Disallow the creation of perf and ftrace kprobes when the kernel is locked down in confidentiality mode by preventing their registration. This prevents kprobes from being used to access kernel memory to steal crypto data, but continues to allow the use of kprobes from signed modules.
Unified · Split
| @@ -117,6 +117,7 @@ enum lockdown_reason { · 116 unmodified lines | ||
| 117 | 117 | LOCKDOWN_MMIOTRACE, |
| 118 | 118 | LOCKDOWN_INTEGRITY_MAX, |
| 119 | 119 | LOCKDOWN_KCORE, |
| 120 | + LOCKDOWN_KPROBES, | |
| 120 | 121 | LOCKDOWN_CONFIDENTIALITY_MAX, |
| 121 | 122 | }; |
| 122 | 123 | |
| @@ -11,6 +11,7 @@ · 10 unmodified lines | ||
| 11 | 11 | #include <linux/uaccess.h> |
| 12 | 12 | #include <linux/rculist.h> |
| 13 | 13 | #include <linux/error-injection.h> |
| 14 | +#include <linux/security.h> | |
| 14 | 15 | |
| 15 | 16 | #include "trace_dynevent.h" |
| 16 | 17 | #include "trace_kprobe_selftest.h" |
| @@ -415,6 +416,10 @@ static int __register_trace_kprobe(struct trace_kprobe *tk) · 398 unmodified lines | ||
| 415 | 416 | { |
| 416 | 417 | int i, ret; |
| 417 | 418 | |
| 419 | + ret = security_locked_down(LOCKDOWN_KPROBES); | |
| 420 | + if (ret) | |
| 421 | + return ret; | |
| 422 | + | |
| 418 | 423 | if (trace_probe_is_registered(&tk->tp)) |
| 419 | 424 | return -EINVAL; |
| 420 | 425 | |
| @@ -32,6 +32,7 @@ static char *lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = { · 31 unmodified lines | ||
| 32 | 32 | [LOCKDOWN_MMIOTRACE] = "unsafe mmio", |
| 33 | 33 | [LOCKDOWN_INTEGRITY_MAX] = "integrity", |
| 34 | 34 | [LOCKDOWN_KCORE] = "/proc/kcore access", |
| 35 | + [LOCKDOWN_KPROBES] = "use of kprobes", | |
| 35 | 36 | [LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality", |
| 36 | 37 | }; |
| 37 | 38 | |