From: "Christopher M. Riedl" <cmr@informatik.wtf>
To: linuxppc-dev@ozlabs.org, kernel-hardening@lists.openwall.com
Cc: ajd@linux.ibm.com
Subject: [PATCH v6 0/2] Restrict xmon when kernel is locked down
Date: Thu, 29 Aug 2019 22:37:42 -0500 [thread overview]
Message-ID: <20190830033744.1392-1-cmr@informatik.wtf> (raw)
Xmon should be either fully or partially disabled depending on the
kernel lockdown state.
Put xmon into read-only mode for lockdown=integrity and completely
disable xmon when lockdown=confidentiality. Since this can occur
dynamically, there may be pre-existing, active breakpoints in xmon when
transitioning into read-only mode. These breakpoints will still trigger,
so allow them to be listed and cleared using xmon.
Changes since v5:
- Do not spam print messages when attempting to enter xmon when
lockdown=confidentiality
Changes since v4:
- Move lockdown state checks into xmon_core
- Allow clearing of breakpoints in xmon read-only mode
- Test simple scenarios (combinations of xmon and lockdown cmdline
options, setting breakpoints and changing lockdown state, etc) in
QEMU and on an actual POWER8 VM
- Rebase onto security/next-lockdown
b602614a81078bf29c82b2671bb96a63488f68d6
Changes since v3:
- Allow active breakpoints to be shown/listed in read-only mode
Changes since v2:
- Rebased onto v36 of https://patchwork.kernel.org/cover/11049461/
(based on: f632a8170a6b667ee4e3f552087588f0fe13c4bb)
- Do not clear existing breakpoints when transitioning from
lockdown=none to lockdown=integrity
- Remove line continuation and dangling quote (confuses checkpatch.pl)
from the xmon command help/usage string
Christopher M. Riedl (2):
powerpc/xmon: Allow listing and clearing breakpoints in read-only mode
powerpc/xmon: Restrict when kernel is locked down
arch/powerpc/xmon/xmon.c | 108 +++++++++++++++++++++++++++--------
include/linux/security.h | 2 +
security/lockdown/lockdown.c | 2 +
3 files changed, 87 insertions(+), 25 deletions(-)
--
2.23.0
next reply other threads:[~2019-08-30 3:34 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-30 3:37 Christopher M. Riedl [this message]
2019-08-30 3:37 ` [PATCH v6 1/2] powerpc/xmon: Allow listing and clearing breakpoints in read-only mode Christopher M. Riedl
2019-08-30 3:37 ` [PATCH v6 2/2] powerpc/xmon: Restrict when kernel is locked down Christopher M. Riedl
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190830033744.1392-1-cmr@informatik.wtf \
--to=cmr@informatik.wtf \
--cc=ajd@linux.ibm.com \
--cc=kernel-hardening@lists.openwall.com \
--cc=linuxppc-dev@ozlabs.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).