bpf_read() and bpf_read_str() could potentially be abused to (eg) allow
private keys in kernel memory to be leaked. Disable them if the kernel
has been locked down in confidentiality mode.
Suggested-by: Alexei Starovoitov <alexei.starovoi...@gmail.com>
Signed-off-by: Matthew Garrett <mj...@google.com>
Reviewed-by: Kees Cook <keesc...@chromium.org>
cc: netdev@vger.kernel.org
cc: Chun-Yi Lee <j...@suse.com>
cc: Alexei Starovoitov <alexei.starovoi...@gmail.com>
Cc: Daniel Borkmann <dan...@iogearbox.net>
Signed-off-by: James Morris <jmor...@namei.org>
[Backport notes:
The upstream version is using enums, and all that fancy code.
We are just retroffiting UEK5 a bit and just checking to
see if integrity mode has been enabled and if so then
allow it. If the default lockdown mode (confidentiality) is on
then we don't allow it.]
Signed-off-by: Konrad Rzeszutek Wilk <konrad.w...@oracle.com>
---
security/lock_down.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/security/lock_down.c b/security/lock_down.c
index 96ff1badfac0b..1b913f855d48d 100644
--- a/security/lock_down.c
+++ b/security/lock_down.c
@@ -57,9 +57,16 @@ void __init init_lockdown(void)
*/
bool __kernel_is_locked_down(const char *what, bool first)
{
- if (what && first && kernel_locked_down)
+ if (what && first && kernel_locked_down) {
+ /* If we are in integrity mode we allow certain callsites */
+ if (!lockdown_confidentiality) {
+ if ((strcmp(what, "BPF") == 0)) {
+ return 0;
+ }
+ }
pr_notice("Lockdown: %s is restricted; see man
kernel_lockdown.7\n",
what);
+ }
return kernel_locked_down;
}
EXPORT_SYMBOL(__kernel_is_locked_down);
--
2.13.6
