netdev - [PATCH RFC UEK5 2/7] bpf: Restrict bpf when kernel lockdown is in confidentiality mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20201020210004.18977-3-konrad.wilk@oracle.com>
Date:   Tue, 20 Oct 2020 16:59:59 -0400
From:   Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>
To:     eric.snowberg@...cle.com, john.haxby@...cle.com,
        todd.vierling@...cle.com
Cc:     Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>,
        Matthew Garrett <mjg59@...gle.com>, netdev@...r.kernel.org,
        Chun-Yi Lee <jlee@...e.com>,
        Alexei Starovoitov <alexei.starovoitov@...il.com>,
        Daniel Borkmann <daniel@...earbox.net>,
        James Morris <jmorris@...ei.org>
Subject: [PATCH RFC UEK5 2/7] bpf: Restrict bpf when kernel lockdown is in confidentiality mode

bpf_read() and bpf_read_str() could potentially be abused to (eg) allow
private keys in kernel memory to be leaked. Disable them if the kernel
has been locked down in confidentiality mode.

Suggested-by: Alexei Starovoitov <alexei.starovoitov@...il.com>
Signed-off-by: Matthew Garrett <mjg59@...gle.com>
Reviewed-by: Kees Cook <keescook@...omium.org>
cc: netdev@...r.kernel.org
cc: Chun-Yi Lee <jlee@...e.com>
cc: Alexei Starovoitov <alexei.starovoitov@...il.com>
Cc: Daniel Borkmann <daniel@...earbox.net>
Signed-off-by: James Morris <jmorris@...ei.org>

[Backport notes:
 The upstream version is using enums, and all that fancy code.
 We are just retroffiting UEK5 a bit and just checking to
 see if integrity mode has been enabled and if so then
 allow it. If the default lockdown mode (confidentiality) is on
 then we don't allow it.]

Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>
---
 security/lock_down.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/security/lock_down.c b/security/lock_down.c
index 96ff1badfac0b..1b913f855d48d 100644
--- a/security/lock_down.c
+++ b/security/lock_down.c
@@ -57,9 +57,16 @@ void __init init_lockdown(void)
  */
 bool __kernel_is_locked_down(const char *what, bool first)
 {
-	if (what && first && kernel_locked_down)
+	if (what && first && kernel_locked_down) {
+		/* If we are in integrity mode we allow certain callsites */
+		if (!lockdown_confidentiality) {
+			if ((strcmp(what, "BPF") == 0)) {
+				return 0;
+			}
+		}
 		pr_notice("Lockdown: %s is restricted; see man kernel_lockdown.7\n",
 			  what);
+	}
 	return kernel_locked_down;
 }
 EXPORT_SYMBOL(__kernel_is_locked_down);
-- 
2.13.6