lkml.org 
[lkml]   [2018]   [Mar]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH 4/4] module: Allow to upgrade to validity enforcement in unforced mode
Date
If module signature verification check is enabled but the
validity enforcement is configured to be disabled, it should
be allowed to enable it. Once enabled, it is disallowed to
disable it.

Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
---
kernel/module.c | 39 ++++++++++++++++++++++++++++++++++++---
1 file changed, 36 insertions(+), 3 deletions(-)

diff --git a/kernel/module.c b/kernel/module.c
index e3c6c8e..89704df 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2806,8 +2806,37 @@ static ssize_t modsign_enforce_read(struct file *filp, char __user *ubuf,
return simple_read_from_buffer(ubuf, count, offp, buf, 1);
}

+#ifndef CONFIG_MODULE_SIG_FORCE
+static ssize_t modsign_enforce_write(struct file *filp,
+ const char __user *ubuf,
+ size_t count, loff_t *offp)
+{
+ char buf;
+ ssize_t ret;
+
+ if (*offp > 1)
+ return -EFBIG;
+
+ ret = simple_write_to_buffer(&buf, 1, offp, ubuf, count);
+ if (ret > 0) {
+ if (buf != '1')
+ return -EINVAL;
+
+ sig_enforce = true;
+ pr_notice_once("Kernel module validity enforcement enabled\n");
+
+ ret = count;
+ }
+
+ return ret;
+}
+#endif
+
static const struct file_operations modsign_enforce_ops = {
.read = modsign_enforce_read,
+#ifndef CONFIG_MODULE_SIG_FORCE
+ .write = modsign_enforce_write,
+#endif
.llseek = generic_file_llseek,
};

@@ -2815,14 +2844,18 @@ static int __init securityfs_init(void)
{
struct dentry *modsign_dir;
struct dentry *enforce;
+ umode_t mode;

modsign_dir = securityfs_create_dir("modsign", NULL);
if (IS_ERR(modsign_dir))
return -1;

- enforce = securityfs_create_file("enforce",
- S_IRUSR | S_IRGRP, modsign_dir,
- NULL, &modsign_enforce_ops);
+ mode = S_IRUSR | S_IRGRP;
+ if (!sig_enforce)
+ mode |= S_IWUSR;
+
+ enforce = securityfs_create_file("enforce", mode, modsign_dir, NULL,
+ &modsign_enforce_ops);
if (IS_ERR(enforce))
goto out;

--
1.8.3.1
\
 
 \ /
  Last update: 2018-03-01 10:09    [W:0.053 / U:0.320 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site