@@ -889,6 +889,17 @@ static int __mem_open_check_access_restriction(struct file *file)
!__mem_open_current_is_ptracer(file))
return -EACCES;
+#ifdef CONFIG_SECURITY_PROC_MEM_WRITE_RESTRICT
+ /* Deny if writes are unconditionally disabled via Kconfig */
+ if (!strncmp(CONFIG_SECURITY_PROC_MEM_WRITE_RESTRICT, "all", 3))
+ return -EACCES;
+
+ /* Deny if writes are allowed only for ptracers via Kconfig */
+ if (!strncmp(CONFIG_SECURITY_PROC_MEM_WRITE_RESTRICT, "ptracer", 7) &&
+ !__mem_open_current_is_ptracer(file))
+ return -EACCES;
+#endif
+
} else if (file->f_mode & FMODE_READ) {
/* Deny if reads are unconditionally disabled via param */
if (static_branch_unlikely(&restrict_proc_mem[2]))
@@ -898,6 +909,17 @@ static int __mem_open_check_access_restriction(struct file *file)
if (static_branch_unlikely(&restrict_proc_mem[3]) &&
!__mem_open_current_is_ptracer(file))
return -EACCES;
+
+#ifdef CONFIG_SECURITY_PROC_MEM_READ_RESTRICT
+ /* Deny if reads are unconditionally disabled via Kconfig */
+ if (!strncmp(CONFIG_SECURITY_PROC_MEM_READ_RESTRICT, "all", 3))
+ return -EACCES;
+
+ /* Deny if reads are allowed only for ptracers via Kconfig */
+ if (!strncmp(CONFIG_SECURITY_PROC_MEM_READ_RESTRICT, "ptracer", 7) &&
+ !__mem_open_current_is_ptracer(file))
+ return -EACCES;
+#endif
}
return 0;
@@ -930,6 +952,17 @@ static unsigned int __mem_rw_get_foll_force_flag(struct file *file)
!__mem_open_current_is_ptracer(file))
return 0;
+#ifdef CONFIG_SECURITY_PROC_MEM_FOLL_FORCE_RESTRICT
+ /* Deny if FOLL_FORCE is disabled via Kconfig */
+ if (!strncmp(CONFIG_SECURITY_PROC_MEM_FOLL_FORCE_RESTRICT, "all", 3))
+ return 0;
+
+ /* Deny if FOLL_FORCE is only allowed for ptracers via Kconfig */
+ if (!strncmp(CONFIG_SECURITY_PROC_MEM_FOLL_FORCE_RESTRICT, "ptracer", 7) &&
+ !__mem_open_current_is_ptracer(file))
+ return 0;
+#endif
+
return FOLL_FORCE;
}
@@ -19,6 +19,48 @@ config SECURITY_DMESG_RESTRICT
If you are unsure how to answer this question, answer N.
+config SECURITY_PROC_MEM_READ_RESTRICT
+ string "Restrict read access to /proc/*/mem files"
+ depends on PROC_FS
+ default "none"
+ help
+ This option allows specifying a restriction level for read access
+ to /proc/*/mem files. Can be one of:
+ - 'all' restricts all access unconditionally.
+ - 'ptracer' allows access only for ptracer processes.
+
+ This can also be set at boot with the "restrict_proc_mem_read=" param.
+
+ If unsure leave empty to continue using basic file permissions.
+
+config SECURITY_PROC_MEM_WRITE_RESTRICT
+ string "Restrict write access to /proc/*/mem files"
+ depends on PROC_FS
+ default "none"
+ help
+ This option allows specifying a restriction level for write access
+ to /proc/*/mem files. Can be one of:
+ - 'all' restricts all access unconditionally.
+ - 'ptracer' allows access only for ptracer processes.
+
+ This can also be set at boot with the "restrict_proc_mem_write=" param.
+
+ If unsure leave empty to continue using basic file permissions.
+
+config SECURITY_PROC_MEM_FOLL_FORCE_RESTRICT
+ string "Restrict use of FOLL_FORCE for /proc/*/mem access"
+ depends on PROC_FS
+ default ""
+ help
+ This option allows specifying a restriction level for FOLL_FORCE usage
+ for /proc/*/mem access. Can be one of:
+ - 'all' restricts all access unconditionally.
+ - 'ptracer' allows access only for ptracer processes.
+
+ This can also be set at boot with the "restrict_proc_mem_foll_force=" param.
+
+ If unsure leave empty to continue using FOLL_FORCE without restriction.
+
config SECURITY
bool "Enable different security models"
depends on SYSFS
Some systems might have difficulty changing their bootloaders to enable the newly added restrict_proc_mem* params, for e.g. remote embedded doing OTA updates, so this provides a set of Kconfigs to set /proc/pid/mem restrictions at build-time. The boot params take precedence over the Kconfig values. This can be reversed, but doing it this way I think makes sense. Another idea is to have a global bool Kconfig which can enable or disable this mechanism in its entirety, however it does not seem necessary since all three knobs default to off, the branch logic overhead is rather minimal and I assume most of systems will want to restrict at least the use of FOLL_FORCE. Cc: Guenter Roeck <groeck@chromium.org> Cc: Doug Anderson <dianders@chromium.org> Cc: Kees Cook <keescook@chromium.org> Cc: Jann Horn <jannh@google.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Randy Dunlap <rdunlap@infradead.org> Cc: Christian Brauner <brauner@kernel.org> Signed-off-by: Adrian Ratiu <adrian.ratiu@collabora.com> --- fs/proc/base.c | 33 +++++++++++++++++++++++++++++++++ security/Kconfig | 42 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 75 insertions(+)