From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Howells Subject: [PATCH 21/24] Lock down kprobes Date: Wed, 11 Apr 2018 17:26:55 +0100 Message-ID: <152346401560.4030.11136333491983876306.stgit@warthog.procyon.org.uk> References: <152346387861.4030.4408662483445703127.stgit@warthog.procyon.org.uk> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <152346387861.4030.4408662483445703127.stgit@warthog.procyon.org.uk> Sender: linux-kernel-owner@vger.kernel.org To: torvalds@linux-foundation.org Cc: linux-man@vger.kernel.org, linux-api@vger.kernel.org, jmorris@namei.org, linux-kernel@vger.kernel.org, dhowells@redhat.com, linux-security-module@vger.kernel.org List-Id: linux-man@vger.kernel.org Disallow the creation of kprobes when the kernel is locked down by preventing their registration. This prevents kprobes from being used to access kernel memory, either to make modifications or to steal crypto data. Reported-by: Alexei Starovoitov Signed-off-by: David Howells --- kernel/kprobes.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/kprobes.c b/kernel/kprobes.c index 102160ff5c66..4f5757732553 100644 --- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -1561,6 +1561,9 @@ int register_kprobe(struct kprobe *p) struct module *probed_mod; kprobe_opcode_t *addr; + if (kernel_is_locked_down("Use of kprobes")) + return -EPERM; + /* Adjust probe address from symbol */ addr = kprobe_addr(p); if (IS_ERR(addr))