@@ -22,6 +22,10 @@ static inline u64 por_set_kpkeys_level(u64 por, int level)
level == KPKEYS_LVL_PGTABLES ||
level == KPKEYS_LVL_UNRESTRICTED
? POE_RW : POE_R);
+ por = por_set_pkey_perms(por, KPKEYS_PKEY_CRED,
+ level == KPKEYS_LVL_CRED ||
+ level == KPKEYS_LVL_UNRESTRICTED
+ ? POE_RW : POE_R);
return por;
}
@@ -2,6 +2,10 @@
#ifndef __ASM_GENERIC_KPKEYS_H
#define __ASM_GENERIC_KPKEYS_H
+#ifndef KPKEYS_PKEY_CRED
+#define KPKEYS_PKEY_CRED 2
+#endif
+
#ifndef KPKEYS_PKEY_PGTABLES
#define KPKEYS_PKEY_PGTABLES 1
#endif
@@ -10,7 +10,8 @@ struct folio;
#define KPKEYS_LVL_DEFAULT 0
#define KPKEYS_LVL_PGTABLES 1
-#define KPKEYS_LVL_UNRESTRICTED 2
+#define KPKEYS_LVL_CRED 2
+#define KPKEYS_LVL_UNRESTRICTED 3
#define KPKEYS_LVL_MIN KPKEYS_LVL_DEFAULT
#define KPKEYS_LVL_MAX KPKEYS_LVL_UNRESTRICTED
@@ -160,4 +161,10 @@ KPKEYS_GUARD(kpkeys_rcu, KPKEYS_LVL_UNRESTRICTED)
KPKEYS_GUARD_NOOP(kpkeys_rcu)
#endif
+#ifdef CONFIG_KPKEYS_HARDENED_CRED
+KPKEYS_GUARD(kpkeys_hardened_cred, KPKEYS_LVL_CRED)
+#else
+KPKEYS_GUARD_NOOP(kpkeys_hardened_cred)
+#endif
+
#endif /* _LINUX_KPKEYS_H */
We will need a separate pkey to protect struct cred. Allocate one as well as a new kpkeys level that grants write access to that pkey, and add a guard that switches to that level. Signed-off-by: Kevin Brodsky <kevin.brodsky@arm.com> --- arch/arm64/include/asm/kpkeys.h | 4 ++++ include/asm-generic/kpkeys.h | 4 ++++ include/linux/kpkeys.h | 9 ++++++++- 3 files changed, 16 insertions(+), 1 deletion(-)