From patchwork Mon Mar 25 22:09:30 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthew Garrett X-Patchwork-Id: 10870245 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 7E29A14DE for ; Mon, 25 Mar 2019 22:12:40 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6847D28C1D for ; Mon, 25 Mar 2019 22:12:40 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 5C8D82905C; Mon, 25 Mar 2019 22:12:40 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-14.5 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,RCVD_IN_DNSWL_HI,USER_IN_DEF_DKIM_WL autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0D95728C1D for ; Mon, 25 Mar 2019 22:12:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730642AbfCYWKH (ORCPT ); Mon, 25 Mar 2019 18:10:07 -0400 Received: from mail-ot1-f73.google.com ([209.85.210.73]:47437 "EHLO mail-ot1-f73.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730605AbfCYWKG (ORCPT ); Mon, 25 Mar 2019 18:10:06 -0400 Received: by mail-ot1-f73.google.com with SMTP id f103so7286931otf.14 for ; Mon, 25 Mar 2019 15:10:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=ygaOrSdGppBoGAldn3hUkJE8lcWsQcCZCWtpw82yF68=; b=i+RZtfwaKLR130wCLRb0HRymzdLNQBWhz+srVgbkCp9K8LknbtrDAqydUBeEgC5PYu fnT3mEAivXx9uic+ygjbI3e5pxjK1yV/0DcAuNdWX9OPgA6g6gO9YbexTjTND6xoxCFf zr+Kp0VN5iTtYFaLXddfDrhpjuz5OGaWd+luD86y0OZt0+BmMPy90A72xF102YLr3S9C FWNjkgqE/opaoDSRU6COJmi3j4Bsvaf4Zm7Cv1CU5n2uDHBIL0dnftmouTyuQCLZOnPV HpaEeKMZ3XXG7u7ehSia+ZDkEtj0nyzYCPhlmGR9E2S5yToBdfc6Bfkj749OaiJmWGqX V5jA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=ygaOrSdGppBoGAldn3hUkJE8lcWsQcCZCWtpw82yF68=; b=uPqZ0E0jtu1ppDDu9/OylLyAagPN1xnXg83S/q8uI7D32dQ+Ls1D6MvpKiBfJcQ0DF ge90eOLE+PsG/BopmkeeBldQUdQGbhNBaoMVA8p4BwsNL+i1QRLdpaTj/sCpAo4whuLj xN7aUKj7HrYHlDQpYOLkXZORCiG55B+MbIJyQjAXV0FsAaz/CrLyXW5FihFYijIjJLyd 6dRBqBlNqVvTw6K4Wz2Vdxy2x3sKsmA/+ZPYOoVrwzGF/eKxPnSlgVmhmXOsiiXTytq3 JbZ/bFGhZcQf2ZUSjgqR1CN9jzzbqVZLFThcBEcjeOhlz3fpp5Z6Y+uMglqC9McMVwsl ZQsw== X-Gm-Message-State: APjAAAWGhxlADV88j0vNRP4NdnxqF/44YilpNRO286alwoWxdv0zoE9A 42CwDBEOCFxYotLLfB3UfnMpekgv2ZO1HGnWvqMmfw== X-Google-Smtp-Source: APXvYqxWRxJS0tYMf4ijmDG93Tsc3sg3PK4wbeYvffPhJv83p8zt89FWps1s8R7sAC0k7avkHGTndLwNZWuBzSLisWNS9g== X-Received: by 2002:aca:c3cc:: with SMTP id t195mr12721683oif.151.1553551805976; Mon, 25 Mar 2019 15:10:05 -0700 (PDT) Date: Mon, 25 Mar 2019 15:09:30 -0700 In-Reply-To: <20190325220954.29054-1-matthewgarrett@google.com> Message-Id: <20190325220954.29054-4-matthewgarrett@google.com> Mime-Version: 1.0 References: <20190325220954.29054-1-matthewgarrett@google.com> X-Mailer: git-send-email 2.21.0.392.gf8f6787159e-goog Subject: [PATCH 03/27] Restrict /dev/{mem,kmem,port} when the kernel is locked down From: Matthew Garrett To: jmorris@namei.org Cc: linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, dhowells@redhat.com, Matthew Garrett , Matthew Garrett , x86@kernel.org Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP From: Matthew Garrett Allowing users to read and write to core kernel memory makes it possible for the kernel to be subverted, avoiding module loading restrictions, and also to steal cryptographic information. Disallow /dev/mem and /dev/kmem from being opened this when the kernel has been locked down to prevent this. Also disallow /dev/port from being opened to prevent raw ioport access and thus DMA from being used to accomplish the same thing. Signed-off-by: Matthew Garrett Signed-off-by: David Howells Signed-off-by: Matthew Garrett Cc: x86@kernel.org --- drivers/char/mem.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/char/mem.c b/drivers/char/mem.c index b08dc50f9f26..0a2f2e75d5f4 100644 --- a/drivers/char/mem.c +++ b/drivers/char/mem.c @@ -786,6 +786,8 @@ static loff_t memory_lseek(struct file *file, loff_t offset, int orig) static int open_port(struct inode *inode, struct file *filp) { + if (kernel_is_locked_down("/dev/mem,kmem,port")) + return -EPERM; return capable(CAP_SYS_RAWIO) ? 0 : -EPERM; }