| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <750d9e17-d8b8-44c0-ba47-74a686333a01@redhat.com>
Date: Tue, 16 Jan 2024 11:40:53 +0100
From: Ondrej Kozina <okozina@...hat.com>
To: Coiby Xu <coxu@...hat.com>, kexec@...ts.infradead.org
Cc: Milan Broz <gmazyland@...il.com>, Thomas Staudt <tstaudt@...ibm.com>,
Daniel P . Berrangé <berrange@...hat.com>,
Kairui Song <ryncsn@...il.com>, dm-devel@...hat.com,
Jan Pazdziora <jpazdziora@...hat.com>, Pingfan Liu <kernelfans@...il.com>,
Baoquan He <bhe@...hat.com>, Dave Young <dyoung@...hat.com>,
linux-kernel@...r.kernel.org, x86@...nel.org,
Dave Hansen <dave.hansen@...el.com>, Vitaly Kuznetsov <vkuznets@...hat.com>,
Vivek Goyal <vgoyal@...hat.com>, Eric Biederman <ebiederm@...ssion.com>
Subject: Re: [PATCH v2 2/5] crash_dump: save the dm crypt key temporarily
On 10/01/2024 08:15, Coiby Xu wrote:
> User space is supposed to write the key description to
> /sys/kernel/crash_dm_crypt_key so the kernel will read the key and save
> a temporary copy for later user. User space has 2 minutes at maximum to
> load the kdump initrd before the key gets wiped. And after kdump
> retrieves the key, the key will be wiped immediately.
>
> Signed-off-by: Coiby Xu <coxu@...hat.com>
> ---
> include/linux/crash_core.h | 7 +-
> include/linux/kexec.h | 4 ++
> kernel/Makefile | 2 +-
> kernel/crash_dump_dm_crypt.c | 121 +++++++++++++++++++++++++++++++++++
> kernel/ksysfs.c | 23 ++++++-
> 5 files changed, 153 insertions(+), 4 deletions(-)
> create mode 100644 kernel/crash_dump_dm_crypt.c
>
> diff --git a/include/linux/crash_core.h b/include/linux/crash_core.h
> index 5126a4fecb44..7078eda6418d 100644
> --- a/include/linux/crash_core.h
> +++ b/include/linux/crash_core.h
> @@ -125,6 +125,12 @@ static inline void __init reserve_crashkernel_generic(char *cmdline,
> {}
> #endif
>
> +struct kimage;
> +
> +int crash_sysfs_dm_crypt_key_write(const char *key_des, size_t count);
> +int crash_pass_temp_dm_crypt_key(void **addr, unsigned long *sz);
> +int crash_load_dm_crypt_key(struct kimage *image);
> +
> /* Alignment required for elf header segment */
> #define ELF_CORE_HEADER_ALIGN 4096
>
> @@ -140,7 +146,6 @@ extern int crash_exclude_mem_range(struct crash_mem *mem,
> extern int crash_prepare_elf64_headers(struct crash_mem *mem, int need_kernel_map,
> void **addr, unsigned long *sz);
>
> -struct kimage;
> struct kexec_segment;
>
> #define KEXEC_CRASH_HP_NONE 0
> diff --git a/include/linux/kexec.h b/include/linux/kexec.h
> index 6f4626490ebf..bf7ab1e927ef 100644
> --- a/include/linux/kexec.h
> +++ b/include/linux/kexec.h
> @@ -366,6 +366,10 @@ struct kimage {
> void *elf_headers;
> unsigned long elf_headers_sz;
> unsigned long elf_load_addr;
> +
> + /* dm crypt key buffer */
> + unsigned long dm_crypt_key_addr;
> + unsigned long dm_crypt_key_sz;
> };
>
> /* kexec interface functions */
> diff --git a/kernel/Makefile b/kernel/Makefile
> index 3947122d618b..48859bf63db5 100644
> --- a/kernel/Makefile
> +++ b/kernel/Makefile
> @@ -119,7 +119,7 @@ obj-$(CONFIG_PERF_EVENTS) += events/
>
> obj-$(CONFIG_USER_RETURN_NOTIFIER) += user-return-notifier.o
> obj-$(CONFIG_PADATA) += padata.o
> -obj-$(CONFIG_CRASH_DUMP) += crash_dump.o
> +obj-$(CONFIG_CRASH_DUMP) += crash_dump.o crash_dump_dm_crypt.o
> obj-$(CONFIG_JUMP_LABEL) += jump_label.o
> obj-$(CONFIG_CONTEXT_TRACKING) += context_tracking.o
> obj-$(CONFIG_TORTURE_TEST) += torture.o
> diff --git a/kernel/crash_dump_dm_crypt.c b/kernel/crash_dump_dm_crypt.c
> new file mode 100644
> index 000000000000..3a0b0b773598
> --- /dev/null
> +++ b/kernel/crash_dump_dm_crypt.c
> @@ -0,0 +1,121 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +#include <keys/user-type.h>
> +#include <linux/crash_dump.h>
> +
> +static u8 *dm_crypt_key;
> +static unsigned int dm_crypt_key_size;
> +
> +void wipe_dm_crypt_key(void)
> +{
> + if (dm_crypt_key) {
> + memset(dm_crypt_key, 0, dm_crypt_key_size * sizeof(u8));
> + kfree(dm_crypt_key);
> + dm_crypt_key = NULL;
> + }
> +}
> +
> +static void _wipe_dm_crypt_key(struct work_struct *dummy)
> +{
> + wipe_dm_crypt_key();
> +}
> +
> +static DECLARE_DELAYED_WORK(wipe_dm_crypt_key_work, _wipe_dm_crypt_key);
> +
> +static unsigned __read_mostly wipe_key_delay = 120; /* 2 mins */
> +
> +static int crash_save_temp_dm_crypt_key(const char *key_desc, size_t count)
> +{
> + const struct user_key_payload *ukp;
> + struct key *key;
> +
> + if (dm_crypt_key) {
> + memset(dm_crypt_key, 0, dm_crypt_key_size * sizeof(u8));
> + kfree(dm_crypt_key);
> + }
> +
> + pr_debug("Requesting key %s", key_desc);
> + key = request_key(&key_type_user, key_desc, NULL);
If we don't read the key copy form userspace (my reply to top level
message) you could use key_type_logon here.
> +
> + if (IS_ERR(key)) {
> + pr_debug("No such key %s", key_desc);
> + return PTR_ERR(key);
> + }
> +
> + ukp = user_key_payload_locked(key);
> + if (!ukp)
> + return -EKEYREVOKED;
> +
> + dm_crypt_key = kmalloc(ukp->datalen, GFP_KERNEL);
> + if (!dm_crypt_key)
> + return -ENOMEM;
> + memcpy(dm_crypt_key, ukp->data, ukp->datalen);
> + dm_crypt_key_size = ukp->datalen;
> + pr_debug("dm crypt key (size=%u): %8ph\n", dm_crypt_key_size, dm_crypt_key);
> + schedule_delayed_work(&wipe_dm_crypt_key_work,
> + round_jiffies_relative(wipe_key_delay * HZ));
> + return 0;
> +}
> +
> +int crash_sysfs_dm_crypt_key_write(const char *key_desc, size_t count)
> +{
> + if (!is_kdump_kernel())
> + return crash_save_temp_dm_crypt_key(key_desc, count);
> + return -EINVAL;
> +}
> +EXPORT_SYMBOL(crash_sysfs_dm_crypt_key_write);
> +
> +int crash_pass_temp_dm_crypt_key(void **addr, unsigned long *sz)
> +{
> + unsigned long dm_crypt_key_sz;
> + unsigned char *buf;
> + unsigned int *size_ptr;
> +
> + if (!dm_crypt_key)
> + return -EINVAL;
> +
> + dm_crypt_key_sz = sizeof(unsigned int) + dm_crypt_key_size * sizeof(u8);
> +
> + buf = vzalloc(dm_crypt_key_sz);
> + if (!buf)
> + return -ENOMEM;
> +
> + size_ptr = (unsigned int *)buf;
> + memcpy(size_ptr, &dm_crypt_key_size, sizeof(unsigned int));
> + memcpy(size_ptr + 1, dm_crypt_key, dm_crypt_key_size * sizeof(u8));
> + *addr = buf;
> + *sz = dm_crypt_key_sz;
> + wipe_dm_crypt_key();
> + return 0;
> +}
> +
> +int crash_load_dm_crypt_key(struct kimage *image)
> +{
> + int ret;
> + struct kexec_buf kbuf = {
> + .image = image,
> + .buf_min = 0,
> + .buf_max = ULONG_MAX,
> + .top_down = false,
> + .random = true,
> + };
> +
> + image->dm_crypt_key_addr = 0;
> + ret = crash_pass_temp_dm_crypt_key(&kbuf.buffer, &kbuf.bufsz);
> + if (ret)
> + return ret;
> +
> + kbuf.memsz = kbuf.bufsz;
> + kbuf.buf_align = ELF_CORE_HEADER_ALIGN;
> + kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
> + ret = kexec_add_buffer(&kbuf);
> + if (ret) {
> + vfree((void *)kbuf.buffer);
> + return ret;
> + }
> + image->dm_crypt_key_addr = kbuf.mem;
> + image->dm_crypt_key_sz = kbuf.bufsz;
> + pr_debug("Loaded dm crypt key at 0x%lx bufsz=0x%lx memsz=0x%lx\n",
> + image->dm_crypt_key_addr, kbuf.bufsz, kbuf.bufsz);
> +
> + return ret;
> +}
> diff --git a/kernel/ksysfs.c b/kernel/ksysfs.c
> index 1d4bc493b2f4..f3bb6bc6a604 100644
> --- a/kernel/ksysfs.c
> +++ b/kernel/ksysfs.c
> @@ -165,16 +165,34 @@ static ssize_t vmcoreinfo_show(struct kobject *kobj,
> }
> KERNEL_ATTR_RO(vmcoreinfo);
>
> +static ssize_t crash_dm_crypt_key_show(struct kobject *kobj,
> + struct kobj_attribute *attr,
> + char *buf)
> +{
> + return 0;
> +}
> +
> +static ssize_t crash_dm_crypt_key_store(struct kobject *kobj,
> + struct kobj_attribute *attr,
> + const char *buf, size_t count)
> +{
> + int ret;
> +
> + ret = crash_sysfs_dm_crypt_key_write(buf, count);
> + return ret < 0 ? ret : count;
> +}
> +KERNEL_ATTR_RW(crash_dm_crypt_key);
> +
> #ifdef CONFIG_CRASH_HOTPLUG
> static ssize_t crash_elfcorehdr_size_show(struct kobject *kobj,
> - struct kobj_attribute *attr, char *buf)
> + struct kobj_attribute *attr,
> + char *buf)
> {
> unsigned int sz = crash_get_elfcorehdr_size();
>
> return sysfs_emit(buf, "%u\n", sz);
> }
> KERNEL_ATTR_RO(crash_elfcorehdr_size);
> -
> #endif
>
> #endif /* CONFIG_CRASH_CORE */
> @@ -267,6 +285,7 @@ static struct attribute * kernel_attrs[] = {
> #endif
> #ifdef CONFIG_CRASH_CORE
> &vmcoreinfo_attr.attr,
> + &crash_dm_crypt_key_attr.attr,
> #ifdef CONFIG_CRASH_HOTPLUG
> &crash_elfcorehdr_size_attr.attr,
> #endif
Powered by blists - more mailing lists