Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756101AbdDMIq0 (ORCPT ); Thu, 13 Apr 2017 04:46:26 -0400 Received: from mx1.redhat.com ([209.132.183.28]:54750 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755138AbdDMIqV (ORCPT ); Thu, 13 Apr 2017 04:46:21 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com D62BB6AAD5 Authentication-Results: ext-mx02.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx02.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=dhowells@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com D62BB6AAD5 Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: <20170406122907.GA53880@ast-mbp.thefacebook.com> References: <20170406122907.GA53880@ast-mbp.thefacebook.com> <149142326734.5101.4596394505987813763.stgit@warthog.procyon.org.uk> <149142344547.5101.4518618716303032193.stgit@warthog.procyon.org.uk> To: Alexei Starovoitov Cc: dhowells@redhat.com, linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org, gnomes@lxorguk.ukuu.org.uk, netdev@vger.kernel.org, Chun-Yi Lee , linux-security-module@vger.kernel.org, keyrings@vger.kernel.org, gregkh@linuxfoundation.org, matthew.garrett@nebula.com Subject: Re: [PATCH 20/24] bpf: Restrict kernel image access functions when the kernel is locked down MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <15282.1492073178.1@warthog.procyon.org.uk> Date: Thu, 13 Apr 2017 09:46:18 +0100 Message-ID: <15283.1492073178@warthog.procyon.org.uk> X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.26]); Thu, 13 Apr 2017 08:46:21 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 816 Lines: 20 Alexei Starovoitov wrote: > this will obviously break the program. Yeah. But if it allows one to twiddle the kernel image or gain access to crypto material... > How about disabling loading tracing programs during the lockdown completely? Interesting thought. I'm not sure how much would actually need locking down here. Turning on tracepoints in the kernel and reading out of the trace buffer, for example, ought to be okay, though if there are any tracepoints that leak crypto information, they may need locking down also. Basically, I think it boils down to: if it can be used to modify the kernel image or read arbitrary data from the kernel image then should probably be forbidden. There have to be exceptions, though, such as loading authenticated kernel modules. David