linux-kernel - [PATCH 4/4] module: Allow to upgrade to validity enforcement in unforced mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu,  1 Mar 2018 17:09:06 +0800
From:   Jia Zhang <zhang.jia@...ux.alibaba.com>
To:     jeyu@...nel.org
Cc:     zhang.jia@...ux.alibaba.com, linux-kernel@...r.kernel.org
Subject: [PATCH 4/4] module: Allow to upgrade to validity enforcement in unforced mode

If module signature verification check is enabled but the
validity enforcement is configured to be disabled, it should
be allowed to enable it. Once enabled, it is disallowed to
disable it.

Signed-off-by: Jia Zhang <zhang.jia@...ux.alibaba.com>
---
 kernel/module.c | 39 ++++++++++++++++++++++++++++++++++++---
 1 file changed, 36 insertions(+), 3 deletions(-)

diff --git a/kernel/module.c b/kernel/module.c
index e3c6c8e..89704df 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2806,8 +2806,37 @@ static ssize_t modsign_enforce_read(struct file *filp, char __user *ubuf,
 	return simple_read_from_buffer(ubuf, count, offp, buf, 1);
 }
 
+#ifndef CONFIG_MODULE_SIG_FORCE
+static ssize_t modsign_enforce_write(struct file *filp,
+				     const char __user *ubuf,
+				     size_t count, loff_t *offp)
+{
+	char buf;
+	ssize_t ret;
+
+	if (*offp > 1)
+		return -EFBIG;
+
+	ret = simple_write_to_buffer(&buf, 1, offp, ubuf, count);
+	if (ret > 0) {
+		if (buf != '1')
+			return -EINVAL;
+
+		sig_enforce = true;
+		pr_notice_once("Kernel module validity enforcement enabled\n");
+
+		ret = count;
+	}
+
+	return ret;
+}
+#endif
+
 static const struct file_operations modsign_enforce_ops = {
 	.read = modsign_enforce_read,
+#ifndef CONFIG_MODULE_SIG_FORCE
+	.write = modsign_enforce_write,
+#endif
 	.llseek = generic_file_llseek,
 };
 
@@ -2815,14 +2844,18 @@ static int __init securityfs_init(void)
 {
 	struct dentry *modsign_dir;
 	struct dentry *enforce;
+	umode_t mode;
 
 	modsign_dir = securityfs_create_dir("modsign", NULL);
 	if (IS_ERR(modsign_dir))
 		return -1;
 
-	enforce = securityfs_create_file("enforce",
-					 S_IRUSR | S_IRGRP, modsign_dir,
-					 NULL, &modsign_enforce_ops);
+	mode = S_IRUSR | S_IRGRP;
+	if (!sig_enforce)
+		mode |= S_IWUSR;
+
+	enforce = securityfs_create_file("enforce", mode, modsign_dir, NULL,
+					 &modsign_enforce_ops);
 	if (IS_ERR(enforce))
 		goto out;
 
-- 
1.8.3.1