[lkml]   [2017]   [Nov]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subject[PATCH 00/30] security, efi: Add kernel lockdown

Here's a set of patches to institute a "locked-down mode" in the kernel and
to trigger that mode if the kernel is booted in secure-boot mode or through
the command line.

Enabling CONFIG_LOCK_DOWN_KERNEL makes lockdown mode available.

Enabling CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ will allow a SysRq combination
to lift the lockdown. On x86 this is SysRq+x. The keys must be pressed on
an attached keyboard.

Enabling CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT will cause EFI secure boot to
trigger kernel lockdown.

Inside the kernel, kernel_is_locked_down() is used to check if the kernel
is in lockdown mode.

Note that the secure boot mode entry doesn't work if the kernel is booted
from older versions of i386/x86_64 Grub as there's a bug in Grub whereby it
doesn't initialise the boot_params correctly. The incorrect initialisation
causes sanitize_boot_params() to be triggered, thereby zapping the secure
boot flag determined by the EFI boot wrapper.

A manual page, kernel_lockdown.7, is proposed, to which people will be
directed by messages in dmesg. This lists the features that are restricted
amongst other things. [Note: I need to update this to mention IMA, so I'll
reply with that later].


(*) Made /dev/mem and /dev/kmem explicitly unopenable in lockdown mode,
rather than being unopenable as a side effect of /dev/port being made

(*) Added lockdowns for ftrace and kprobes.

(*) Made the bpf lockdown prohibit the use of sys_bpf entirely.

(*) Made IMA require secure_boot rules in lockdown mode.

(*) Made module signing and kexec allow unsigned images if IMA has been
used to validate the image.

The patches can be found here also:

Chun-Yi Lee (1):
kexec_file: Restrict at runtime if the kernel is locked down

Dave Young (1):
Copy secure_boot flag in boot params across kexec reboot

David Howells (14):
Add the ability to lock down access to the running kernel image
Enforce module signatures if the kernel is locked down
scsi: Lock down the eata driver
Prohibit PCMCIA CIS storage when the kernel is locked down
Lock down module params that specify hardware parameters (eg. ioport)
x86/mmiotrace: Lock down the testmmiotrace module
debugfs: Disallow use of debugfs files when the kernel is locked down
Lock down /proc/kcore
Lock down ftrace
Lock down kprobes
bpf: Restrict kernel image access functions when the kernel is locked down
efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode
efi: Lock down the kernel if booted in secure boot mode

Josh Boyer (2):
hibernate: Disable when the kernel is locked down
acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down

Kyle McMartin (1):
Add a SysRq option to lift kernel lockdown

Linn Crosetto (2):
acpi: Disable ACPI table override if the kernel is locked down
acpi: Disable APEI error injection if the kernel is locked down

Matthew Garrett (8):
Restrict /dev/{mem,kmem,port} when the kernel is locked down
kexec: Disable at runtime if the kernel is locked down
uswsusp: Disable when the kernel is locked down
PCI: Lock down BAR access when the kernel is locked down
x86: Lock down IO port access when the kernel is locked down
x86/msr: Restrict MSR access when the kernel is locked down
asus-wmi: Restrict debugfs interface when the kernel is locked down
ACPI: Limit access to custom_method when the kernel is locked down

Mimi Zohar (1):
ima: require secure_boot rules in lockdown mode

arch/x86/include/asm/setup.h | 2 +
arch/x86/kernel/ioport.c | 6 +-
arch/x86/kernel/kexec-bzimage64.c | 1
arch/x86/kernel/msr.c | 10 +++
arch/x86/kernel/setup.c | 18 +-----
arch/x86/mm/testmmiotrace.c | 3 +
drivers/acpi/apei/einj.c | 3 +
drivers/acpi/custom_method.c | 3 +
drivers/acpi/osl.c | 2 -
drivers/acpi/tables.c | 5 ++
drivers/char/mem.c | 2 +
drivers/firmware/efi/Makefile | 1
drivers/firmware/efi/secureboot.c | 38 ++++++++++++
drivers/input/misc/uinput.c | 1
drivers/pci/pci-sysfs.c | 9 +++
drivers/pci/proc.c | 9 +++
drivers/pci/syscall.c | 3 +
drivers/pcmcia/cistpl.c | 3 +
drivers/platform/x86/asus-wmi.c | 9 +++
drivers/scsi/eata.c | 5 +-
drivers/tty/serial/serial_core.c | 6 ++
drivers/tty/sysrq.c | 19 ++++--
fs/debugfs/file.c | 6 ++
fs/proc/kcore.c | 2 +
include/linux/efi.h | 16 +++--
include/linux/input.h | 5 ++
include/linux/kernel.h | 17 ++++++
include/linux/security.h | 8 +++
include/linux/sysrq.h | 8 ++-
kernel/bpf/syscall.c | 3 +
kernel/debug/kdb/kdb_main.c | 2 -
kernel/kexec.c | 7 ++
kernel/kexec_file.c | 8 +++
kernel/kprobes.c | 3 +
kernel/module.c | 19 ++++--
kernel/params.c | 26 +++++++-
kernel/power/hibernate.c | 2 -
kernel/power/user.c | 3 +
kernel/trace/ftrace.c | 22 +++++++
security/Kconfig | 32 ++++++++++
security/Makefile | 3 +
security/integrity/ima/ima_policy.c | 39 +++++++++----
security/lock_down.c | 108 +++++++++++++++++++++++++++++++++++
43 files changed, 440 insertions(+), 57 deletions(-)
create mode 100644 drivers/firmware/efi/secureboot.c
create mode 100644 security/lock_down.c

 \ /
  Last update: 2017-11-09 18:40    [W:0.302 / U:1.596 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site