From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932308AbdJXKsw (ORCPT ); Tue, 24 Oct 2017 06:48:52 -0400 Received: from mail-it0-f66.google.com ([209.85.214.66]:46050 "EHLO mail-it0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751825AbdJXKsp (ORCPT ); Tue, 24 Oct 2017 06:48:45 -0400 X-Google-Smtp-Source: ABhQp+TnR7+ObalZiNt9+g9QtZb17aLnn2UxoURWrs7M5DFOYn9q28/yTm+y8ArmJgMVK7AlCnOE7WH39GaZSKZHwYM= MIME-Version: 1.0 In-Reply-To: <18778.1508769258@warthog.procyon.org.uk> References: <150842463163.7923.11081723749106843698.stgit@warthog.procyon.org.uk> <150842466261.7923.14359746674406637357.stgit@warthog.procyon.org.uk> <18778.1508769258@warthog.procyon.org.uk> From: Ethan Zhao Date: Tue, 24 Oct 2017 18:48:44 +0800 Message-ID: Subject: Re: [PATCH 04/27] Restrict /dev/mem and /dev/kmem when the kernel is locked down To: David Howells Cc: joeyli , linux-security-module@vger.kernel.org, gnomes@lxorguk.ukuu.org.uk, linux-efi@vger.kernel.org, Greg KH , LKML , jforbes@redhat.com Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by nfs id v9OAmwwi020418 David， May I ask a question here -- Is it intentionally enabling the read-only mode, so userspace tools like dmidecode could work with kernel_is_locked_down ? while it was impossible to work with the attached patch applied. Is it a security policy change with secure boot ? Thanks, Ethan On Mon, Oct 23, 2017 at 10:34 PM, David Howells wrote: > I think I should replace this patch with the attached. This will prevent > /dev/mem, /dev/kmem and /dev/port from being *opened*, and thereby preventing > read, write and ioctl. > > David > --- > commit e68daa2256986932b9a7d6709cf9e24b30d93583 > Author: Matthew Garrett > Date: Wed May 24 14:56:02 2017 +0100 > > Restrict /dev/{mem,kmem,port} when the kernel is locked down > > Allowing users to read and write to core kernel memory makes it possible > for the kernel to be subverted, avoiding module loading restrictions, and > also to steal cryptographic information. > > Disallow /dev/mem and /dev/kmem from being opened this when the kernel has > been locked down to prevent this. > > Also disallow /dev/port from being opened to prevent raw ioport access and > thus DMA from being used to accomplish the same thing. > > Signed-off-by: Matthew Garrett > Signed-off-by: David Howells > Reviewed-by: "Lee, Chun-Yi" > > diff --git a/drivers/char/mem.c b/drivers/char/mem.c > index 593a8818aca9..0ce5ac0a5c6b 100644 > --- a/drivers/char/mem.c > +++ b/drivers/char/mem.c > @@ -762,6 +762,8 @@ static loff_t memory_lseek(struct file *file, loff_t offset, int orig) > > static int open_port(struct inode *inode, struct file *filp) > { > + if (kernel_is_locked_down("/dev/mem,kmem,port")) > + return -EPERM; > return capable(CAP_SYS_RAWIO) ? 0 : -EPERM; > } >