linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Thomas Gleixner <tglx@linutronix.de>
To: Matthew Garrett <matthewgarrett@google.com>
Cc: jmorris@namei.org, linux-security-module@vger.kernel.org,
	linux-kernel@vger.kernel.org, dhowells@redhat.com,
	Matthew Garrett <mjg59@srcf.ucam.org>,
	Kees Cook <keescook@chromium.org>,
	x86@kernel.org
Subject: Re: [PATCH 12/27] x86/msr: Restrict MSR access when the kernel is locked down
Date: Tue, 26 Mar 2019 00:40:34 +0100 (CET)	[thread overview]
Message-ID: <alpine.DEB.2.21.1903260003040.1789@nanos.tec.linutronix.de> (raw)
In-Reply-To: <20190325220954.29054-13-matthewgarrett@google.com>

Matthew,

On Mon, 25 Mar 2019, Matthew Garrett wrote:

> From: Matthew Garrett <mjg59@srcf.ucam.org>
> 
> Writing to MSRs should not be allowed if the kernel is locked down, since
> it could lead to execution of arbitrary code in kernel mode.  Based on a
> patch by Kees Cook.
> 
> MSR accesses are logged for the purposes of building up a whitelist as per
> Alan Cox's suggestion.
> 
> Signed-off-by: Matthew Garrett <mjg59@srcf.ucam.org>
> Signed-off-by: David Howells <dhowells@redhat.com>
> Acked-by: Kees Cook <keescook@chromium.org>
> Reviewed-by: Thomas Gleixner <tglx@linutronix.de>

I'm pretty sure, that I reviewed a different version of this, but due to
the lack of:

 1) A version indicator in the subject line, i.e. [PATCH v7 12/27]

 2) A simple change indicator after the --- separator, e.g.

    v6 -> v7: Add MRS logging to dmesg .....

It's tedious to figure out what actually changed here. I just know for sure
that the printk wasn't there before.

It's not a huge effort adding such information, but it's very helpful for
those who are supposed to look at your patches. Those people are drowned in
patches so making it as easy as it goes would be very appreciated.

> +++ b/arch/x86/kernel/msr.c
> @@ -84,6 +84,11 @@ static ssize_t msr_write(struct file *file, const char __user *buf,
>  	int err = 0;
>  	ssize_t bytes = 0;
>  
> +	if (kernel_is_locked_down("Direct MSR access")) {
> +		pr_info("Direct access to MSR %x\n", reg);

I'm really not fond of this at all. /dev/msr should simply die.

Maintaining a whitelist for this is a horrible idea as you will get a
gazillion of excuses why access to a particular MSR is sane. And I'm
neither interested in these discussions nor interested in adding the
whitelist to this trainwreck,

The right thing to do is to provide sane interfaces and that's where we are
moving to. So simply blocking the access with locked down mode might be
very helpful to accelerate that.

Thanks,

	tglx



  reply	other threads:[~2019-03-25 23:40 UTC|newest]

Thread overview: 57+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-03-25 22:09 [PULL REQUEST] Lockdown patches for 5.2 Matthew Garrett
2019-03-25 22:09 ` [PATCH 01/27] Add the ability to lock down access to the running kernel image Matthew Garrett
2019-03-26  5:30   ` Matthew Garrett
2019-03-25 22:09 ` [PATCH 02/27] Enforce module signatures if the kernel is locked down Matthew Garrett
2019-03-25 22:09 ` [PATCH 03/27] Restrict /dev/{mem,kmem,port} when " Matthew Garrett
2019-03-25 22:09 ` [PATCH 04/27] kexec_load: Disable at runtime if " Matthew Garrett
2019-03-25 22:09 ` [PATCH 05/27] Copy secure_boot flag in boot params across kexec reboot Matthew Garrett
2019-03-25 22:09 ` [PATCH 06/27] kexec_file: split KEXEC_VERIFY_SIG into KEXEC_SIG and KEXEC_SIG_FORCE Matthew Garrett
2019-03-25 22:09 ` [PATCH 07/27] kexec_file: Restrict at runtime if the kernel is locked down Matthew Garrett
2019-03-25 22:09 ` [PATCH 08/27] hibernate: Disable when " Matthew Garrett
2019-03-25 22:09 ` [PATCH 09/27] uswsusp: " Matthew Garrett
2019-03-25 22:09 ` [PATCH 10/27] PCI: Lock down BAR access " Matthew Garrett
2019-03-25 22:09 ` [PATCH 11/27] x86: Lock down IO port " Matthew Garrett
2019-03-25 22:09 ` [PATCH 12/27] x86/msr: Restrict MSR " Matthew Garrett
2019-03-25 23:40   ` Thomas Gleixner [this message]
2019-03-25 22:09 ` [PATCH 13/27] ACPI: Limit access to custom_method " Matthew Garrett
2019-03-25 22:09 ` [PATCH 14/27] acpi: Ignore acpi_rsdp kernel param when the kernel has been " Matthew Garrett
2019-03-25 22:09 ` [PATCH 15/27] acpi: Disable ACPI table override if the kernel is " Matthew Garrett
2019-03-25 22:09 ` [PATCH 16/27] acpi: Disable APEI error injection " Matthew Garrett
2019-03-25 22:09 ` [PATCH 17/27] Prohibit PCMCIA CIS storage when " Matthew Garrett
2019-03-25 22:09 ` [PATCH 18/27] Lock down TIOCSSERIAL Matthew Garrett
2019-03-25 22:09 ` [PATCH 19/27] Lock down module params that specify hardware parameters (eg. ioport) Matthew Garrett
2019-03-25 22:09 ` [PATCH 20/27] x86/mmiotrace: Lock down the testmmiotrace module Matthew Garrett
2019-03-25 23:35   ` Steven Rostedt
2019-03-25 22:09 ` [PATCH 21/27] Lock down /proc/kcore Matthew Garrett
2019-03-25 22:09 ` [PATCH 22/27] Lock down kprobes Matthew Garrett
2019-03-26 12:29   ` Masami Hiramatsu
2019-03-26 17:41     ` Matthew Garrett
2019-03-26 22:47       ` Masami Hiramatsu
2019-03-25 22:09 ` [PATCH 23/27] bpf: Restrict kernel image access functions when the kernel is locked down Matthew Garrett
2019-03-25 23:42   ` Stephen Hemminger
2019-03-25 23:59     ` Stephen Hemminger
2019-03-26  0:00     ` Daniel Borkmann
2019-03-26 13:54       ` Jordan Glover
2019-03-26  0:10     ` Andy Lutomirski
2019-03-26 18:57       ` James Morris
2019-03-26 19:22         ` Andy Lutomirski
2019-03-28  3:15           ` James Morris
2019-03-28 18:07             ` Matthew Garrett
2019-03-28 19:23               ` James Morris
2019-03-28 20:08                 ` Matthew Garrett
2019-03-26 20:19         ` Matthew Garrett
2019-03-25 22:09 ` [PATCH 24/27] Lock down perf Matthew Garrett
2019-03-25 22:09 ` [PATCH 25/27] debugfs: Restrict debugfs when the kernel is locked down Matthew Garrett
2019-03-26  0:31   ` Greg Kroah-Hartman
2019-03-26  0:38     ` Matthew Garrett
2019-03-26  0:43       ` Greg Kroah-Hartman
2019-03-25 22:09 ` [PATCH 26/27] lockdown: Print current->comm in restriction messages Matthew Garrett
2019-03-25 22:09 ` [PATCH 27/27] kexec: Allow kexec_file() with appropriate IMA policy when locked down Matthew Garrett
2019-03-26 15:33   ` Mimi Zohar
  -- strict thread matches above, loose matches on Subject: below --
2017-10-19 14:50 [PATCH 00/27] security, efi: Add kernel lockdown David Howells
2017-10-19 14:52 ` [PATCH 12/27] x86/msr: Restrict MSR access when the kernel is locked down David Howells
2017-10-20  6:43   ` joeyli
2017-10-20 18:09   ` Alan Cox
2017-10-20 20:48   ` David Howells
2017-10-21  4:39     ` joeyli
2017-10-23 14:49   ` David Howells
2017-10-25 14:03     ` joeyli

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=alpine.DEB.2.21.1903260003040.1789@nanos.tec.linutronix.de \
    --to=tglx@linutronix.de \
    --cc=dhowells@redhat.com \
    --cc=jmorris@namei.org \
    --cc=keescook@chromium.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=matthewgarrett@google.com \
    --cc=mjg59@srcf.ucam.org \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).