linux-kernel - Re: [PATCH 20/24] bpf: Restrict kernel image access functions when the kernel is locked down

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 13 Apr 2017 09:46:18 +0100
From:   David Howells <dhowells@...hat.com>
To:     Alexei Starovoitov <alexei.starovoitov@...il.com>
Cc:     dhowells@...hat.com, linux-kernel@...r.kernel.org,
        linux-efi@...r.kernel.org, gnomes@...rguk.ukuu.org.uk,
        netdev@...r.kernel.org, Chun-Yi Lee <jlee@...e.com>,
        linux-security-module@...r.kernel.org, keyrings@...r.kernel.org,
        gregkh@...uxfoundation.org, matthew.garrett@...ula.com
Subject: Re: [PATCH 20/24] bpf: Restrict kernel image access functions when the kernel is locked down

Alexei Starovoitov <alexei.starovoitov@...il.com> wrote:

> this will obviously break the program.

Yeah.  But if it allows one to twiddle the kernel image or gain access to
crypto material...

> How about disabling loading tracing programs during the lockdown completely?

Interesting thought.  I'm not sure how much would actually need locking down
here.  Turning on tracepoints in the kernel and reading out of the trace
buffer, for example, ought to be okay, though if there are any tracepoints
that leak crypto information, they may need locking down also.

Basically, I think it boils down to: if it can be used to modify the kernel
image or read arbitrary data from the kernel image then should probably be
forbidden.  There have to be exceptions, though, such as loading authenticated
kernel modules.

David