lkml.org 
[lkml]   [2017]   [Oct]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 18/27] bpf: Restrict kernel image access functions when the kernel is locked down
    On Thu, Oct 19, 2017 at 03:52:49PM +0100, David Howells wrote:
    > From: Chun-Yi Lee <jlee@suse.com>
    >
    > There are some bpf functions can be used to read kernel memory:
    > bpf_probe_read, bpf_probe_write_user and bpf_trace_printk. These allow
    > private keys in kernel memory (e.g. the hibernation image signing key) to
    > be read by an eBPF program. Prohibit those functions when the kernel is
    > locked down.
    >
    > Signed-off-by: Chun-Yi Lee <jlee@suse.com>
    > Signed-off-by: David Howells <dhowells@redhat.com>
    > cc: netdev@vger.kernel.org
    > ---
    >
    > kernel/trace/bpf_trace.c | 11 +++++++++++
    > 1 file changed, 11 insertions(+)
    >
    > diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
    > index dc498b605d5d..35e85a3fdb37 100644
    > --- a/kernel/trace/bpf_trace.c
    > +++ b/kernel/trace/bpf_trace.c
    > @@ -65,6 +65,11 @@ BPF_CALL_3(bpf_probe_read, void *, dst, u32, size, const void *, unsafe_ptr)
    > {
    > int ret;
    >
    > + if (kernel_is_locked_down("BPF")) {
    > + memset(dst, 0, size);
    > + return -EPERM;
    > + }

    That doesn't help the lockdown purpose.
    If you don't trust the root the only way to prevent bpf read
    memory is to disable the whole thing.
    Have a single check in sys_bpf() to disallow everything if kernel_is_locked_down()
    and don't add overhead to critical path like bpf_probe_read().

    \
     
     \ /
      Last update: 2017-10-22 17:30    [W:6.151 / U:0.080 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site