linux-kernel - Re: [PATCH] LSM: ModPin LSM for module loading restrictions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20131003213625.GH5729@outflux.net>
Date:	Thu, 3 Oct 2013 14:36:25 -0700
From:	Kees Cook <kees@...flux.net>
To:	Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
Cc:	keescook@...omium.org, jmorris@...ei.org,
	linux-kernel@...r.kernel.org, james.l.morris@...cle.com,
	casey@...aufler-ca.com, linux-security-module@...r.kernel.org,
	rusty@...tcorp.com.au
Subject: Re: [PATCH] LSM: ModPin LSM for module loading restrictions

On Fri, Oct 04, 2013 at 06:31:42AM +0900, Tetsuo Handa wrote:
> Kees Cook wrote:
> > +static int modpin_load_module(struct file *file)
> > +{
> > +   struct dentry *module_root;
> > +
> > +   if (!file) {
> > +           if (!modpin_enforced) {
> > +                   report_load_module(NULL, "old-api-pinning-ignored");
> > +                   return 0;
> > +           }
> > +
> > +           report_load_module(NULL, "old-api-denied");
> > +           return -EPERM;
> > +   }
> > +
> > +   module_root = file->f_path.mnt->mnt_root;
> > +
> > +   /* First loaded module defines the root for all others. */
> > +   spin_lock(&pinned_root_spinlock);
> > +   if (!pinned_root) {
> > +           pinned_root = dget(module_root);
> > +           /*
> > +            * Unlock now since it's only pinned_root we care about.
> > +            * In the worst case, we will (correctly) report pinning
> > +            * failures before we have announced that pinning is
> > +            * enabled. This would be purely cosmetic.
> > +            */
> > +           spin_unlock(&pinned_root_spinlock);
> > +           check_pinning_enforcement();
> > +           report_load_module(&file->f_path, "pinned");
> > +           return 0;
> > +   }
> > +   spin_unlock(&pinned_root_spinlock);
> 
> Firstly loaded module is usually in initramfs whereas subsequently loaded
> modules are usually on a hard disk partition.
> 
> This module is not meant for PC servers, is it?

This LSM is what Chrome OS uses for the module pinning logic. We do not use
an initramfs. This LSM could also be used for devices booting entirely from
CDROM or other R/O media.

I'm open to improvements, obviously. I imagine things like delayed
activation, where the initramfs triggers pinning in some way once it is
done loading modules from its filesystem, etc. But since I don't have any
real life examples of this, I'm writing the LSM as it currently is, used
without an initramfs. :)

-Kees

-- 
Kees Cook                                            @outflux.net
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/