 100644 --- a/drivers/tty/serial/serial_core.c +++ b/drivers/tty/serial/serial_core.c -@@ -820,6 +820,12 @@ static int uart_set_info(struct tty_struct *tty, struct tty_port *port, - new_flags = new_info->flags; +@@ -842,6 +842,12 @@ static int uart_set_info(struct tty_struct *tty, struct tty_port *port, + new_flags = (__force upf_t)new_info->flags; old_custom_divisor = uport->custom_divisor; - -+ if ((change_port || change_irq) && kernel_is_locked_down()) { -+ pr_err("Using TIOCSSERIAL to change device addresses, irqs and dma channels is not permitted when the kernel is locked down\n"); + ++ if ((change_port || change_irq) && ++ kernel_is_locked_down("Using TIOCSSERIAL to change device addresses, irqs and dma channels")) { + retval = -EPERM; + goto exit; + } @@ -1405,5 +1256,457 @@ index 9939c3d..7c040e2 100644 retval = -EPERM; if (change_irq || change_port || -- -2.7.4 +2.13.6 + +From 9d266defc89a73c6dcca3b67ad70b95ac99b8e53 Mon Sep 17 00:00:00 2001 +From: David Howells <dhowells@redhat.com> +Date: Wed, 24 May 2017 14:56:06 +0100 +Subject: [PATCH 21/26] Lock down module params that specify hardware + parameters (eg. ioport) + +Provided an annotation for module parameters that specify hardware +parameters (such as io ports, iomem addresses, irqs, dma channels, fixed +dma buffers and other types). + +Suggested-by: Alan Cox <gnomes@lxorguk.ukuu.org.uk> +Signed-off-by: David Howells <dhowells@redhat.com> +--- + kernel/params.c | 26 +++++++++++++++++++++----- + 1 file changed, 21 insertions(+), 5 deletions(-) + +diff --git a/kernel/params.c b/kernel/params.c +index 60b2d8101355..422979adb60a 100644 +--- a/kernel/params.c ++++ b/kernel/params.c +@@ -108,13 +108,19 @@ bool parameq(const char *a, const char *b) + return parameqn(a, b, strlen(a)+1); + } + +-static void param_check_unsafe(const struct kernel_param *kp) ++static bool param_check_unsafe(const struct kernel_param *kp, ++ const char *doing) + { + if (kp->flags & KERNEL_PARAM_FL_UNSAFE) { + pr_warn("Setting dangerous option %s - tainting kernel\n", + kp->name); + add_taint(TAINT_USER, LOCKDEP_STILL_OK); + } ++ ++ if (kp->flags & KERNEL_PARAM_FL_HWPARAM && ++ kernel_is_locked_down("Command line-specified device addresses, irqs and dma channels")) ++ return false; ++ return true; + } + + static int parse_one(char *param, +@@ -144,8 +150,10 @@ static int parse_one(char *param, + pr_debug("handling %s with %p\n", param, + params[i].ops->set); + kernel_param_lock(params[i].mod); +- param_check_unsafe(¶ms[i]); +- err = params[i].ops->set(val, ¶ms[i]); ++ if (param_check_unsafe(¶ms[i], doing)) ++ err = params[i].ops->set(val, ¶ms[i]); ++ else ++ err = -EPERM; + kernel_param_unlock(params[i].mod); + return err; + } +@@ -556,6 +564,12 @@ static ssize_t param_attr_show(struct module_attribute *mattr, + return count; + } + ++#ifdef CONFIG_MODULES ++#define mod_name(mod) (mod)->name ++#else ++#define mod_name(mod) "unknown" ++#endif ++ + /* sysfs always hands a nul-terminated string in buf. We rely on that. */ + static ssize_t param_attr_store(struct module_attribute *mattr, + struct module_kobject *mk, +@@ -568,8 +582,10 @@ static ssize_t param_attr_store(struct module_attribute *mattr, + return -EPERM; + + kernel_param_lock(mk->mod); +- param_check_unsafe(attribute->param); +- err = attribute->param->ops->set(buf, attribute->param); ++ if (param_check_unsafe(attribute->param, mod_name(mk->mod))) ++ err = attribute->param->ops->set(buf, attribute->param); ++ else ++ err = -EPERM; + kernel_param_unlock(mk->mod); + if (!err) + return len; +-- +2.13.6 + +From 17a8caed6507846edd0a7016cdcd97fe46cca263 Mon Sep 17 00:00:00 2001 +From: David Howells <dhowells@redhat.com> +Date: Wed, 24 May 2017 14:56:07 +0100 +Subject: [PATCH 22/26] x86/mmiotrace: Lock down the testmmiotrace module + +The testmmiotrace module shouldn't be permitted when the kernel is locked +down as it can be used to arbitrarily read and write MMIO space. + +Suggested-by: Thomas Gleixner <tglx@linutronix.de> +Signed-off-by: David Howells <dhowells@redhat.com +cc: Thomas Gleixner <tglx@linutronix.de> +cc: Steven Rostedt <rostedt@goodmis.org> +cc: Ingo Molnar <mingo@kernel.org> +cc: "H. Peter Anvin" <hpa@zytor.com> +cc: x86@kernel.org +--- + arch/x86/mm/testmmiotrace.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/x86/mm/testmmiotrace.c b/arch/x86/mm/testmmiotrace.c +index f6ae6830b341..bbaad357f5d7 100644 +--- a/arch/x86/mm/testmmiotrace.c ++++ b/arch/x86/mm/testmmiotrace.c +@@ -115,6 +115,9 @@ static int __init init(void) + { + unsigned long size = (read_far) ? (8 << 20) : (16 << 10); + ++ if (kernel_is_locked_down("MMIO trace testing")) ++ return -EPERM; ++ + if (mmio_address == 0) { + pr_err("you have to use the module argument mmio_address.\n"); + pr_err("DO NOT LOAD THIS MODULE UNLESS YOU REALLY KNOW WHAT YOU ARE DOING!\n"); +-- +2.13.6 + +From 79ae67bf5f7eda526abaa80b01b19e08c1ed3558 Mon Sep 17 00:00:00 2001 +From: David Howells <dhowells@redhat.com> +Date: Wed, 18 Oct 2017 17:28:02 +0100 +Subject: [PATCH 23/26] debugfs: Disallow use of debugfs files when the kernel + is locked down + +Disallow opening of debugfs files when the kernel is locked down as various +drivers give raw access to hardware through debugfs. + +Accesses to tracefs should use /sys/kernel/tracing/ rather than +/sys/kernel/debug/tracing/. Possibly a symlink should be emplaced. + +Normal device interaction should be done through configfs or a miscdev, not +debugfs. + +Note that this makes it unnecessary to specifically lock down show_dsts(), +show_devs() and show_call() in the asus-wmi driver. + +Signed-off-by: David Howells <dhowells@redhat.com> +cc: Andy Shevchenko <andy.shevchenko@gmail.com> +cc: acpi4asus-user@lists.sourceforge.net +cc: platform-driver-x86@vger.kernel.org +cc: Matthew Garrett <matthew.garrett@nebula.com> +cc: Thomas Gleixner <tglx@linutronix.de> +--- + fs/debugfs/file.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c +index 6dabc4a10396..32b5168a7e91 100644 +--- a/fs/debugfs/file.c ++++ b/fs/debugfs/file.c +@@ -103,6 +103,9 @@ static int open_proxy_open(struct inode *inode, struct file *filp) + const struct file_operations *real_fops = NULL; + int srcu_idx, r; + ++ if (kernel_is_locked_down("debugfs")) ++ return -EPERM; ++ + r = debugfs_use_file_start(dentry, &srcu_idx); + if (r) { + r = -ENOENT; +@@ -232,6 +235,9 @@ static int full_proxy_open(struct inode *inode, struct file *filp) + struct file_operations *proxy_fops = NULL; + int srcu_idx, r; + ++ if (kernel_is_locked_down("debugfs")) ++ return -EPERM; ++ + r = debugfs_use_file_start(dentry, &srcu_idx); + if (r) { + r = -ENOENT; +-- +2.13.6 + +From 87ed5c02f0946c855730420cbf1daa6a2dfc54d7 Mon Sep 17 00:00:00 2001 +From: David Howells <dhowells@redhat.com> +Date: Thu, 19 Oct 2017 13:58:19 +0100 +Subject: [PATCH 24/26] Lock down /proc/kcore + +Disallow access to /proc/kcore when the kernel is locked down to prevent +access to cryptographic data. + +Signed-off-by: David Howells <dhowells@redhat.com> +Reviewed-by: James Morris <james.l.morris@oracle.com> +--- + fs/proc/kcore.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c +index 45629f4b5402..176cf749e650 100644 +--- a/fs/proc/kcore.c ++++ b/fs/proc/kcore.c +@@ -549,6 +549,8 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos) + + static int open_kcore(struct inode *inode, struct file *filp) + { ++ if (kernel_is_locked_down("/proc/kcore")) ++ return -EPERM; + if (!capable(CAP_SYS_RAWIO)) + return -EPERM; + +-- +2.13.6 + +From 2bce9ca3a24e0b35dcf665e6ba082f0a796c6aad Mon Sep 17 00:00:00 2001 +From: David Howells <dhowells@redhat.com> +Date: Thu, 19 Oct 2017 14:18:53 +0100 +Subject: [PATCH 25/26] efi: Add an EFI_SECURE_BOOT flag to indicate secure + boot mode + +UEFI machines can be booted in Secure Boot mode. Add an EFI_SECURE_BOOT +flag that can be passed to efi_enabled() to find out whether secure boot is +enabled. + +Move the switch-statement in x86's setup_arch() that inteprets the +secure_boot boot parameter to generic code and set the bit there. + +Suggested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> +Signed-off-by: David Howells <dhowells@redhat.com> +Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> +cc: linux-efi@vger.kernel.org +--- + arch/x86/kernel/setup.c | 14 +------------- + drivers/firmware/efi/Makefile | 1 + + drivers/firmware/efi/secureboot.c | 38 ++++++++++++++++++++++++++++++++++++++ + include/linux/efi.h | 16 ++++++++++------ + 4 files changed, 50 insertions(+), 19 deletions(-) + create mode 100644 drivers/firmware/efi/secureboot.c + +diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c +index 0957dd73d127..7c2162f9e769 100644 +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -1197,19 +1197,7 @@ void __init setup_arch(char **cmdline_p) + /* Allocate bigger log buffer */ + setup_log_buf(1); + +- if (efi_enabled(EFI_BOOT)) { +- switch (boot_params.secure_boot) { +- case efi_secureboot_mode_disabled: +- pr_info("Secure boot disabled\n"); +- break; +- case efi_secureboot_mode_enabled: +- pr_info("Secure boot enabled\n"); +- break; +- default: +- pr_info("Secure boot could not be determined\n"); +- break; +- } +- } ++ efi_set_secure_boot(boot_params.secure_boot); + + reserve_initrd(); + +diff --git a/drivers/firmware/efi/Makefile b/drivers/firmware/efi/Makefile +index 0329d319d89a..883f9f7eefc6 100644 +--- a/drivers/firmware/efi/Makefile ++++ b/drivers/firmware/efi/Makefile +@@ -23,6 +23,7 @@ obj-$(CONFIG_EFI_FAKE_MEMMAP) += fake_mem.o + obj-$(CONFIG_EFI_BOOTLOADER_CONTROL) += efibc.o + obj-$(CONFIG_EFI_TEST) += test/ + obj-$(CONFIG_EFI_DEV_PATH_PARSER) += dev-path-parser.o ++obj-$(CONFIG_EFI) += secureboot.o + obj-$(CONFIG_APPLE_PROPERTIES) += apple-properties.o + + arm-obj-$(CONFIG_EFI) := arm-init.o arm-runtime.o +diff --git a/drivers/firmware/efi/secureboot.c b/drivers/firmware/efi/secureboot.c +new file mode 100644 +index 000000000000..9070055de0a1 +--- /dev/null ++++ b/drivers/firmware/efi/secureboot.c +@@ -0,0 +1,38 @@ ++/* Core kernel secure boot support. ++ * ++ * Copyright (C) 2017 Red Hat, Inc. All Rights Reserved. ++ * Written by David Howells (dhowells@redhat.com) ++ * ++ * This program is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU General Public Licence ++ * as published by the Free Software Foundation; either version ++ * 2 of the Licence, or (at your option) any later version. ++ */ ++ ++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt ++ ++#include <linux/efi.h> ++#include <linux/kernel.h> ++#include <linux/printk.h> ++ ++/* ++ * Decide what to do when UEFI secure boot mode is enabled. ++ */ ++void __init efi_set_secure_boot(enum efi_secureboot_mode mode) ++{ ++ if (efi_enabled(EFI_BOOT)) { ++ switch (mode) { ++ case efi_secureboot_mode_disabled: ++ pr_info("Secure boot disabled\n"); ++ break; ++ case efi_secureboot_mode_enabled: ++ set_bit(EFI_SECURE_BOOT, &efi.flags); ++ pr_info("Secure boot enabled\n"); ++ break; ++ default: ++ pr_warning("Secure boot could not be determined (mode %u)\n", ++ mode); ++ break; ++ } ++ } ++} +diff --git a/include/linux/efi.h b/include/linux/efi.h +index 66f4a4e79f4b..7c7a7e33e4d1 100644 +--- a/include/linux/efi.h ++++ b/include/linux/efi.h +@@ -1103,6 +1103,14 @@ extern int __init efi_setup_pcdp_console(char *); + #define EFI_DBG 8 /* Print additional debug info at runtime */ + #define EFI_NX_PE_DATA 9 /* Can runtime data regions be mapped non-executable? */ + #define EFI_MEM_ATTR 10 /* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */ ++#define EFI_SECURE_BOOT 11 /* Are we in Secure Boot mode? */ ++ ++enum efi_secureboot_mode { ++ efi_secureboot_mode_unset, ++ efi_secureboot_mode_unknown, ++ efi_secureboot_mode_disabled, ++ efi_secureboot_mode_enabled, ++}; + + #ifdef CONFIG_EFI + /* +@@ -1115,6 +1123,7 @@ static inline bool efi_enabled(int feature) + extern void efi_reboot(enum reboot_mode reboot_mode, const char *__unused); + + extern bool efi_is_table_address(unsigned long phys_addr); ++extern void __init efi_set_secure_boot(enum efi_secureboot_mode mode); + #else + static inline bool efi_enabled(int feature) + { +@@ -1133,6 +1142,7 @@ static inline bool efi_is_table_address(unsigned long phys_addr) + { + return false; + } ++static inline void efi_set_secure_boot(enum efi_secureboot_mode mode) {} + #endif + + extern int efi_status_to_err(efi_status_t status); +@@ -1518,12 +1528,6 @@ efi_status_t efi_setup_gop(efi_system_table_t *sys_table_arg, + bool efi_runtime_disabled(void); + extern void efi_call_virt_check_flags(unsigned long flags, const char *call); + +-enum efi_secureboot_mode { +- efi_secureboot_mode_unset, +- efi_secureboot_mode_unknown, +- efi_secureboot_mode_disabled, +- efi_secureboot_mode_enabled, +-}; + enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table); + + #ifdef CONFIG_RESET_ATTACK_MITIGATION +-- +2.13.6 + +From 163d6a313399a4d50c5c7e42e3dd642ca8d495d7 Mon Sep 17 00:00:00 2001 +From: David Howells <dhowells@redhat.com> +Date: Thu, 19 Oct 2017 14:05:02 +0100 +Subject: [PATCH 26/26] efi: Lock down the kernel if booted in secure boot mode + +UEFI Secure Boot provides a mechanism for ensuring that the firmware will +only load signed bootloaders and kernels. Certain use cases may also +require that all kernel modules also be signed. Add a configuration option +that to lock down the kernel - which includes requiring validly signed +modules - if the kernel is secure-booted. + +Signed-off-by: David Howells <dhowells@redhat.com> +Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> +cc: linux-efi@vger.kernel.org +--- + arch/x86/kernel/setup.c | 6 ++++-- + security/Kconfig | 14 ++++++++++++++ + security/lock_down.c | 1 + + 3 files changed, 19 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c +index 7c2162f9e769..4e38327efb2e 100644 +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -64,6 +64,7 @@ + #include <linux/dma-mapping.h> + #include <linux/ctype.h> + #include <linux/uaccess.h> ++#include <linux/security.h> + + #include <linux/percpu.h> + #include <linux/crash_dump.h> +@@ -1039,6 +1040,9 @@ void __init setup_arch(char **cmdline_p) + if (efi_enabled(EFI_BOOT)) + efi_init(); + ++ efi_set_secure_boot(boot_params.secure_boot); ++ init_lockdown(); ++ + dmi_scan_machine(); + dmi_memdev_walk(); + dmi_set_dump_stack_arch_desc(); +@@ -1197,8 +1201,6 @@ void __init setup_arch(char **cmdline_p) + /* Allocate bigger log buffer */ + setup_log_buf(1); + +- efi_set_secure_boot(boot_params.secure_boot); +- + reserve_initrd(); + + acpi_table_upgrade(); +diff --git a/security/Kconfig b/security/Kconfig +index 453cc89c198a..974731ac4f85 100644 +--- a/security/Kconfig ++++ b/security/Kconfig +@@ -220,6 +220,20 @@ config ALLOW_LOCKDOWN_LIFT_BY_SYSRQ + Allow the lockdown on a kernel to be lifted, by pressing a SysRq key + combination on a wired keyboard. + ++config LOCK_DOWN_IN_EFI_SECURE_BOOT ++ bool "Lock down the kernel in EFI Secure Boot mode" ++ default n ++ select LOCK_DOWN_KERNEL ++ depends on EFI ++ help ++ UEFI Secure Boot provides a mechanism for ensuring that the firmware ++ will only load signed bootloaders and kernels. Secure boot mode may ++ be determined from EFI variables provided by the system firmware if ++ not indicated by the boot parameters. ++ ++ Enabling this option turns on results in kernel lockdown being ++ triggered if EFI Secure Boot is set. ++ + + source security/selinux/Kconfig + source security/smack/Kconfig +diff --git a/security/lock_down.c b/security/lock_down.c +index 2c6b00f0c229..527f7e51dc8d 100644 +--- a/security/lock_down.c ++++ b/security/lock_down.c +@@ -12,6 +12,7 @@ + #include <linux/security.h> + #include <linux/export.h> + #include <linux/sysrq.h> ++#include <linux/efi.h> + #include <asm/setup.h> + + #ifdef CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ +-- +2.13.6 |