* [PATCH v2] efi/efi_test: lock down /dev/efi_test and require CAP_SYS_ADMIN
@ 2019-10-08 10:55 Javier Martinez Canillas
2019-10-08 18:15 ` Laszlo Ersek
2019-10-09 2:17 ` Matthew Garrett
0 siblings, 2 replies; 4+ messages in thread
From: Javier Martinez Canillas @ 2019-10-08 10:55 UTC (permalink / raw)
To: linux-kernel
Cc: Ivan Hu, Laszlo Ersek, linux-efi, Laura Abbott, Josh Boyer,
Peter Jones, Ard Biesheuvel, Javier Martinez Canillas,
Janne Karhunen, Kees Cook, David Howells, linux-security-module,
Casey Schaufler, Micah Morton, Steven Rostedt (VMware),
James Morris, Al Viro, Matthew Garrett, Serge E. Hallyn
The driver exposes EFI runtime services to user-space through an IOCTL
interface, calling the EFI services function pointers directly without
using the efivar API.
Disallow access to the /dev/efi_test character device when the kernel is
locked down to prevent arbitrary user-space to call EFI runtime services.
Also require CAP_SYS_ADMIN to open the chardev to prevent unprivileged
users to call the EFI runtime services, instead of just relying on the
chardev file mode bits for this.
The main user of this driver is the fwts [0] tool that already checks if
the effective user ID is 0 and fails otherwise. So this change shouldn't
cause any regression to this tool.
[0]: https://wiki.ubuntu.com/FirmwareTestSuite/Reference/uefivarinfo
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
---
Changes in v2:
- Also disable /dev/efi_test access when the kernel is locked down as
suggested by Matthew Garrett.
- Add Acked-by tag from Laszlo Ersek.
drivers/firmware/efi/test/efi_test.c | 8 ++++++++
include/linux/security.h | 1 +
security/lockdown/lockdown.c | 1 +
3 files changed, 10 insertions(+)
diff --git a/drivers/firmware/efi/test/efi_test.c b/drivers/firmware/efi/test/efi_test.c
index 877745c3aaf..7baf48c01e7 100644
--- a/drivers/firmware/efi/test/efi_test.c
+++ b/drivers/firmware/efi/test/efi_test.c
@@ -14,6 +14,7 @@
#include <linux/init.h>
#include <linux/proc_fs.h>
#include <linux/efi.h>
+#include <linux/security.h>
#include <linux/slab.h>
#include <linux/uaccess.h>
@@ -717,6 +718,13 @@ static long efi_test_ioctl(struct file *file, unsigned int cmd,
static int efi_test_open(struct inode *inode, struct file *file)
{
+ int ret = security_locked_down(LOCKDOWN_EFI_TEST);
+
+ if (ret)
+ return ret;
+
+ if (!capable(CAP_SYS_ADMIN))
+ return -EACCES;
/*
* nothing special to do here
* We do accept multiple open files at the same time as we
diff --git a/include/linux/security.h b/include/linux/security.h
index a8d59d612d2..9df7547afc0 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -105,6 +105,7 @@ enum lockdown_reason {
LOCKDOWN_NONE,
LOCKDOWN_MODULE_SIGNATURE,
LOCKDOWN_DEV_MEM,
+ LOCKDOWN_EFI_TEST,
LOCKDOWN_KEXEC,
LOCKDOWN_HIBERNATION,
LOCKDOWN_PCI_ACCESS,
diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
index 8a10b43daf7..40b790536de 100644
--- a/security/lockdown/lockdown.c
+++ b/security/lockdown/lockdown.c
@@ -20,6 +20,7 @@ static const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = {
[LOCKDOWN_NONE] = "none",
[LOCKDOWN_MODULE_SIGNATURE] = "unsigned module loading",
[LOCKDOWN_DEV_MEM] = "/dev/mem,kmem,port",
+ [LOCKDOWN_EFI_TEST] = "/dev/efi_test access",
[LOCKDOWN_KEXEC] = "kexec of unsigned images",
[LOCKDOWN_HIBERNATION] = "hibernation",
[LOCKDOWN_PCI_ACCESS] = "direct PCI access",
--
2.21.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH v2] efi/efi_test: lock down /dev/efi_test and require CAP_SYS_ADMIN
2019-10-08 10:55 [PATCH v2] efi/efi_test: lock down /dev/efi_test and require CAP_SYS_ADMIN Javier Martinez Canillas
@ 2019-10-08 18:15 ` Laszlo Ersek
2019-10-09 2:17 ` Matthew Garrett
1 sibling, 0 replies; 4+ messages in thread
From: Laszlo Ersek @ 2019-10-08 18:15 UTC (permalink / raw)
To: Javier Martinez Canillas, linux-kernel
Cc: Ivan Hu, linux-efi, Laura Abbott, Josh Boyer, Peter Jones,
Ard Biesheuvel, Janne Karhunen, Kees Cook, David Howells,
linux-security-module, Casey Schaufler, Micah Morton,
Steven Rostedt (VMware),
James Morris, Al Viro, Matthew Garrett, Serge E. Hallyn
On 10/08/19 12:55, Javier Martinez Canillas wrote:
> The driver exposes EFI runtime services to user-space through an IOCTL
> interface, calling the EFI services function pointers directly without
> using the efivar API.
>
> Disallow access to the /dev/efi_test character device when the kernel is
> locked down to prevent arbitrary user-space to call EFI runtime services.
>
> Also require CAP_SYS_ADMIN to open the chardev to prevent unprivileged
> users to call the EFI runtime services, instead of just relying on the
> chardev file mode bits for this.
>
> The main user of this driver is the fwts [0] tool that already checks if
> the effective user ID is 0 and fails otherwise. So this change shouldn't
> cause any regression to this tool.
>
> [0]: https://wiki.ubuntu.com/FirmwareTestSuite/Reference/uefivarinfo
>
> Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
> Acked-by: Laszlo Ersek <lersek@redhat.com>
>
> ---
>
> Changes in v2:
> - Also disable /dev/efi_test access when the kernel is locked down as
> suggested by Matthew Garrett.
Right; if you remember the pre-patch discussion off-list, we kind of
expected that lockdown might affect this. :)
... And, I can see Matt's comment now, at
<https://bugzilla.redhat.com/show_bug.cgi?id=1759325#c1>. Thanks for that!
While this change decreases the usability of the module, I fully agree
it is justified for production use. While it's more convenient for me to
keep SB enabled in the test VM(s) in general, and just run the test
whenever I need it, security trumps convenience. I can disable SB when
necessary, or even dedicate separate VMs (with SB generally disabled) to
this kind of testing.
> - Add Acked-by tag from Laszlo Ersek.
My ACK stands -- I don't know enough to validate the
security_locked_down() call and its friends, but I'm OK with the intent.
Thanks all!
Laszlo
>
> drivers/firmware/efi/test/efi_test.c | 8 ++++++++
> include/linux/security.h | 1 +
> security/lockdown/lockdown.c | 1 +
> 3 files changed, 10 insertions(+)
>
> diff --git a/drivers/firmware/efi/test/efi_test.c b/drivers/firmware/efi/test/efi_test.c
> index 877745c3aaf..7baf48c01e7 100644
> --- a/drivers/firmware/efi/test/efi_test.c
> +++ b/drivers/firmware/efi/test/efi_test.c
> @@ -14,6 +14,7 @@
> #include <linux/init.h>
> #include <linux/proc_fs.h>
> #include <linux/efi.h>
> +#include <linux/security.h>
> #include <linux/slab.h>
> #include <linux/uaccess.h>
>
> @@ -717,6 +718,13 @@ static long efi_test_ioctl(struct file *file, unsigned int cmd,
>
> static int efi_test_open(struct inode *inode, struct file *file)
> {
> + int ret = security_locked_down(LOCKDOWN_EFI_TEST);
> +
> + if (ret)
> + return ret;
> +
> + if (!capable(CAP_SYS_ADMIN))
> + return -EACCES;
> /*
> * nothing special to do here
> * We do accept multiple open files at the same time as we
> diff --git a/include/linux/security.h b/include/linux/security.h
> index a8d59d612d2..9df7547afc0 100644
> --- a/include/linux/security.h
> +++ b/include/linux/security.h
> @@ -105,6 +105,7 @@ enum lockdown_reason {
> LOCKDOWN_NONE,
> LOCKDOWN_MODULE_SIGNATURE,
> LOCKDOWN_DEV_MEM,
> + LOCKDOWN_EFI_TEST,
> LOCKDOWN_KEXEC,
> LOCKDOWN_HIBERNATION,
> LOCKDOWN_PCI_ACCESS,
> diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
> index 8a10b43daf7..40b790536de 100644
> --- a/security/lockdown/lockdown.c
> +++ b/security/lockdown/lockdown.c
> @@ -20,6 +20,7 @@ static const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = {
> [LOCKDOWN_NONE] = "none",
> [LOCKDOWN_MODULE_SIGNATURE] = "unsigned module loading",
> [LOCKDOWN_DEV_MEM] = "/dev/mem,kmem,port",
> + [LOCKDOWN_EFI_TEST] = "/dev/efi_test access",
> [LOCKDOWN_KEXEC] = "kexec of unsigned images",
> [LOCKDOWN_HIBERNATION] = "hibernation",
> [LOCKDOWN_PCI_ACCESS] = "direct PCI access",
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH v2] efi/efi_test: lock down /dev/efi_test and require CAP_SYS_ADMIN
2019-10-08 10:55 [PATCH v2] efi/efi_test: lock down /dev/efi_test and require CAP_SYS_ADMIN Javier Martinez Canillas
2019-10-08 18:15 ` Laszlo Ersek
@ 2019-10-09 2:17 ` Matthew Garrett
2019-10-09 13:02 ` Ard Biesheuvel
1 sibling, 1 reply; 4+ messages in thread
From: Matthew Garrett @ 2019-10-09 2:17 UTC (permalink / raw)
To: Javier Martinez Canillas
Cc: Linux Kernel Mailing List, Ivan Hu, Laszlo Ersek, linux-efi,
Laura Abbott, Josh Boyer, Peter Jones, Ard Biesheuvel,
Janne Karhunen, Kees Cook, David Howells, LSM List,
Casey Schaufler, Micah Morton, Steven Rostedt (VMware),
James Morris, Al Viro, Serge E. Hallyn
On Tue, Oct 8, 2019 at 9:55 PM Javier Martinez Canillas
<javierm@redhat.com> wrote:
> Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
> Acked-by: Laszlo Ersek <lersek@redhat.com>
Acked-by: Matthew Garrett <mjg59@google.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2] efi/efi_test: lock down /dev/efi_test and require CAP_SYS_ADMIN
2019-10-09 2:17 ` Matthew Garrett
@ 2019-10-09 13:02 ` Ard Biesheuvel
0 siblings, 0 replies; 4+ messages in thread
From: Ard Biesheuvel @ 2019-10-09 13:02 UTC (permalink / raw)
To: Matthew Garrett
Cc: Javier Martinez Canillas, Linux Kernel Mailing List, Ivan Hu,
Laszlo Ersek, linux-efi, Laura Abbott, Josh Boyer, Peter Jones,
Janne Karhunen, Kees Cook, David Howells, LSM List,
Casey Schaufler, Micah Morton, Steven Rostedt (VMware),
James Morris, Al Viro, Serge E. Hallyn
On Wed, 9 Oct 2019 at 04:18, Matthew Garrett <mjg59@google.com> wrote:
>
> On Tue, Oct 8, 2019 at 9:55 PM Javier Martinez Canillas
> <javierm@redhat.com> wrote:
> > Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
> > Acked-by: Laszlo Ersek <lersek@redhat.com>
>
> Acked-by: Matthew Garrett <mjg59@google.com>
Thanks all. Queued as a fix.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2019-10-09 13:02 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-10-08 10:55 [PATCH v2] efi/efi_test: lock down /dev/efi_test and require CAP_SYS_ADMIN Javier Martinez Canillas
2019-10-08 18:15 ` Laszlo Ersek
2019-10-09 2:17 ` Matthew Garrett
2019-10-09 13:02 ` Ard Biesheuvel
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).