Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley
        Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United
        Kingdom.
        Registered in England and Wales under Company Registration No. 3798903
From:   David Howells <dhowells@redhat.com>
To:     ananth@linux.vnet.ibm.com
cc:     dhowells@redhat.com, alexei.starovoitov@gmail.com,
        Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>,
        "David S. Miller" <davem@davemloft.net>,
        Masami Hiramatsu <mhiramat@kernel.org>,
        linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [RFC][PATCH] Lock down kprobes
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <11785.1510246325.1@warthog.procyon.org.uk>
Content-Transfer-Encoding: 8BIT
Date:   Thu, 09 Nov 2017 16:52:05 +0000
Message-ID: <11786.1510246325@warthog.procyon.org.uk>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Hi,

I need to lock down kprobes under secure boot conditions as part of the patch
series that can be found here:

	https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/log/?h=efi-lock-down

Can you tell me that if the attached patch is sufficient to the cause?

Thanks,
David
---
commit ffb3484d6e0f1d625f8e84a6a19c139a28a52499
Author: David Howells <dhowells@redhat.com>
Date:   Wed Nov 8 16:14:12 2017 +0000

    Lock down kprobes
    
    Disallow the creation of kprobes when the kernel is locked down by
    preventing their registration.  This prevents kprobes from being used to
    access kernel memory, either to make modifications or to steal crypto data.
    
    Reported-by: Alexei Starovoitov <alexei.starovoitov@gmail.com>
    Signed-off-by: David Howells <dhowells@redhat.com>

diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index a1606a4224e1..f06023b0936c 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1530,6 +1530,9 @@ int register_kprobe(struct kprobe *p)
 	struct module *probed_mod;
 	kprobe_opcode_t *addr;
 
+	if (kernel_is_locked_down("Use of kprobes"))
+		return -EPERM;
+
 	/* Adjust probe address from symbol */
 	addr = kprobe_addr(p);
 	if (IS_ERR(addr))

From 1583607638041240280@xxx Thu Nov 09 16:45:31 +0000 2017
X-GM-THRID: 1583515606617523183
X-Gmail-Labels: Inbox,Category Forums,HistoricalUnread