From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934612AbeCHE1M (ORCPT ); Wed, 7 Mar 2018 23:27:12 -0500 Received: from out30-131.freemail.mail.aliyun.com ([115.124.30.131]:45886 "EHLO out30-131.freemail.mail.aliyun.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754066AbeCHE1L (ORCPT ); Wed, 7 Mar 2018 23:27:11 -0500 X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R141e4;CH=green;FP=0|-1|-1|-1|0|-1|-1|-1;HT=e01e01355;MF=zhang.jia@linux.alibaba.com;NM=1;PH=DS;RN=3;SR=0;TI=SMTPD_---0Sz3uhW6_1520483226; From: Jia Zhang To: jeyu@kernel.org Cc: linux-kernel@vger.kernel.org, zhang.jia@linux.alibaba.com Subject: [PATCH 3/4] module: Support to show the current enforcement policy Date: Thu, 8 Mar 2018 12:27:02 +0800 Message-Id: <1520483223-6596-4-git-send-email-zhang.jia@linux.alibaba.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1520483223-6596-1-git-send-email-zhang.jia@linux.alibaba.com> References: <1520483223-6596-1-git-send-email-zhang.jia@linux.alibaba.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org /sys/kernel/security/modsign/enforce gives the result of current enforcement policy of loading module. Signed-off-by: Jia Zhang --- kernel/module.c | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) diff --git a/kernel/module.c b/kernel/module.c index 79825ea..6b032577 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -2794,11 +2794,60 @@ static int module_sig_check(struct load_info *info, int flags) return err; } + +#ifdef CONFIG_SECURITYFS +static ssize_t modsign_enforce_read(struct file *filp, char __user *ubuf, + size_t count, loff_t *offp) +{ + char buf[2]; + + sprintf(buf, "%d", is_module_sig_enforced()); + + return simple_read_from_buffer(ubuf, count, offp, buf, 1); +} + +static const struct file_operations modsign_enforce_ops = { + .read = modsign_enforce_read, + .llseek = generic_file_llseek, +}; + +static int __init securityfs_init(void) +{ + struct dentry *modsign_dir; + struct dentry *enforce; + + modsign_dir = securityfs_create_dir("modsign", NULL); + if (IS_ERR(modsign_dir)) + return -1; + + enforce = securityfs_create_file("enforce", + S_IRUSR | S_IRGRP, modsign_dir, + NULL, &modsign_enforce_ops); + if (IS_ERR(enforce)) + goto out; + + return 0; +out: + securityfs_remove(modsign_dir); + + return -1; +} +#else /* !CONFIG_SECURITYFS */ +static int __init securityfs_init(void) +{ + return 0; +} +#endif #else /* !CONFIG_MODULE_SIG */ static int module_sig_check(struct load_info *info, int flags) { return 0; } + +static int __init securityfs_init(void) +{ + return 0; +} #endif /* !CONFIG_MODULE_SIG */ /* Sanity checks against invalid binaries, wrong arch, weird elf version. */ @@ -4395,8 +4444,14 @@ void module_layout(struct module *mod, static int __init initialize_module(void) { + int ret; + proc_modules_init(); + ret = securityfs_init(); + if (unlikely(ret)) + return ret; + return 0; } module_init(initialize_module); -- 1.8.3.1