From patchwork Tue Jul 7 08:19:23 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 11648003 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id A6B5C14DD for ; Tue, 7 Jul 2020 08:19:41 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8E047206F6 for ; Tue, 7 Jul 2020 08:19:41 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="d2fuJhBs" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728207AbgGGITi (ORCPT ); Tue, 7 Jul 2020 04:19:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51506 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728152AbgGGITd (ORCPT ); Tue, 7 Jul 2020 04:19:33 -0400 Received: from mail-pf1-x444.google.com (mail-pf1-x444.google.com [IPv6:2607:f8b0:4864:20::444]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C3EAAC08C5E0 for ; Tue, 7 Jul 2020 01:19:33 -0700 (PDT) Received: by mail-pf1-x444.google.com with SMTP id a14so13537987pfi.2 for ; Tue, 07 Jul 2020 01:19:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=8LzHvhyH79XNraI64aGNs932IW1tYhCTGhfJh2lEVIw=; b=d2fuJhBs1yWbjePYoqvJWYZe1SRSJgbjp553u56FFd31yWYbHWdQauk74RXaM6QK5Z 6wtktQwojSEogkmCtIrko7hYiDkU9vh+r9y+G9YbC23l+ldCh74l7x4YprTb5e1AAhlW wDajPTrKHOXyHe/oURDusoQV86iqeDJZ91LRk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=8LzHvhyH79XNraI64aGNs932IW1tYhCTGhfJh2lEVIw=; b=cnOPkndDoypqIU5gDDx84jvd5lW9pWeTGkQVUDBl4VpIfKaEFIVWm2YppHtvmCEcGc +3J04bMZs51SOLUunTG0U2CvQJp/jLJWMrQjMiwayZTU6E8g6AcR8TxzWmgfzCbAWg84 yoHPj/0ADBwJ2Z12dymhnSeWlxtgCRWuNzgwLt2IIyGCbL+ofFNSiOs2Ggbx5LIM3byD d/xoFYDvlSYZ3T4GbFGdXAYtN6+UpWNL9QqnRGXdvS3r7HQtmeqML4SjlNCm7FEzieuw 2dqcb1WIZF8nQ+OfnF7JMl+p9sPvkcMVK4Ywyzrvp9Ea3cEAuoknc3MmXGayMcJOSeZH U4cg== X-Gm-Message-State: AOAM532rISyAajHPtKqkxNs33le1f9zwcolyLmM7v/4DP5xUBdbs6cTa LGxU6l8CoOKHILJxajWc79wihA== X-Google-Smtp-Source: ABdhPJwlmQnAhT5yC6LPH3rR/m0Ap5gtjZUGRRbIWoOIwPOnnsVXMjkjdE7a5NAxP236CA/vqMmsAw== X-Received: by 2002:a63:2b93:: with SMTP id r141mr43550710pgr.171.1594109973034; Tue, 07 Jul 2020 01:19:33 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id s10sm1821622pjl.41.2020.07.07.01.19.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 07 Jul 2020 01:19:30 -0700 (PDT) From: Kees Cook To: James Morris Cc: Kees Cook , stable@vger.kernel.org, Luis Chamberlain , Mimi Zohar , Scott Branden , Greg Kroah-Hartman , "Rafael J. Wysocki" , Alexander Viro , Jessica Yu , Dmitry Kasatkin , "Serge E. Hallyn" , Casey Schaufler , "Eric W. Biederman" , Peter Zijlstra , Matthew Garrett , David Howells , Mauro Carvalho Chehab , Randy Dunlap , "Joel Fernandes (Google)" , KP Singh , Dave Olsthoorn , Hans de Goede , Peter Jones , Andrew Morton , Stephen Boyd , Paul Moore , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [PATCH 1/4] firmware_loader: EFI firmware loader must handle pre-allocated buffer Date: Tue, 7 Jul 2020 01:19:23 -0700 Message-Id: <20200707081926.3688096-2-keescook@chromium.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200707081926.3688096-1-keescook@chromium.org> References: <20200707081926.3688096-1-keescook@chromium.org> MIME-Version: 1.0 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org The EFI platform firmware fallback would clobber any pre-allocated buffers. Instead, correctly refuse to reallocate when too small (as already done in the sysfs fallback), or perform allocation normally when needed. Fixes: e4c2c0ff00ec ("firmware: Add new platform fallback mechanism and firm ware_request_platform()") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook --- drivers/base/firmware_loader/fallback_platform.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/base/firmware_loader/fallback_platform.c b/drivers/base/firmware_loader/fallback_platform.c index cdd2c9a9f38a..685edb7dd05a 100644 --- a/drivers/base/firmware_loader/fallback_platform.c +++ b/drivers/base/firmware_loader/fallback_platform.c @@ -25,7 +25,10 @@ int firmware_fallback_platform(struct fw_priv *fw_priv, u32 opt_flags) if (rc) return rc; /* rc == -ENOENT when the fw was not found */ - fw_priv->data = vmalloc(size); + if (fw_priv->data && size > fw_priv->allocated_size) + return -ENOMEM; + if (!fw_priv->data) + fw_priv->data = vmalloc(size); if (!fw_priv->data) return -ENOMEM; From patchwork Tue Jul 7 08:19:24 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 11648007 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 1052B912 for ; Tue, 7 Jul 2020 08:19:44 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E3765206E2 for ; Tue, 7 Jul 2020 08:19:43 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="ZeE/vfgK" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728182AbgGGITi (ORCPT ); Tue, 7 Jul 2020 04:19:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51492 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728162AbgGGITe (ORCPT ); Tue, 7 Jul 2020 04:19:34 -0400 Received: from mail-pf1-x441.google.com (mail-pf1-x441.google.com [IPv6:2607:f8b0:4864:20::441]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1C1B0C08C5E2 for ; Tue, 7 Jul 2020 01:19:34 -0700 (PDT) Received: by mail-pf1-x441.google.com with SMTP id u185so16076509pfu.1 for ; Tue, 07 Jul 2020 01:19:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=oXmMUA+Slmu9lbYRAJIZHSMzlajqISgWM80EG35cNbg=; b=ZeE/vfgK+v1GqxYTXUNDmF5e4/g8r2Ag6iu8mzSJEkdVGm9dB1k7swD0RAVU24nTiG 7SBN7HaMbE+vWnkOfjl94jR8dvSapP0o8KaY7KKDOMRjyZ8iu+UduP+5EBnrStRPh/KV 8JQXl7MBiiW+TlBbhV6wxfykp90S//DeLS5UM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=oXmMUA+Slmu9lbYRAJIZHSMzlajqISgWM80EG35cNbg=; b=aHDMBdZLtVRn3S7RUFz8ODI6o54uzAhnl21Nzyvac6rn7AWYMp5kkjZy+I6NiPSyNn FAOL0juQ8nJ9FyPJpUy4smy6niaTHI/42yMm0/7gz9iPiK4ivSKZRWTOUhI8fI1A33Rb FNLYbnv9LzEe4xnTG/R4umGQT6O5rMCdxUdYeMP5afoh2R5Dr+idNd0+h1Wq3mllcdMy nGVm1J+/inTUUN+ujYuP4jwDXxb3pNw05aFMRS0Tytk++NxziZbqXVgx/bDCIZvr1sG7 sHKesQRO2HlN/yTvCGwgA/x0xELyrOvxPwzWf2c1HvzEyXEPIe6HPcCs3PdymfFcYmfP X1bA== X-Gm-Message-State: AOAM5310rzOVLO74vBqEK0OeSqx7arKd9/d33MthFUs5nJkAoiQdcrIN r7R8mPaT662gQSmv1nE9e0wmdg== X-Google-Smtp-Source: ABdhPJzNhYHBYnkkxr0IEIYYTJP1XkKnUvqNP/Ht2HIYfP3jBUvPvi3Me6tsEjyrqJal9c9F0sY0kg== X-Received: by 2002:aa7:93c3:: with SMTP id y3mr37629502pff.206.1594109973630; Tue, 07 Jul 2020 01:19:33 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id b18sm1806653pju.10.2020.07.07.01.19.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 07 Jul 2020 01:19:30 -0700 (PDT) From: Kees Cook To: James Morris Cc: Kees Cook , Luis Chamberlain , Mimi Zohar , Scott Branden , Greg Kroah-Hartman , "Rafael J. Wysocki" , Alexander Viro , Jessica Yu , Dmitry Kasatkin , "Serge E. Hallyn" , Casey Schaufler , "Eric W. Biederman" , Peter Zijlstra , Matthew Garrett , David Howells , Mauro Carvalho Chehab , Randy Dunlap , "Joel Fernandes (Google)" , KP Singh , Dave Olsthoorn , Hans de Goede , Peter Jones , Andrew Morton , Stephen Boyd , Paul Moore , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [PATCH 2/4] fs: Remove FIRMWARE_PREALLOC_BUFFER from kernel_read_file() enums Date: Tue, 7 Jul 2020 01:19:24 -0700 Message-Id: <20200707081926.3688096-3-keescook@chromium.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200707081926.3688096-1-keescook@chromium.org> References: <20200707081926.3688096-1-keescook@chromium.org> MIME-Version: 1.0 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org FIRMWARE_PREALLOC_BUFFER is a "how", not a "what", and confuses the LSMs that are interested in filtering between types of things. The "how" should be an internal detail made uninteresting to the LSMs. Fixes: a098ecd2fa7d ("firmware: support loading into a pre-allocated buffer") Fixes: fd90bc559bfb ("ima: based on policy verify firmware signatures (pre-allocated buffer)") Fixes: 4f0496d8ffa3 ("ima: based on policy warn about loading firmware (pre-allocated buffer)") Signed-off-by: Kees Cook --- drivers/base/firmware_loader/main.c | 5 ++--- fs/exec.c | 7 ++++--- include/linux/fs.h | 2 +- security/integrity/ima/ima_main.c | 6 ++---- 4 files changed, 9 insertions(+), 11 deletions(-) diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c index ca871b13524e..c2f57cedcd6f 100644 --- a/drivers/base/firmware_loader/main.c +++ b/drivers/base/firmware_loader/main.c @@ -465,14 +465,12 @@ fw_get_filesystem_firmware(struct device *device, struct fw_priv *fw_priv, int i, len; int rc = -ENOENT; char *path; - enum kernel_read_file_id id = READING_FIRMWARE; size_t msize = INT_MAX; void *buffer = NULL; /* Already populated data member means we're loading into a buffer */ if (!decompress && fw_priv->data) { buffer = fw_priv->data; - id = READING_FIRMWARE_PREALLOC_BUFFER; msize = fw_priv->allocated_size; } @@ -496,7 +494,8 @@ fw_get_filesystem_firmware(struct device *device, struct fw_priv *fw_priv, /* load firmware files from the mount namespace of init */ rc = kernel_read_file_from_path_initns(path, &buffer, - &size, msize, id); + &size, msize, + READING_FIRMWARE); if (rc) { if (rc != -ENOENT) dev_warn(device, "loading %s failed with error %d\n", diff --git a/fs/exec.c b/fs/exec.c index e6e8a9a70327..2bf549757ce7 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -927,6 +927,7 @@ int kernel_read_file(struct file *file, void **buf, loff_t *size, { loff_t i_size, pos; ssize_t bytes = 0; + void *allocated = NULL; int ret; if (!S_ISREG(file_inode(file)->i_mode) || max_size < 0) @@ -950,8 +951,8 @@ int kernel_read_file(struct file *file, void **buf, loff_t *size, goto out; } - if (id != READING_FIRMWARE_PREALLOC_BUFFER) - *buf = vmalloc(i_size); + if (!*buf) + *buf = allocated = vmalloc(i_size); if (!*buf) { ret = -ENOMEM; goto out; @@ -980,7 +981,7 @@ int kernel_read_file(struct file *file, void **buf, loff_t *size, out_free: if (ret < 0) { - if (id != READING_FIRMWARE_PREALLOC_BUFFER) { + if (allocated) { vfree(*buf); *buf = NULL; } diff --git a/include/linux/fs.h b/include/linux/fs.h index 3f881a892ea7..95fc775ed937 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2993,10 +2993,10 @@ static inline void i_readcount_inc(struct inode *inode) #endif extern int do_pipe_flags(int *, int); +/* This is a list of *what* is being read, not *how*. */ #define __kernel_read_file_id(id) \ id(UNKNOWN, unknown) \ id(FIRMWARE, firmware) \ - id(FIRMWARE_PREALLOC_BUFFER, firmware) \ id(FIRMWARE_EFI_EMBEDDED, firmware) \ id(MODULE, kernel-module) \ id(KEXEC_IMAGE, kexec-image) \ diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index c1583d98c5e5..f80ee4ce4669 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -611,19 +611,17 @@ void ima_post_path_mknod(struct dentry *dentry) int ima_read_file(struct file *file, enum kernel_read_file_id read_id) { /* - * READING_FIRMWARE_PREALLOC_BUFFER - * * Do devices using pre-allocated memory run the risk of the * firmware being accessible to the device prior to the completion * of IMA's signature verification any more than when using two - * buffers? + * buffers? It may be desirable to include the buffer address + * in this API and walk all the dma_map_single() mappings to check. */ return 0; } const int read_idmap[READING_MAX_ID] = { [READING_FIRMWARE] = FIRMWARE_CHECK, - [READING_FIRMWARE_PREALLOC_BUFFER] = FIRMWARE_CHECK, [READING_MODULE] = MODULE_CHECK, [READING_KEXEC_IMAGE] = KEXEC_KERNEL_CHECK, [READING_KEXEC_INITRAMFS] = KEXEC_INITRAMFS_CHECK, From patchwork Tue Jul 7 08:19:25 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 11648017 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 4DB07912 for ; Tue, 7 Jul 2020 08:19:54 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 33E2D206C3 for ; Tue, 7 Jul 2020 08:19:54 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="BBeRz/5+" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728012AbgGGITx (ORCPT ); Tue, 7 Jul 2020 04:19:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51480 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727999AbgGGITd (ORCPT ); Tue, 7 Jul 2020 04:19:33 -0400 Received: from mail-pj1-x1041.google.com (mail-pj1-x1041.google.com [IPv6:2607:f8b0:4864:20::1041]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AC463C08C5EE for ; Tue, 7 Jul 2020 01:19:32 -0700 (PDT) Received: by mail-pj1-x1041.google.com with SMTP id o22so13147943pjw.2 for ; Tue, 07 Jul 2020 01:19:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=sjDrdoX7gf+4DuKtCmuxAh2Xm2q9yMKpqX8nn9fNlAU=; b=BBeRz/5+VJOp1s5xKW+QB/U7Z61hcEMJy79aFjwf2dJ9rKV8hONmZsPCo5Nhh2N9X+ AFYaL+6F5Y74L5ZxmUFHBnaw7KGYEJ/MwF5UAfy1bbvWQL5fIXJHFPyAsl57beknLqxK 4bzhDBr2u3/Ej7fNZaSFsox4Us7VvonmVkQpc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=sjDrdoX7gf+4DuKtCmuxAh2Xm2q9yMKpqX8nn9fNlAU=; b=iQKcG7Kk2mrA2Sl+lZxyWKFKWo/3+9xg6EwrxIvmpDcQunM9b6eNYnL+jS6AOKwkua bTIzVDNRuJJKIdZIzCI2OJtI8yxyFDn/6GkpnzOpEdQKKmxe+114rBcCiXpu46Z917db tab+3PxXqd1EQCfqHy4ilK6dw6JcKsw7ySzlzPVwhsjNSygy7KLkAarqulaQpt77X/cD X78giwWQiOs8mi43LpA9LeUQc2oMV/exjRt1TwHOAUJAbnfvr4zMoHskSTtCjvnvWV5a KzSeR1wkpajdRI7ocAEwkr+MXmnqLf0f/edKRouJLjP/5Nku7S+pjPpjci+g77fZvXJg KC2w== X-Gm-Message-State: AOAM5309xHOpcIww9Qg/kxTPHrNQ+VWBOFIUalQJVBeAS90LSFQGQ6Q+ hQaHnm3p9uDktnOaqlR1EzdpMw== X-Google-Smtp-Source: ABdhPJxGDuEjuYScG46HCLyI9wttHYF86/hPhGKgpCUuGKRMHmNSLyc+lzbiBkHquFjKncIjjpHaBg== X-Received: by 2002:a17:902:40a:: with SMTP id 10mr20914146ple.180.1594109972200; Tue, 07 Jul 2020 01:19:32 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id h9sm21361306pfk.155.2020.07.07.01.19.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 07 Jul 2020 01:19:30 -0700 (PDT) From: Kees Cook To: James Morris Cc: Kees Cook , Luis Chamberlain , Mimi Zohar , Scott Branden , Greg Kroah-Hartman , "Rafael J. Wysocki" , Alexander Viro , Jessica Yu , Dmitry Kasatkin , "Serge E. Hallyn" , Casey Schaufler , "Eric W. Biederman" , Peter Zijlstra , Matthew Garrett , David Howells , Mauro Carvalho Chehab , Randy Dunlap , "Joel Fernandes (Google)" , KP Singh , Dave Olsthoorn , Hans de Goede , Peter Jones , Andrew Morton , Stephen Boyd , Paul Moore , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [PATCH 3/4] fs: Remove FIRMWARE_EFI_EMBEDDED from kernel_read_file() enums Date: Tue, 7 Jul 2020 01:19:25 -0700 Message-Id: <20200707081926.3688096-4-keescook@chromium.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200707081926.3688096-1-keescook@chromium.org> References: <20200707081926.3688096-1-keescook@chromium.org> MIME-Version: 1.0 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org The "FIRMWARE_EFI_EMBEDDED" enum is a "where", not a "what". It should not be distinguished separately from just "FIRMWARE", as this confuses the LSMs about what is being loaded. Additionally, there was no actual validation of the firmware contents happening. Add call to security_kernel_post_read_file() so the contents can be measured/verified, just as the firmware sysfs fallback does. This would allow for IMA (or other LSMs) to validate known-good EFI firmware images. Fixes: e4c2c0ff00ec ("firmware: Add new platform fallback mechanism and firmware_request_platform()") Signed-off-by: Kees Cook --- drivers/base/firmware_loader/fallback_platform.c | 7 ++++++- include/linux/fs.h | 3 +-- include/linux/lsm_hooks.h | 6 +++++- 3 files changed, 12 insertions(+), 4 deletions(-) diff --git a/drivers/base/firmware_loader/fallback_platform.c b/drivers/base/firmware_loader/fallback_platform.c index 685edb7dd05a..76e0c4a7835f 100644 --- a/drivers/base/firmware_loader/fallback_platform.c +++ b/drivers/base/firmware_loader/fallback_platform.c @@ -17,7 +17,7 @@ int firmware_fallback_platform(struct fw_priv *fw_priv, u32 opt_flags) if (!(opt_flags & FW_OPT_FALLBACK_PLATFORM)) return -ENOENT; - rc = security_kernel_load_data(LOADING_FIRMWARE_EFI_EMBEDDED); + rc = security_kernel_load_data(LOADING_FIRMWARE); if (rc) return rc; @@ -25,6 +25,11 @@ int firmware_fallback_platform(struct fw_priv *fw_priv, u32 opt_flags) if (rc) return rc; /* rc == -ENOENT when the fw was not found */ + rc = security_kernel_post_read_file(NULL, (char *)data, size, + READING_FIRMWARE); + if (rc) + return rc; + if (fw_priv->data && size > fw_priv->allocated_size) return -ENOMEM; if (!fw_priv->data) diff --git a/include/linux/fs.h b/include/linux/fs.h index 95fc775ed937..f50a35d54a61 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2993,11 +2993,10 @@ static inline void i_readcount_inc(struct inode *inode) #endif extern int do_pipe_flags(int *, int); -/* This is a list of *what* is being read, not *how*. */ +/* This is a list of *what* is being read, not *how* nor *where*. */ #define __kernel_read_file_id(id) \ id(UNKNOWN, unknown) \ id(FIRMWARE, firmware) \ - id(FIRMWARE_EFI_EMBEDDED, firmware) \ id(MODULE, kernel-module) \ id(KEXEC_IMAGE, kexec-image) \ id(KEXEC_INITRAMFS, kexec-initramfs) \ diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index 95b7c1d32062..7cfc3166a1e2 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -633,15 +633,19 @@ * @kmod_name name of the module requested by the kernel * Return 0 if successful. * @kernel_load_data: - * Load data provided by userspace. + * Load data provided by a non-file source (usually userspace buffer). * @id kernel load data identifier * Return 0 if permission is granted. + * This may be paired with a kernel_post_read_file() with a NULL + * @file, but contains the actual data loaded. * @kernel_read_file: * Read a file specified by userspace. * @file contains the file structure pointing to the file being read * by the kernel. * @id kernel read file identifier * Return 0 if permission is granted. + * This must be paired with a kernel_post_read_file(), which contains + * the actual data read from @file. * @kernel_post_read_file: * Read a file specified by userspace. * @file contains the file structure pointing to the file being read From patchwork Tue Jul 7 08:19:26 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 11647997 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 804B3912 for ; Tue, 7 Jul 2020 08:19:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 67F4D206C3 for ; Tue, 7 Jul 2020 08:19:38 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="bTBN7lfi" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727995AbgGGITc (ORCPT ); Tue, 7 Jul 2020 04:19:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51474 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726879AbgGGITc (ORCPT ); Tue, 7 Jul 2020 04:19:32 -0400 Received: from mail-pf1-x444.google.com (mail-pf1-x444.google.com [IPv6:2607:f8b0:4864:20::444]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E871EC08C5DB for ; Tue, 7 Jul 2020 01:19:31 -0700 (PDT) Received: by mail-pf1-x444.google.com with SMTP id x72so8680550pfc.6 for ; Tue, 07 Jul 2020 01:19:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=3/TGGX2kn2NKL/BgEqb75l7336ZUov57vqrEk8SkHU4=; b=bTBN7lfilcJGYJdlbwQDX/rqp45HFb8HgJGAGBOBV9CKgL4pKePubhej06HA9A/RP4 GYmlJTS16HrfkuEjFWhk2UBxLPGgXCrjCJm0sfYpW7tUAiCXQijLn14wMx50qyTlAyIa KcmWeWhBMi7HFssd/6ma4MzBpKX5m9i8fZazg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=3/TGGX2kn2NKL/BgEqb75l7336ZUov57vqrEk8SkHU4=; b=Zaj34adKbyCEdk18DpDgBkvpsynnQyrelm49sCkSAznduYkn/Hg57EUxZjpPrCho9L TEQag/ZzCLAfE1OZxJLnW3fmRO+Y34F4LSUHsSgY6kdfdEYhkL7x5Lsxw1iqxoLlf7g5 dUouia8yfJt5dztGESsP41AO6cidKbjaWAVyk0Bx6540sYClagV4R1kTmn7NNGtFetjS tjav5wbZM0B7oyKXK728rdkNVYlQGCAe0WZ90OisCOGzixjfrpYM0fzuxXoQVwDdbBNZ sOGmxMhBBawdwGTh24eoxYSiv6ieJogB/xQypArI+38N3EMQ+s6YeWrs68J4SSLB3QgJ 15bw== X-Gm-Message-State: AOAM531VEA8TVoXXD/xzbyeWpKn4OqkcaisgRIQq8p5h6m6Gk26y3vzR LIERDlaybWf/RyitquEU2o0fDA== X-Google-Smtp-Source: ABdhPJziQGymUuXunuRD3Hljwo1v5DLu/Rvol9Qs1TKP88U1Ya5951qLD2hP+Du4ykBwwluuy8bk1A== X-Received: by 2002:a63:df54:: with SMTP id h20mr42712026pgj.319.1594109971059; Tue, 07 Jul 2020 01:19:31 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id r8sm20795455pfh.29.2020.07.07.01.19.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 07 Jul 2020 01:19:30 -0700 (PDT) From: Kees Cook To: James Morris Cc: Kees Cook , Jessica Yu , Luis Chamberlain , Mimi Zohar , Scott Branden , Greg Kroah-Hartman , "Rafael J. Wysocki" , Alexander Viro , Dmitry Kasatkin , "Serge E. Hallyn" , Casey Schaufler , "Eric W. Biederman" , Peter Zijlstra , Matthew Garrett , David Howells , Mauro Carvalho Chehab , Randy Dunlap , "Joel Fernandes (Google)" , KP Singh , Dave Olsthoorn , Hans de Goede , Peter Jones , Andrew Morton , Stephen Boyd , Paul Moore , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [PATCH 4/4] module: Add hook for security_kernel_post_read_file() Date: Tue, 7 Jul 2020 01:19:26 -0700 Message-Id: <20200707081926.3688096-5-keescook@chromium.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200707081926.3688096-1-keescook@chromium.org> References: <20200707081926.3688096-1-keescook@chromium.org> MIME-Version: 1.0 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Calls to security_kernel_load_data() should be paired with a call to security_kernel_post_read_file() with a NULL file argument. Add the missing call so the module contents are visible to the LSMs interested in measuring the module content. (This also paves the way for moving module signature checking out of the module core and into an LSM.) Cc: Jessica Yu Fixes: c77b8cdf745d ("module: replace the existing LSM hook in init_module") Signed-off-by: Kees Cook --- kernel/module.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/kernel/module.c b/kernel/module.c index 0c6573b98c36..af9679f8e5c6 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -2980,7 +2980,12 @@ static int copy_module_from_user(const void __user *umod, unsigned long len, return -EFAULT; } - return 0; + err = security_kernel_post_read_file(NULL, (char *)info->hdr, + info->len, READING_MODULE); + if (err) + vfree(info->hdr); + + return err; } static void free_copy(struct load_info *info)