linux-kernel - Re: [PATCH v2] selftests/ftrace: Skip test for optimized probes on PowerPC if Secure Boot is enabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20240825173557.89c64ab5362b0fa78df2f45a@kernel.org>
Date: Sun, 25 Aug 2024 17:35:57 +0900
From: Masami Hiramatsu (Google) <mhiramat@...nel.org>
To: Akanksha J N <akanksha@...ux.ibm.com>
Cc: linux-kernel@...r.kernel.org, linux-trace-kernel@...r.kernel.org,
 linux-kselftest@...r.kernel.org, shuah@...nel.org,
 mathieu.desnoyers@...icios.com, mhiramat@...nel.org, rostedt@...dmis.org
Subject: Re: [PATCH v2] selftests/ftrace: Skip test for optimized probes on
 PowerPC if Secure Boot is enabled

On Tue, 13 Aug 2024 09:10:56 +0530
Akanksha J N <akanksha@...ux.ibm.com> wrote:

> Currently while accessing debugfs with Secure Boot enabled on PowerPC,
> it is causing the kprobe_opt_types.tc test to fail. Below is the snippet
> of the error:
> 
> +++ grep kernel_clone /sys/kernel/debug/kprobes/list
> grep: /sys/kernel/debug/kprobes/list: Operation not permitted
> ++ PROBE=
> + '[' 2 -ne 0 ']'
> + kill -s 37 7595
> ++ SIG_RESULT=1
> + eval_result 1
> + case $1 in
> + prlog '	[\033[31mFAIL\033[0m]'
> + newline='\n'
> + '[' '	[\033[31mFAIL\033[0m]' = -n ']'
> + printf '	[\033[31mFAIL\033[0m]\n'
> 	[FAIL]
> 
> This is happening when secure boot is enabled, as it enables lockdown
> by default. With lockdown, access to certain debug features and
> filesystems like debugfs may be restricted or completely disabled.

Hmm, if the kprobes lockdown causes this problem, all tests which use
kprobes must not run. This seems onlu checks kprobe_opt_types.tc, but
what about other tests?

(Anyway, we don't recommend user to run tests in lockdown environment.)

Thank you,

> 
> To fix this, modify the test to check for Secure Boot status using
> lsprop /proc/device-tree/ibm,secure-boot. And, skip execution of the
> test on PowerPC if Secure Boot is enabled (00000002).
> 
> With this patch, test skips as unsupported:
> === Ftrace unit tests ===
> [1] Register/unregister optimized probe	[UNSUPPORTED]
> 
> Signed-off-by: Akanksha J N <akanksha@...ux.ibm.com>
> ---
>  .../selftests/ftrace/test.d/kprobe/kprobe_opt_types.tc       | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_opt_types.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_opt_types.tc
> index 9f5d99328086..925e74d6acc7 100644
> --- a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_opt_types.tc
> +++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_opt_types.tc
> @@ -10,6 +10,11 @@ x86_64)
>  arm*)
>  ;;
>  ppc*)
> +  lsprop_output=$(lsprop /proc/device-tree/ibm,secure-boot)
> +  if echo "$lsprop_output" | grep -q "00000002"; then
> +    echo "Secure Boot is enabled on PowerPC."
> +    exit_unsupported
> +  fi
>  ;;
>  *)
>    echo "Please implement other architecture here"
> -- 
> 2.45.2
> 


-- 
Masami Hiramatsu (Google) <mhiramat@...nel.org>