linux-kernel - [RFC][PATCH] Lock down kprobes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <14323.1510158093@warthog.procyon.org.uk>
Date:   Wed, 08 Nov 2017 16:21:33 +0000
From:   David Howells <dhowells@...hat.com>
To:     Ananth N Mavinakayanahalli <ananth@...ux.vnet.ibm.com>,
        Anil S Keshavamurthy <anil.s.keshavamurthy@...el.com>,
        "David S. Miller" <davem@...emloft.net>,
        Masami Hiramatsu <mhiramat@...nel.org>
cc:     dhowells@...hat.com, linux-security-module@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: [RFC][PATCH] Lock down kprobes

Hi,

I need to lock down kprobes under secure boot conditions as part of the patch
series that can be found here:

	https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/log/?h=efi-lock-down

Can you tell me that if the attached patch is sufficient to the cause?

---
commit 9b736b76fbd7b23b54b4340e80c66f87df54016c
Author: David Howells <dhowells@...hat.com>
Date:   Wed Nov 8 16:14:12 2017 +0000

    Lock down kprobes
    
    Disallow the creation of kprobes when the kernel is locked down.  This
    patch restricts writing to /sys/kernel/debug/tracing/kprobe_events; writing
    to /sys/kernel/debug/kprobes/enabled is disabled by the patch that locks
    down debugfs.
    
    Signed-off-by: David Howells <dhowells@...hat.com>

diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 8a907e12b6b9..b44f046d2582 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -907,6 +907,9 @@ static int probes_open(struct inode *inode, struct file *file)
 static ssize_t probes_write(struct file *file, const char __user *buffer,
 			    size_t count, loff_t *ppos)
 {
+	if (kernel_is_locked_down("Use of kprobes"))
+		return -EPERM;
+
 	return traceprobe_probes_write(file, buffer, count, ppos,
 			create_trace_kprobe);
 }