Received-SPF: pass (google.com: domain of linux-kernel+bounces-137432-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
From: Adrian Ratiu <adrian.ratiu@collabora.com>
To: linux-fsdevel@vger.kernel.org
Cc: linux-security-module@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	linux-hardening@vger.kernel.org,
	linux-doc@vger.kernel.org,
	kernel@collabora.com,
	gbiv@google.com,
	ryanbeltran@google.com,
	inglorion@google.com,
	ajordanr@google.com,
	jorgelo@chromium.org,
	Adrian Ratiu <adrian.ratiu@collabora.com>,
	Guenter Roeck <groeck@chromium.org>,
	Doug Anderson <dianders@chromium.org>,
	Kees Cook <keescook@chromium.org>,
	Jann Horn <jannh@google.com>,
	Andrew Morton <akpm@linux-foundation.org>,
	Randy Dunlap <rdunlap@infradead.org>,
	Christian Brauner <brauner@kernel.org>
Subject: [PATCH v3 2/2] proc: add Kconfigs to restrict /proc/pid/mem access
Date: Tue,  9 Apr 2024 20:57:50 +0300
Message-ID: <20240409175750.206445-2-adrian.ratiu@collabora.com>
In-Reply-To: <20240409175750.206445-1-adrian.ratiu@collabora.com>
References: <20240409175750.206445-1-adrian.ratiu@collabora.com>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Some systems might have difficulty changing their bootloaders
to enable the newly added restrict_proc_mem* params, for e.g.
remote embedded doing OTA updates, so this provides a set of
Kconfigs to set /proc/pid/mem restrictions at build-time.

The boot params take precedence over the Kconfig values. This
can be reversed, but doing it this way I think makes sense.

Another idea is to have a global bool Kconfig which can enable
or disable this mechanism in its entirety, however it does not
seem necessary since all three knobs default to off, the branch
logic overhead is rather minimal and I assume most of systems
will want to restrict at least the use of FOLL_FORCE.

Cc: Guenter Roeck <groeck@chromium.org>
Cc: Doug Anderson <dianders@chromium.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Jann Horn <jannh@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Randy Dunlap <rdunlap@infradead.org>
Cc: Christian Brauner <brauner@kernel.org>
Signed-off-by: Adrian Ratiu <adrian.ratiu@collabora.com>
---
 fs/proc/base.c   | 33 +++++++++++++++++++++++++++++++++
 security/Kconfig | 42 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 75 insertions(+)

diff --git a/fs/proc/base.c b/fs/proc/base.c
index c733836c42a65..e8ee848fc4a98 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -889,6 +889,17 @@ static int __mem_open_check_access_restriction(struct file *file)
 		    !__mem_open_current_is_ptracer(file))
 			return -EACCES;
 
+#ifdef CONFIG_SECURITY_PROC_MEM_WRITE_RESTRICT
+		/* Deny if writes are unconditionally disabled via Kconfig */
+		if (!strncmp(CONFIG_SECURITY_PROC_MEM_WRITE_RESTRICT, "all", 3))
+			return -EACCES;
+
+		/* Deny if writes are allowed only for ptracers via Kconfig */
+		if (!strncmp(CONFIG_SECURITY_PROC_MEM_WRITE_RESTRICT, "ptracer", 7) &&
+		    !__mem_open_current_is_ptracer(file))
+			return -EACCES;
+#endif
+
 	} else if (file->f_mode & FMODE_READ) {
 		/* Deny if reads are unconditionally disabled via param */
 		if (static_branch_unlikely(&restrict_proc_mem[2]))
@@ -898,6 +909,17 @@ static int __mem_open_check_access_restriction(struct file *file)
 		if (static_branch_unlikely(&restrict_proc_mem[3]) &&
 		    !__mem_open_current_is_ptracer(file))
 			return -EACCES;
+
+#ifdef CONFIG_SECURITY_PROC_MEM_READ_RESTRICT
+		/* Deny if reads are unconditionally disabled via Kconfig */
+		if (!strncmp(CONFIG_SECURITY_PROC_MEM_READ_RESTRICT, "all", 3))
+			return -EACCES;
+
+		/* Deny if reads are allowed only for ptracers via Kconfig */
+		if (!strncmp(CONFIG_SECURITY_PROC_MEM_READ_RESTRICT, "ptracer", 7) &&
+		    !__mem_open_current_is_ptracer(file))
+			return -EACCES;
+#endif
 	}
 
 	return 0;
@@ -930,6 +952,17 @@ static unsigned int __mem_rw_get_foll_force_flag(struct file *file)
 	    !__mem_open_current_is_ptracer(file))
 		return 0;
 
+#ifdef CONFIG_SECURITY_PROC_MEM_FOLL_FORCE_RESTRICT
+	/* Deny if FOLL_FORCE is disabled via Kconfig */
+	if (!strncmp(CONFIG_SECURITY_PROC_MEM_FOLL_FORCE_RESTRICT, "all", 3))
+		return 0;
+
+	/* Deny if FOLL_FORCE is only allowed for ptracers via Kconfig */
+	if (!strncmp(CONFIG_SECURITY_PROC_MEM_FOLL_FORCE_RESTRICT, "ptracer", 7) &&
+	    !__mem_open_current_is_ptracer(file))
+		return 0;
+#endif
+
 	return FOLL_FORCE;
 }
 
diff --git a/security/Kconfig b/security/Kconfig
index 412e76f1575d0..31a588cedec8d 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -19,6 +19,48 @@ config SECURITY_DMESG_RESTRICT
 
 	  If you are unsure how to answer this question, answer N.
 
+config SECURITY_PROC_MEM_READ_RESTRICT
+	string "Restrict read access to /proc/*/mem files"
+	depends on PROC_FS
+	default "none"
+	help
+	  This option allows specifying a restriction level for read access
+	  to /proc/*/mem files. Can be one of:
+	  - 'all' restricts all access unconditionally.
+	  - 'ptracer' allows access only for ptracer processes.
+
+	  This can also be set at boot with the "restrict_proc_mem_read=" param.
+
+	  If unsure leave empty to continue using basic file permissions.
+
+config SECURITY_PROC_MEM_WRITE_RESTRICT
+	string "Restrict write access to /proc/*/mem files"
+	depends on PROC_FS
+	default "none"
+	help
+	  This option allows specifying a restriction level for write access
+	  to /proc/*/mem files. Can be one of:
+	  - 'all' restricts all access unconditionally.
+	  - 'ptracer' allows access only for ptracer processes.
+
+	  This can also be set at boot with the "restrict_proc_mem_write=" param.
+
+	  If unsure leave empty to continue using basic file permissions.
+
+config SECURITY_PROC_MEM_FOLL_FORCE_RESTRICT
+	string "Restrict use of FOLL_FORCE for /proc/*/mem access"
+	depends on PROC_FS
+	default ""
+	help
+	  This option allows specifying a restriction level for FOLL_FORCE usage
+	  for /proc/*/mem access. Can be one of:
+	  - 'all' restricts all access unconditionally.
+	  - 'ptracer' allows access only for ptracer processes.
+
+	  This can also be set at boot with the "restrict_proc_mem_foll_force=" param.
+
+	  If unsure leave empty to continue using FOLL_FORCE without restriction.
+
 config SECURITY
 	bool "Enable different security models"
 	depends on SYSFS
-- 
2.30.2