From: Ricardo Ribalda <ribalda@chromium.org> To: Eric Biederman <ebiederm@xmission.com>, Jonathan Corbet <corbet@lwn.net> Cc: Sergey Senozhatsky <senozhatsky@chromium.org>, linux-kernel@vger.kernel.org, kexec@lists.infradead.org, Ross Zwisler <zwisler@kernel.org>, linux-doc@vger.kernel.org, "Joel Fernandes (Google)" <joel@joelfernandes.org>, Steven Rostedt <rostedt@goodmis.org>, Ricardo Ribalda <ribalda@chromium.org> Subject: [PATCH v1 2/2] kexec: Introduce kexec_reboot_disabled Date: Mon, 14 Nov 2022 14:18:39 +0100 [thread overview] Message-ID: <20221114-disable-kexec-reset-v1-2-fb51d20cf871@chromium.org> (raw) In-Reply-To: <20221114-disable-kexec-reset-v1-0-fb51d20cf871@chromium.org> Create a new toogle that disables LINUX_REBOOT_CMD_KEXEC, reducing the attack surface to a system. Without this toogle, an attacker can only reboot into a different kernel if they can create a panic(). Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> diff --git a/Documentation/admin-guide/sysctl/kernel.rst b/Documentation/admin-guide/sysctl/kernel.rst index 97394bd9d065..25d019682d33 100644 --- a/Documentation/admin-guide/sysctl/kernel.rst +++ b/Documentation/admin-guide/sysctl/kernel.rst @@ -462,6 +462,17 @@ altered. Generally used together with the `modules_disabled`_ sysctl. +kexec_reboot_disabled +===================== + +A toggle indicating if ``LINUX_REBOOT_CMD_KEXEC`` has been disabled. +This value defaults to 0 (false: ``LINUX_REBOOT_CMD_KEXEC`` enabled), +but can be set to 1 (true: ``LINUX_REBOOT_CMD_KEXEC`` disabled). +Once true, kexec can no longer be used for reboot and the toggle +cannot be set back to false. +This toggle does not affect the use of kexec during a crash. + + kptr_restrict ============= diff --git a/include/linux/kexec.h b/include/linux/kexec.h index 41a686996aaa..15c3fad8918b 100644 --- a/include/linux/kexec.h +++ b/include/linux/kexec.h @@ -407,6 +407,7 @@ extern int kimage_crash_copy_vmcoreinfo(struct kimage *image); extern struct kimage *kexec_image; extern struct kimage *kexec_crash_image; extern int kexec_load_disabled; +extern int kexec_reboot_disabled; #ifndef kexec_flush_icache_page #define kexec_flush_icache_page(page) diff --git a/kernel/kexec.c b/kernel/kexec.c index cb8e6e6f983c..43063f803d81 100644 --- a/kernel/kexec.c +++ b/kernel/kexec.c @@ -196,6 +196,10 @@ static inline int kexec_load_check(unsigned long nr_segments, if (!capable(CAP_SYS_BOOT) || kexec_load_disabled) return -EPERM; + /* Check if the system admin has disabled kexec reboot. */ + if (!(flags & KEXEC_ON_CRASH) && kexec_reboot_disabled) + return -EPERM; + /* Permit LSMs and IMA to fail the kexec */ result = security_kernel_load_data(LOADING_KEXEC_IMAGE, false); if (result < 0) diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c index ca2743f9c634..fe82e2525705 100644 --- a/kernel/kexec_core.c +++ b/kernel/kexec_core.c @@ -929,6 +929,7 @@ int kimage_load_segment(struct kimage *image, struct kimage *kexec_image; struct kimage *kexec_crash_image; int kexec_load_disabled; +int kexec_reboot_disabled; #ifdef CONFIG_SYSCTL static struct ctl_table kexec_core_sysctls[] = { { @@ -941,6 +942,16 @@ static struct ctl_table kexec_core_sysctls[] = { .extra1 = SYSCTL_ONE, .extra2 = SYSCTL_ONE, }, + { + .procname = "kexec_reboot_disabled", + .data = &kexec_reboot_disabled, + .maxlen = sizeof(int), + .mode = 0644, + /* only handle a transition from default "0" to "1" */ + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ONE, + .extra2 = SYSCTL_ONE, + }, { } }; @@ -1138,7 +1149,7 @@ int kernel_kexec(void) if (!kexec_trylock()) return -EBUSY; - if (!kexec_image) { + if (!kexec_image || kexec_reboot_disabled) { error = -EINVAL; goto Unlock; } diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c index 45637511e0de..583fba6de5cb 100644 --- a/kernel/kexec_file.c +++ b/kernel/kexec_file.c @@ -333,6 +333,11 @@ SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd, if (!capable(CAP_SYS_BOOT) || kexec_load_disabled) return -EPERM; + /* Check if the system admin has disabled kexec reboot. */ + if (!(flags & (KEXEC_FILE_ON_CRASH | KEXEC_FILE_UNLOAD)) + && kexec_reboot_disabled) + return -EPERM; + /* Make sure we have a legal set of flags */ if (flags != (flags & KEXEC_FILE_FLAGS)) return -EINVAL; -- b4 0.11.0-dev-d93f8
WARNING: multiple messages have this Message-ID (diff)
From: Ricardo Ribalda <ribalda@chromium.org> To: Eric Biederman <ebiederm@xmission.com>, Jonathan Corbet <corbet@lwn.net> Cc: Sergey Senozhatsky <senozhatsky@chromium.org>, linux-kernel@vger.kernel.org, kexec@lists.infradead.org, Ross Zwisler <zwisler@kernel.org>, linux-doc@vger.kernel.org, "Joel Fernandes (Google)" <joel@joelfernandes.org>, Steven Rostedt <rostedt@goodmis.org>, Ricardo Ribalda <ribalda@chromium.org> Subject: [PATCH v1 2/2] kexec: Introduce kexec_reboot_disabled Date: Mon, 14 Nov 2022 14:18:39 +0100 [thread overview] Message-ID: <20221114-disable-kexec-reset-v1-2-fb51d20cf871@chromium.org> (raw) In-Reply-To: <20221114-disable-kexec-reset-v1-0-fb51d20cf871@chromium.org> Create a new toogle that disables LINUX_REBOOT_CMD_KEXEC, reducing the attack surface to a system. Without this toogle, an attacker can only reboot into a different kernel if they can create a panic(). Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> diff --git a/Documentation/admin-guide/sysctl/kernel.rst b/Documentation/admin-guide/sysctl/kernel.rst index 97394bd9d065..25d019682d33 100644 --- a/Documentation/admin-guide/sysctl/kernel.rst +++ b/Documentation/admin-guide/sysctl/kernel.rst @@ -462,6 +462,17 @@ altered. Generally used together with the `modules_disabled`_ sysctl. +kexec_reboot_disabled +===================== + +A toggle indicating if ``LINUX_REBOOT_CMD_KEXEC`` has been disabled. +This value defaults to 0 (false: ``LINUX_REBOOT_CMD_KEXEC`` enabled), +but can be set to 1 (true: ``LINUX_REBOOT_CMD_KEXEC`` disabled). +Once true, kexec can no longer be used for reboot and the toggle +cannot be set back to false. +This toggle does not affect the use of kexec during a crash. + + kptr_restrict ============= diff --git a/include/linux/kexec.h b/include/linux/kexec.h index 41a686996aaa..15c3fad8918b 100644 --- a/include/linux/kexec.h +++ b/include/linux/kexec.h @@ -407,6 +407,7 @@ extern int kimage_crash_copy_vmcoreinfo(struct kimage *image); extern struct kimage *kexec_image; extern struct kimage *kexec_crash_image; extern int kexec_load_disabled; +extern int kexec_reboot_disabled; #ifndef kexec_flush_icache_page #define kexec_flush_icache_page(page) diff --git a/kernel/kexec.c b/kernel/kexec.c index cb8e6e6f983c..43063f803d81 100644 --- a/kernel/kexec.c +++ b/kernel/kexec.c @@ -196,6 +196,10 @@ static inline int kexec_load_check(unsigned long nr_segments, if (!capable(CAP_SYS_BOOT) || kexec_load_disabled) return -EPERM; + /* Check if the system admin has disabled kexec reboot. */ + if (!(flags & KEXEC_ON_CRASH) && kexec_reboot_disabled) + return -EPERM; + /* Permit LSMs and IMA to fail the kexec */ result = security_kernel_load_data(LOADING_KEXEC_IMAGE, false); if (result < 0) diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c index ca2743f9c634..fe82e2525705 100644 --- a/kernel/kexec_core.c +++ b/kernel/kexec_core.c @@ -929,6 +929,7 @@ int kimage_load_segment(struct kimage *image, struct kimage *kexec_image; struct kimage *kexec_crash_image; int kexec_load_disabled; +int kexec_reboot_disabled; #ifdef CONFIG_SYSCTL static struct ctl_table kexec_core_sysctls[] = { { @@ -941,6 +942,16 @@ static struct ctl_table kexec_core_sysctls[] = { .extra1 = SYSCTL_ONE, .extra2 = SYSCTL_ONE, }, + { + .procname = "kexec_reboot_disabled", + .data = &kexec_reboot_disabled, + .maxlen = sizeof(int), + .mode = 0644, + /* only handle a transition from default "0" to "1" */ + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ONE, + .extra2 = SYSCTL_ONE, + }, { } }; @@ -1138,7 +1149,7 @@ int kernel_kexec(void) if (!kexec_trylock()) return -EBUSY; - if (!kexec_image) { + if (!kexec_image || kexec_reboot_disabled) { error = -EINVAL; goto Unlock; } diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c index 45637511e0de..583fba6de5cb 100644 --- a/kernel/kexec_file.c +++ b/kernel/kexec_file.c @@ -333,6 +333,11 @@ SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd, if (!capable(CAP_SYS_BOOT) || kexec_load_disabled) return -EPERM; + /* Check if the system admin has disabled kexec reboot. */ + if (!(flags & (KEXEC_FILE_ON_CRASH | KEXEC_FILE_UNLOAD)) + && kexec_reboot_disabled) + return -EPERM; + /* Make sure we have a legal set of flags */ if (flags != (flags & KEXEC_FILE_FLAGS)) return -EINVAL; -- b4 0.11.0-dev-d93f8 _______________________________________________ kexec mailing list kexec@lists.infradead.org http://lists.infradead.org/mailman/listinfo/kexec
next prev parent reply other threads:[~2022-11-14 13:20 UTC|newest] Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-11-14 13:18 [PATCH v1 0/2] kexec: Add new toogle to disable kexec_reboot Ricardo Ribalda 2022-11-14 13:18 ` Ricardo Ribalda 2022-11-14 13:18 ` [PATCH v1 1/2] Documentation: sysctl: Correct kexec_load_disabled Ricardo Ribalda 2022-11-14 13:18 ` Ricardo Ribalda 2022-11-23 9:47 ` Baoquan He 2022-11-23 9:47 ` Baoquan He 2022-11-14 13:18 ` Ricardo Ribalda [this message] 2022-11-14 13:18 ` [PATCH v1 2/2] kexec: Introduce kexec_reboot_disabled Ricardo Ribalda 2022-11-17 15:06 ` Philipp Rudo 2022-11-17 15:06 ` Philipp Rudo 2022-11-17 15:15 ` Ricardo Ribalda 2022-11-17 15:15 ` Ricardo Ribalda 2022-11-21 14:09 ` Philipp Rudo 2022-11-21 14:09 ` Philipp Rudo 2022-11-23 8:58 ` Ricardo Ribalda 2022-11-23 8:58 ` Ricardo Ribalda 2022-11-24 11:40 ` Philipp Rudo 2022-11-24 11:40 ` Philipp Rudo 2022-11-24 12:52 ` Ricardo Ribalda 2022-11-24 12:52 ` Ricardo Ribalda 2022-11-24 15:01 ` Philipp Rudo 2022-11-24 15:01 ` Philipp Rudo 2022-11-24 22:32 ` Ricardo Ribalda 2022-11-24 22:32 ` Ricardo Ribalda 2022-11-28 16:28 ` Philipp Rudo 2022-11-28 16:28 ` Philipp Rudo 2022-11-28 23:37 ` Steven Rostedt 2022-11-28 23:37 ` Steven Rostedt 2022-11-28 16:42 ` Steven Rostedt 2022-11-28 16:42 ` Steven Rostedt 2022-11-29 13:44 ` Philipp Rudo 2022-11-29 13:44 ` Philipp Rudo 2022-11-29 14:32 ` Steven Rostedt 2022-11-29 14:32 ` Steven Rostedt 2022-12-12 21:43 ` Ricardo Ribalda 2022-12-12 21:43 ` Ricardo Ribalda 2022-11-23 13:49 ` Baoquan He 2022-11-23 13:49 ` Baoquan He
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20221114-disable-kexec-reset-v1-2-fb51d20cf871@chromium.org \ --to=ribalda@chromium.org \ --cc=corbet@lwn.net \ --cc=ebiederm@xmission.com \ --cc=joel@joelfernandes.org \ --cc=kexec@lists.infradead.org \ --cc=linux-doc@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=rostedt@goodmis.org \ --cc=senozhatsky@chromium.org \ --cc=zwisler@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.