| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 25 Jun 2014 13:06:58 +0200
From: Jiri Slaby <jslaby@...e.cz>
To: linux-kernel@...r.kernel.org
Cc: tj@...nel.org, rostedt@...dmis.org, mingo@...hat.com,
akpm@...ux-foundation.org, andi@...stfloor.org,
paulmck@...ux.vnet.ibm.com, pavel@....cz, jirislaby@...il.com,
Vojtech Pavlik <vojtech@...e.cz>, Michael Matz <matz@...e.de>,
Jiri Kosina <jkosina@...e.cz>, Jiri Slaby <jslaby@...e.cz>,
Frederic Weisbecker <fweisbec@...il.com>
Subject: [PATCH -repost 04/21] kgr: add testing kgraft patch
This is intended to be a presentation of the kGraft engine, so it is
placed into samples/ directory.
It patches two chosen functions sys_iopl() and sys_capable() to print
a message in addition to the original functionality.
js: fix filename in Makefile (thanks mmarek)
Signed-off-by: Jiri Kosina <jkosina@...e.cz>
Signed-off-by: Jiri Slaby <jslaby@...e.cz>
Cc: Steven Rostedt <rostedt@...dmis.org>
Cc: Frederic Weisbecker <fweisbec@...il.com>
Cc: Ingo Molnar <mingo@...hat.com>
---
samples/Kconfig | 4 ++
samples/Makefile | 3 +-
samples/kgraft/Makefile | 1 +
samples/kgraft/kgraft_patcher.c | 92 +++++++++++++++++++++++++++++++++++++++++
4 files changed, 99 insertions(+), 1 deletion(-)
create mode 100644 samples/kgraft/Makefile
create mode 100644 samples/kgraft/kgraft_patcher.c
diff --git a/samples/Kconfig b/samples/Kconfig
index 6181c2cc9ca0..b33a397dfc58 100644
--- a/samples/Kconfig
+++ b/samples/Kconfig
@@ -55,6 +55,10 @@ config SAMPLE_KDB
Build an example of how to dynamically add the hello
command to the kdb shell.
+config SAMPLE_KGRAFT_PATCHER
+ tristate "Build kGraft patcher example -- loadable modules only"
+ depends on KGRAFT && m
+
config SAMPLE_RPMSG_CLIENT
tristate "Build rpmsg client sample -- loadable modules only"
depends on RPMSG && m
diff --git a/samples/Makefile b/samples/Makefile
index 1a60c62e2045..a0d1626bd5bb 100644
--- a/samples/Makefile
+++ b/samples/Makefile
@@ -1,4 +1,5 @@
# Makefile for Linux samples code
obj-$(CONFIG_SAMPLES) += kobject/ kprobes/ trace_events/ \
- hw_breakpoint/ kfifo/ kdb/ hidraw/ rpmsg/ seccomp/
+ hw_breakpoint/ kfifo/ kdb/ kgraft/ \
+ hidraw/ rpmsg/ seccomp/
diff --git a/samples/kgraft/Makefile b/samples/kgraft/Makefile
new file mode 100644
index 000000000000..888a332c3148
--- /dev/null
+++ b/samples/kgraft/Makefile
@@ -0,0 +1 @@
+obj-$(CONFIG_SAMPLE_KGRAFT_PATCHER) += kgraft_patcher.o
diff --git a/samples/kgraft/kgraft_patcher.c b/samples/kgraft/kgraft_patcher.c
new file mode 100644
index 000000000000..abb0c05bf739
--- /dev/null
+++ b/samples/kgraft/kgraft_patcher.c
@@ -0,0 +1,92 @@
+/*
+ * kgraft_patcher -- just kick the kGraft infrastructure for test
+ *
+ * We patch two (arbitrarily chosen) functions at once...
+ *
+ * Copyright (c) 2013-2014 SUSE
+ * Authors: Jiri Kosina
+ * Vojtech Pavlik
+ * Jiri Slaby
+ */
+
+/*
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/kgraft.h>
+#include <linux/kallsyms.h>
+#include <linux/sched.h>
+#include <linux/types.h>
+#include <linux/capability.h>
+#include <linux/ptrace.h>
+
+#include <asm/processor.h>
+
+/*
+ * This all should be autogenerated from the patched sources
+ */
+
+asmlinkage long kgr_new_sys_iopl(unsigned int level)
+{
+ struct pt_regs *regs = current_pt_regs();
+ unsigned int old = (regs->flags >> 12) & 3;
+ struct thread_struct *t = ¤t->thread;
+
+ printk(KERN_DEBUG "kgr-patcher: this is a new sys_iopl()\n");
+
+ if (level > 3)
+ return -EINVAL;
+ /* Trying to gain more privileges? */
+ if (level > old) {
+ if (!capable(CAP_SYS_RAWIO))
+ return -EPERM;
+ }
+ regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | (level << 12);
+ t->iopl = level << 12;
+ set_iopl_mask(t->iopl);
+
+ return 0;
+}
+KGR_PATCHED_FUNCTION(SyS_iopl, kgr_new_sys_iopl);
+
+static bool new_capable(int cap)
+{
+ printk(KERN_DEBUG "kgr-patcher: this is a new capable()\n");
+
+ return ns_capable(&init_user_ns, cap);
+}
+KGR_PATCHED_FUNCTION(capable, new_capable);
+
+static const struct kgr_patch patch = {
+ .patches = {
+ KGR_PATCH(SyS_iopl),
+ KGR_PATCH(capable),
+ KGR_PATCH_END
+ }
+};
+
+static int __init kgr_patcher_init(void)
+{
+ /* removing not supported */
+ __module_get(THIS_MODULE);
+ kgr_start_patching(&patch);
+ return 0;
+}
+
+static void __exit kgr_patcher_cleanup(void)
+{
+ /* extra care needs to be taken when freeing ftrace_ops->private */
+ pr_err("removing now buggy!\n");
+}
+
+module_init(kgr_patcher_init);
+module_exit(kgr_patcher_cleanup);
+
+MODULE_LICENSE("GPL");
+
--
2.0.0
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists