LKML Archive on lore.kernel.org
 help / color / Atom feed
From: David Howells <dhowells@redhat.com>
To: linux-security-module@vger.kernel.org
Cc: gnomes@lxorguk.ukuu.org.uk, linux-efi@vger.kernel.org,
	matthew.garrett@nebula.com, gregkh@linuxfoundation.org,
	linux-kernel@vger.kernel.org, dhowells@redhat.com,
	jforbes@redhat.com
Subject: [PATCH 01/27] Add the ability to lock down access to the running kernel image
Date: Thu, 19 Oct 2017 15:50:40 +0100
Message-ID: <150842463996.7923.6815305873334959305.stgit@warthog.procyon.org.uk> (raw)
In-Reply-To: <150842463163.7923.11081723749106843698.stgit@warthog.procyon.org.uk>

Provide a single call to allow kernel code to determine whether the system
should be locked down, thereby disallowing various accesses that might
allow the running kernel image to be changed including the loading of
modules that aren't validly signed with a key we recognise, fiddling with
MSR registers and disallowing hibernation,

Signed-off-by: David Howells <dhowells@redhat.com>
---

 include/linux/kernel.h   |   17 +++++++++++++
 include/linux/security.h |    8 ++++++
 security/Kconfig         |    8 ++++++
 security/Makefile        |    3 ++
 security/lock_down.c     |   60 ++++++++++++++++++++++++++++++++++++++++++++++
 5 files changed, 96 insertions(+)
 create mode 100644 security/lock_down.c

diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 0ad4c3044cf9..362da2e4bf53 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -287,6 +287,23 @@ static inline void refcount_error_report(struct pt_regs *regs, const char *err)
 { }
 #endif
 
+#ifdef CONFIG_LOCK_DOWN_KERNEL
+extern bool __kernel_is_locked_down(const char *what, bool first);
+#else
+static inline bool __kernel_is_locked_down(const char *what, bool first)
+{
+	return false;
+}
+#endif
+
+#define kernel_is_locked_down(what)					\
+	({								\
+		static bool message_given;				\
+		bool locked_down = __kernel_is_locked_down(what, !message_given); \
+		message_given = true;					\
+		locked_down;						\
+	})
+
 /* Internal, do not use. */
 int __must_check _kstrtoul(const char *s, unsigned int base, unsigned long *res);
 int __must_check _kstrtol(const char *s, unsigned int base, long *res);
diff --git a/include/linux/security.h b/include/linux/security.h
index ce6265960d6c..f9a894b42d4c 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1753,5 +1753,13 @@ static inline void free_secdata(void *secdata)
 { }
 #endif /* CONFIG_SECURITY */
 
+#ifdef CONFIG_LOCK_DOWN_KERNEL
+extern void __init init_lockdown(void);
+#else
+static inline void __init init_lockdown(void);
+{
+}
+#endif
+
 #endif /* ! __LINUX_SECURITY_H */
 
diff --git a/security/Kconfig b/security/Kconfig
index e8e449444e65..8e01fd59ae7e 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -205,6 +205,14 @@ config STATIC_USERMODEHELPER_PATH
 	  If you wish for all usermode helper programs to be disabled,
 	  specify an empty string here (i.e. "").
 
+config LOCK_DOWN_KERNEL
+	bool "Allow the kernel to be 'locked down'"
+	help
+	  Allow the kernel to be locked down under certain circumstances, for
+	  instance if UEFI secure boot is enabled.  Locking down the kernel
+	  turns off various features that might otherwise allow access to the
+	  kernel image (eg. setting MSR registers).
+
 source security/selinux/Kconfig
 source security/smack/Kconfig
 source security/tomoyo/Kconfig
diff --git a/security/Makefile b/security/Makefile
index f2d71cdb8e19..8c4a43e3d4e0 100644
--- a/security/Makefile
+++ b/security/Makefile
@@ -29,3 +29,6 @@ obj-$(CONFIG_CGROUP_DEVICE)		+= device_cgroup.o
 # Object integrity file lists
 subdir-$(CONFIG_INTEGRITY)		+= integrity
 obj-$(CONFIG_INTEGRITY)			+= integrity/
+
+# Allow the kernel to be locked down
+obj-$(CONFIG_LOCK_DOWN_KERNEL)		+= lock_down.o
diff --git a/security/lock_down.c b/security/lock_down.c
new file mode 100644
index 000000000000..d8595c0e6673
--- /dev/null
+++ b/security/lock_down.c
@@ -0,0 +1,60 @@
+/* Lock down the kernel
+ *
+ * Copyright (C) 2016 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#include <linux/security.h>
+#include <linux/export.h>
+
+static __ro_after_init bool kernel_locked_down;
+
+/*
+ * Put the kernel into lock-down mode.
+ */
+static void __init lock_kernel_down(const char *where)
+{
+	if (!kernel_locked_down) {
+		kernel_locked_down = true;
+		pr_notice("Kernel is locked down from %s; see man kernel_lockdown.7\n",
+			  where);
+	}
+}
+
+static int __init lockdown_param(char *ignored)
+{
+	lock_kernel_down("command line");
+	return 0;
+}
+
+early_param("lockdown", lockdown_param);
+
+/*
+ * Lock the kernel down from very early in the arch setup.  This must happen
+ * prior to things like ACPI being initialised.
+ */
+void __init init_lockdown(void)
+{
+#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT
+	if (efi_enabled(EFI_SECURE_BOOT))
+		lock_kernel_down("EFI secure boot");
+#endif
+}
+
+/**
+ * kernel_is_locked_down - Find out if the kernel is locked down
+ * @what: Tag to use in notice generated if lockdown is in effect
+ */
+bool __kernel_is_locked_down(const char *what, bool first)
+{
+	if (what && first && kernel_locked_down)
+		pr_notice("Lockdown: %s is restricted; see man kernel_lockdown.7\n",
+			  what);
+	return kernel_locked_down;
+}
+EXPORT_SYMBOL(__kernel_is_locked_down);

  reply index

Thread overview: 158+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-10-19 14:50 [PATCH 00/27] security, efi: Add kernel lockdown David Howells
2017-10-19 14:50 ` David Howells [this message]
2017-10-20 23:19   ` [PATCH 01/27] Add the ability to lock down access to the running kernel image James Morris
2017-10-19 14:50 ` [PATCH 02/27] Add a SysRq option to lift kernel lockdown David Howells
2017-10-19 17:20   ` Randy Dunlap
2017-10-19 22:12   ` David Howells
2017-11-07 17:39   ` Thiago Jung Bauermann
2017-11-07 22:56   ` David Howells
2017-10-19 14:50 ` [PATCH 03/27] Enforce module signatures if the kernel is locked down David Howells
2017-10-20  6:33   ` joeyli
2017-10-20 23:21   ` James Morris
2017-10-27 18:48   ` Mimi Zohar
2017-10-30 17:00   ` David Howells
2017-10-30 17:52     ` Mimi Zohar
2017-11-02 17:22   ` David Howells
2017-11-02 19:13     ` Mimi Zohar
2017-11-02 21:30     ` David Howells
2017-11-02 21:41       ` Mimi Zohar
2017-11-02 22:01       ` David Howells
2017-11-02 22:18         ` Mimi Zohar
2017-10-19 14:51 ` [PATCH 04/27] Restrict /dev/mem and /dev/kmem when " David Howells
2017-10-20  6:37   ` joeyli
2017-10-20 23:21   ` James Morris
2017-10-19 14:51 ` [PATCH 05/27] kexec: Disable at runtime if " David Howells
2017-10-20  6:38   ` joeyli
2017-10-20 23:22   ` James Morris
2017-10-19 14:51 ` [PATCH 06/27] Copy secure_boot flag in boot params across kexec reboot David Howells
2017-10-20  6:40   ` joeyli
2017-10-19 14:51 ` [PATCH 07/27] kexec_file: Disable at runtime if securelevel has been set David Howells
2017-10-20 23:26   ` James Morris
2017-10-23 15:54   ` Mimi Zohar
2017-10-26  7:42     ` joeyli
2017-10-26 14:17       ` Mimi Zohar
2017-10-27 19:30         ` Mimi Zohar
2017-10-27 19:32         ` Mimi Zohar
2017-10-28  8:34           ` joeyli
2017-10-29 22:26             ` Mimi Zohar
2017-10-30  9:00       ` David Howells
2017-10-30 12:01         ` Mimi Zohar
2017-10-26 15:02     ` David Howells
2017-10-26 15:46       ` Mimi Zohar
2017-10-30 15:49       ` David Howells
2017-10-30 16:43         ` Mimi Zohar
2017-11-02 17:00         ` David Howells
2017-10-26 14:51   ` David Howells
2017-11-02 17:29   ` David Howells
2017-10-19 14:51 ` [PATCH 08/27] hibernate: Disable when the kernel is locked down David Howells
2017-10-20  6:40   ` joeyli
2017-10-19 14:51 ` [PATCH 09/27] uswsusp: " David Howells
2017-10-20  6:41   ` joeyli
2017-10-20 23:29   ` James Morris
2017-10-19 14:51 ` [PATCH 10/27] PCI: Lock down BAR access " David Howells
2017-10-20  6:42   ` joeyli
2017-10-19 14:51 ` [PATCH 11/27] x86: Lock down IO port " David Howells
2017-10-20  6:43   ` joeyli
2017-10-19 14:52 ` [PATCH 12/27] x86/msr: Restrict MSR " David Howells
2017-10-20  6:43   ` joeyli
2017-10-20 18:09   ` Alan Cox
2017-10-20 20:48   ` David Howells
2017-10-21  4:39     ` joeyli
2017-10-23 14:49   ` David Howells
2017-10-25 14:03     ` joeyli
2017-10-19 14:52 ` [PATCH 13/27] asus-wmi: Restrict debugfs interface " David Howells
2017-10-20  6:44   ` joeyli
2017-10-19 14:52 ` [PATCH 14/27] ACPI: Limit access to custom_method " David Howells
2017-10-20  6:45   ` joeyli
2017-10-19 14:52 ` [PATCH 15/27] acpi: Ignore acpi_rsdp kernel param when the kernel has been " David Howells
2017-10-20  6:45   ` joeyli
2017-10-19 14:52 ` [PATCH 16/27] acpi: Disable ACPI table override if the kernel is " David Howells
2017-10-20  6:46   ` joeyli
2017-10-19 14:52 ` [PATCH 17/27] acpi: Disable APEI error injection " David Howells
2017-10-20  6:47   ` joeyli
2017-10-19 14:52 ` [PATCH 18/27] bpf: Restrict kernel image access functions when " David Howells
2017-10-19 22:18   ` Alexei Starovoitov
2017-10-20  2:47     ` joeyli
2017-10-20  8:08     ` David Howells
2017-10-20 15:57       ` jlee
2017-10-20 23:00         ` Alexei Starovoitov
2017-10-23 14:51         ` David Howells
2017-10-20 16:03       ` David Howells
2017-10-20 16:43         ` jlee
2017-10-23 14:53         ` David Howells
2017-10-25  7:07           ` joeyli
2017-10-19 22:48   ` David Howells
2017-10-19 23:31     ` Alexei Starovoitov
2017-11-09 17:15     ` David Howells
2017-10-19 14:52 ` [PATCH 19/27] scsi: Lock down the eata driver David Howells
2017-10-19 14:53 ` [PATCH 20/27] Prohibit PCMCIA CIS storage when the kernel is locked down David Howells
2017-10-19 14:53 ` [PATCH 21/27] Lock down TIOCSSERIAL David Howells
2017-10-19 14:53 ` [PATCH 22/27] Lock down module params that specify hardware parameters (eg. ioport) David Howells
2017-10-19 14:53 ` [PATCH 23/27] x86/mmiotrace: Lock down the testmmiotrace module David Howells
2017-10-19 14:53 ` [PATCH 24/27] debugfs: Disallow use of debugfs files when the kernel is locked down David Howells
2017-10-19 14:53 ` [PATCH 25/27] Lock down /proc/kcore David Howells
2017-10-21  2:11   ` James Morris
2017-10-23 14:56   ` David Howells
2017-10-19 14:53 ` [PATCH 26/27] efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode David Howells
2017-10-21  2:19   ` James Morris
2017-10-23 14:58   ` David Howells
2017-10-19 14:53 ` [PATCH 27/27] efi: Lock down the kernel if booted in " David Howells
2017-10-19 22:39 ` [PATCH 00/27] security, efi: Add kernel lockdown David Howells
2017-10-23 14:34 ` [PATCH 04/27] Restrict /dev/mem and /dev/kmem when the kernel is locked down David Howells
2017-10-24 10:48   ` Ethan Zhao
2017-10-24 14:56   ` David Howells
2017-11-02 22:01 ` [PATCH 00/27] security, efi: Add kernel lockdown Mimi Zohar
2017-11-02 22:04 ` Firmware signing -- " David Howells
2017-11-02 22:10   ` Mimi Zohar
2017-11-07 23:07     ` Luis R. Rodriguez
2017-11-08  6:15       ` AKASHI, Takahiro
2017-11-08 19:46         ` Luis R. Rodriguez
2017-11-09  1:48           ` AKASHI, Takahiro
2017-11-09  2:17             ` Mimi Zohar
2017-11-09  4:46               ` AKASHI, Takahiro
2017-11-10 13:37                 ` Mimi Zohar
2017-11-11  2:32                 ` Alan Cox
2017-11-13 11:49                   ` Mimi Zohar
2017-11-13 17:42                   ` Luis R. Rodriguez
2017-11-13 21:08                     ` Alan Cox
2017-12-04 19:51                       ` Luis R. Rodriguez
2017-12-07 15:32                         ` Alan Cox
2017-11-13 21:44                     ` David Howells
2017-11-13 22:09                       ` Linus Torvalds
2017-11-14  0:20                         ` Alan Cox
2017-11-14 12:21                         ` Mimi Zohar
2017-11-14 12:38                           ` Greg Kroah-Hartman
2017-11-14 13:17                             ` Mimi Zohar
2017-11-14 17:34                           ` Linus Torvalds
2017-11-14 19:58                             ` Matthew Garrett
2017-11-14 20:18                               ` Linus Torvalds
2017-11-14 20:31                                 ` Matthew Garrett
2017-11-14 20:35                                   ` Linus Torvalds
2017-11-14 20:37                                     ` Matthew Garrett
2017-11-14 20:50                                 ` Luis R. Rodriguez
2017-11-14 20:55                                   ` Matthew Garrett
2017-11-14 22:14                                     ` James Bottomley
2017-11-14 22:17                                       ` Matthew Garrett
2017-11-14 22:31                                         ` James Bottomley
2017-11-14 22:34                                           ` Matthew Garrett
2017-11-15 11:49                                   ` Mimi Zohar
2017-11-15 17:52                                     ` Luis R. Rodriguez
2017-11-15 19:56                                       ` Mimi Zohar
2017-11-15 20:46                                         ` Luis R. Rodriguez
2017-11-16  0:05                                           ` Mimi Zohar
2017-12-05 10:27                                 ` Pavel Machek
2017-12-07 23:02                                   ` Luis R. Rodriguez
2017-12-08 17:11                                     ` Alan Cox
2017-11-10  1:46             ` Luis R. Rodriguez
2017-11-10 13:45               ` Mimi Zohar
2017-11-13 18:50                 ` Luis R. Rodriguez
2017-11-13 19:08                   ` Luis R. Rodriguez
2017-11-08 20:01       ` Mimi Zohar
2017-11-08 20:09         ` Luis R. Rodriguez
2019-02-28 21:28 [PULL REQUEST] Lock down patches Matthew Garrett
2019-02-28 22:44 ` [PATCH 01/27] Add the ability to lock down access to the running kernel image Matthew Garrett
2019-02-28 23:10 ` Matthew Garrett
2019-02-28 23:11 ` Matthew Garrett
2019-02-28 23:11 ` Matthew Garrett
2019-03-06 23:58 [PULL REQUEST] Kernel lockdown patches for 5.2 Matthew Garrett
2019-03-06 23:58 ` [PATCH 01/27] Add the ability to lock down access to the running kernel image Matthew Garrett
2019-03-25 22:09 [PULL REQUEST] Lockdown patches for 5.2 Matthew Garrett
2019-03-25 22:09 ` [PATCH 01/27] Add the ability to lock down access to the running kernel image Matthew Garrett
2019-03-26  5:30   ` Matthew Garrett

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=150842463996.7923.6815305873334959305.stgit@warthog.procyon.org.uk \
    --to=dhowells@redhat.com \
    --cc=gnomes@lxorguk.ukuu.org.uk \
    --cc=gregkh@linuxfoundation.org \
    --cc=jforbes@redhat.com \
    --cc=linux-efi@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=matthew.garrett@nebula.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git
	git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git
	git clone --mirror https://lore.kernel.org/lkml/8 lkml/git/8.git
	git clone --mirror https://lore.kernel.org/lkml/9 lkml/git/9.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
		linux-kernel@vger.kernel.org
	public-inbox-index lkml

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git