Received: by 2002:a25:4158:0:0:0:0:0 with SMTP id o85csp5297961yba; Tue, 30 Apr 2019 12:21:23 -0700 (PDT) X-Google-Smtp-Source: APXvYqzQsJj+Gn5UPnmUrt7XcsPqoW/kYmywIFB7+C6amNpC00uWnCapymn067YR1JL4ZspkqGs9 X-Received: by 2002:a63:5020:: with SMTP id e32mr54702151pgb.215.1556652083840; Tue, 30 Apr 2019 12:21:23 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1556652083; cv=none; d=google.com; s=arc-20160816; b=Flz7FT6Qgm2YkuWv93IJNptNfeDQx3Ny0NOU/44qd5soksGWtaByOdzsNqyu1phk9M AlR1n6gVYH1gkiHv0M54dIlyFUeYxIpU1HwTI+xxGfDEuX1I5bvy5nney4tpWmEUl0ib vlApj6VTVUKaDMtCjycvcxJmHUDIqwzUdGxPM+B2nIstSYjRIFTihSzrAQZIhUBXdZuK k1Y/YetJxmTiDXsHaFbFndEGmSfDSb97IkJEvg1JgrwyKjI65xVcQ54rUFYFij6JGQRc d+6rlFBI3CvuFoYqBcLaboNBvdl99dx/Ri2BPce7/83FJgFa7uiNtjxX4wVZBxu6vqzu FgFA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=g3qC6EpvLSeHFr2sRZhVsgJD/RMgh/dYJRkIiVXTq9w=; b=CoFTGhiRDJgWeViD4v+TeT8DRYSaF1gvloitiFiDwc/O5hiTARWAXaijAiO+fQjYLB NIbWgOODKV4Ov7HWJKiC99bjGgGfr4Nyy7g+6Nvfv5cnuSjX2Yt/how3p4itiZLhyyCY Jx/PL7v6d9MDjAqSj2S9OKy3J8RQmiiHEbb6dCMRvnwxHYd6UmN2cDzMvVahd9QoYHt6 8HGrK2ZHeWsNkdvp71oBAkQCky/5xSMOh9TktE1tA8UxSBox+4NfT3tMGs7jyUoeBIV2 vDeJk8fnFqnbDgg9f6wCHsF+m2NhMUuMcLeAToXQFK0Wh7PXbbeCKNiSH2vIENKrfcEi UcLg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b=Nnxc1mQb; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id g6si2568466pgs.500.2019.04.30.12.21.07; Tue, 30 Apr 2019 12:21:23 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b=Nnxc1mQb; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726015AbfD3TTr (ORCPT + 99 others); Tue, 30 Apr 2019 15:19:47 -0400 Received: from mail-oi1-f196.google.com ([209.85.167.196]:41691 "EHLO mail-oi1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726123AbfD3TTr (ORCPT ); Tue, 30 Apr 2019 15:19:47 -0400 Received: by mail-oi1-f196.google.com with SMTP id v23so12055846oif.8 for ; Tue, 30 Apr 2019 12:19:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=g3qC6EpvLSeHFr2sRZhVsgJD/RMgh/dYJRkIiVXTq9w=; b=Nnxc1mQbpIdlfxZJ7b65LkwEBcnT2G3SZCW1ewlTv0HCLQ4SeZltNWI5DB2nRlxokd RbaAGI3WnQpjuhLJY9ogavnDOrcrgDcvHLoP1iCDhPh5D+pmfThLuStn7g+aL5vdM5ar sr/4+METBLx3UHpY+uyqkruCyquSMHVBY6rqFpT8B7wIk5ADufaYUkL6d/EkL+nrEEJL A52w4k7dbRxEjbEjnCVFV55IGN5uMzHbR/DBtTPsL+cdGWrwxwSHUVqQrT8gQ7y1NYdl R9H10F3TJ2anAK5lqoJyjCsDV1U8YOZ066fwedQIWhxvucztM9lbs98EpH9FMtFY+vbv PdHw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=g3qC6EpvLSeHFr2sRZhVsgJD/RMgh/dYJRkIiVXTq9w=; b=XbTJGFhSkCkagreR2l6kWx64Uk0tsYPvJkTiHnhLSOiNq9XmVO4Yoj58h440mGvgdo YXoDua8cy2QAsZ0piAdsHB3nOVB+QlxMD3p/EgxGPZgios0v73XIKuDxVYoRRxXAYCfy 5OlDoRlc0pTcKG4jRRHg67gUtMzMcELrCr7nldJz2fMtCKdAXdv33bpB8qroHjd8aMk1 z8iCNpqE04wm2e3vKlZL141Zkh5AFIyewX0y61IRwgWDDpDT9N6KKrG5307wDX5PuWXs KR2PgofoT0sy7IXS7ANSXF5FD2kywL8kvVz1Cz9wf7QsPg7bj5V8JYjc8J8uoPCl3fXu dnAQ== X-Gm-Message-State: APjAAAV6NPsJEMZL0BEsVgGBtlvyUE5RZ3QhFlVQNN/V4azfkHVG4jPX nNIDOSqFjTQ6I2WZN4RKk9BoM6hUnO/0iPc/Ff2oYQ== X-Received: by 2002:aca:dcd7:: with SMTP id t206mr4274264oig.68.1556651985980; Tue, 30 Apr 2019 12:19:45 -0700 (PDT) MIME-Version: 1.0 References: <20190404003249.14356-1-matthewgarrett@google.com> <20190404003249.14356-23-matthewgarrett@google.com> In-Reply-To: <20190404003249.14356-23-matthewgarrett@google.com> From: Jann Horn Date: Tue, 30 Apr 2019 15:19:20 -0400 Message-ID: Subject: Re: [PATCH V32 22/27] bpf: Restrict bpf when kernel lockdown is in confidentiality mode To: Matthew Garrett , bpf@vger.kernel.org Cc: James Morris , linux-security-module , kernel list , David Howells , Linux API , Andy Lutomirski , Alexei Starovoitov , Matthew Garrett , Network Development , Chun-Yi Lee , Daniel Borkmann Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org +bpf list On Wed, Apr 3, 2019 at 8:34 PM Matthew Garrett wrote: > There are some bpf functions can be used to read kernel memory: > bpf_probe_read, bpf_probe_write_user and bpf_trace_printk. These allow > private keys in kernel memory (e.g. the hibernation image signing key) to > be read by an eBPF program and kernel memory to be altered without > restriction. Disable them if the kernel has been locked down in > confidentiality mode. > > Suggested-by: Alexei Starovoitov > Signed-off-by: David Howells > Signed-off-by: Matthew Garrett > cc: netdev@vger.kernel.org > cc: Chun-Yi Lee > cc: Alexei Starovoitov > Cc: Daniel Borkmann > --- > kernel/trace/bpf_trace.c | 11 +++++++++++ > 1 file changed, 11 insertions(+) > > diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c > index 8b068adb9da1..9e8eda605b5e 100644 > --- a/kernel/trace/bpf_trace.c > +++ b/kernel/trace/bpf_trace.c > @@ -137,6 +137,9 @@ BPF_CALL_3(bpf_probe_read, void *, dst, u32, size, const void *, unsafe_ptr) > { > int ret; > > + if (kernel_is_locked_down("BPF", LOCKDOWN_CONFIDENTIALITY)) > + return -EINVAL; > + > ret = probe_kernel_read(dst, unsafe_ptr, size); > if (unlikely(ret < 0)) > memset(dst, 0, size); This looks wrong. bpf_probe_read_proto is declared with an ARG_PTR_TO_UNINIT_MEM argument, so if you don't do a "memset(dst, 0, size);" like in the probe_kernel_read() error path, the BPF program can read uninitialized memory.