mirror of
https://github.com/torvalds/linux
synced 2024-09-06 18:01:05 +00:00
bpf: Restrict bpf when kernel lockdown is in confidentiality mode
bpf_read() and bpf_read_str() could potentially be abused to (eg) allow private keys in kernel memory to be leaked. Disable them if the kernel has been locked down in confidentiality mode. Suggested-by: Alexei Starovoitov <alexei.starovoitov@gmail.com> Signed-off-by: Matthew Garrett <mjg59@google.com> Reviewed-by: Kees Cook <keescook@chromium.org> cc: netdev@vger.kernel.org cc: Chun-Yi Lee <jlee@suse.com> cc: Alexei Starovoitov <alexei.starovoitov@gmail.com> Cc: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: James Morris <jmorris@namei.org>
This commit is contained in:
parent
a94549dd87
commit
9d1f8be5cf
|
@ -118,6 +118,7 @@ enum lockdown_reason {
|
||||||
LOCKDOWN_INTEGRITY_MAX,
|
LOCKDOWN_INTEGRITY_MAX,
|
||||||
LOCKDOWN_KCORE,
|
LOCKDOWN_KCORE,
|
||||||
LOCKDOWN_KPROBES,
|
LOCKDOWN_KPROBES,
|
||||||
|
LOCKDOWN_BPF_READ,
|
||||||
LOCKDOWN_CONFIDENTIALITY_MAX,
|
LOCKDOWN_CONFIDENTIALITY_MAX,
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
|
@ -139,8 +139,13 @@ BPF_CALL_3(bpf_probe_read, void *, dst, u32, size, const void *, unsafe_ptr)
|
||||||
{
|
{
|
||||||
int ret;
|
int ret;
|
||||||
|
|
||||||
|
ret = security_locked_down(LOCKDOWN_BPF_READ);
|
||||||
|
if (ret < 0)
|
||||||
|
goto out;
|
||||||
|
|
||||||
ret = probe_kernel_read(dst, unsafe_ptr, size);
|
ret = probe_kernel_read(dst, unsafe_ptr, size);
|
||||||
if (unlikely(ret < 0))
|
if (unlikely(ret < 0))
|
||||||
|
out:
|
||||||
memset(dst, 0, size);
|
memset(dst, 0, size);
|
||||||
|
|
||||||
return ret;
|
return ret;
|
||||||
|
@ -566,6 +571,10 @@ BPF_CALL_3(bpf_probe_read_str, void *, dst, u32, size,
|
||||||
{
|
{
|
||||||
int ret;
|
int ret;
|
||||||
|
|
||||||
|
ret = security_locked_down(LOCKDOWN_BPF_READ);
|
||||||
|
if (ret < 0)
|
||||||
|
goto out;
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* The strncpy_from_unsafe() call will likely not fill the entire
|
* The strncpy_from_unsafe() call will likely not fill the entire
|
||||||
* buffer, but that's okay in this circumstance as we're probing
|
* buffer, but that's okay in this circumstance as we're probing
|
||||||
|
@ -577,6 +586,7 @@ BPF_CALL_3(bpf_probe_read_str, void *, dst, u32, size,
|
||||||
*/
|
*/
|
||||||
ret = strncpy_from_unsafe(dst, unsafe_ptr, size);
|
ret = strncpy_from_unsafe(dst, unsafe_ptr, size);
|
||||||
if (unlikely(ret < 0))
|
if (unlikely(ret < 0))
|
||||||
|
out:
|
||||||
memset(dst, 0, size);
|
memset(dst, 0, size);
|
||||||
|
|
||||||
return ret;
|
return ret;
|
||||||
|
|
|
@ -33,6 +33,7 @@ static char *lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = {
|
||||||
[LOCKDOWN_INTEGRITY_MAX] = "integrity",
|
[LOCKDOWN_INTEGRITY_MAX] = "integrity",
|
||||||
[LOCKDOWN_KCORE] = "/proc/kcore access",
|
[LOCKDOWN_KCORE] = "/proc/kcore access",
|
||||||
[LOCKDOWN_KPROBES] = "use of kprobes",
|
[LOCKDOWN_KPROBES] = "use of kprobes",
|
||||||
|
[LOCKDOWN_BPF_READ] = "use of bpf to read kernel RAM",
|
||||||
[LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality",
|
[LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality",
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue