123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255 |
- // SPDX-License-Identifier: GPL-2.0-only
- /*
- * Module and Firmware Pinning Security Module
- *
- * Copyright 2011-2016 Google Inc.
- *
- * Author: Kees Cook <keescook@chromium.org>
- */
- #define pr_fmt(fmt) "LoadPin: " fmt
- #include <linux/module.h>
- #include <linux/fs.h>
- #include <linux/kernel_read_file.h>
- #include <linux/lsm_hooks.h>
- #include <linux/mount.h>
- #include <linux/blkdev.h>
- #include <linux/path.h>
- #include <linux/sched.h> /* current */
- #include <linux/string_helpers.h>
- static void report_load(const char *origin, struct file *file, char *operation)
- {
- char *cmdline, *pathname;
- pathname = kstrdup_quotable_file(file, GFP_KERNEL);
- cmdline = kstrdup_quotable_cmdline(current, GFP_KERNEL);
- pr_notice("%s %s obj=%s%s%s pid=%d cmdline=%s%s%s\n",
- origin, operation,
- (pathname && pathname[0] != '<') ? "\"" : "",
- pathname,
- (pathname && pathname[0] != '<') ? "\"" : "",
- task_pid_nr(current),
- cmdline ? "\"" : "", cmdline, cmdline ? "\"" : "");
- kfree(cmdline);
- kfree(pathname);
- }
- static int enforce = IS_ENABLED(CONFIG_SECURITY_LOADPIN_ENFORCE);
- static char *exclude_read_files[READING_MAX_ID];
- static int ignore_read_file_id[READING_MAX_ID] __ro_after_init;
- static struct super_block *pinned_root;
- static DEFINE_SPINLOCK(pinned_root_spinlock);
- #ifdef CONFIG_SYSCTL
- static struct ctl_path loadpin_sysctl_path[] = {
- { .procname = "kernel", },
- { .procname = "loadpin", },
- { }
- };
- static struct ctl_table loadpin_sysctl_table[] = {
- {
- .procname = "enforce",
- .data = &enforce,
- .maxlen = sizeof(int),
- .mode = 0644,
- .proc_handler = proc_dointvec_minmax,
- .extra1 = SYSCTL_ZERO,
- .extra2 = SYSCTL_ONE,
- },
- { }
- };
- /*
- * This must be called after early kernel init, since then the rootdev
- * is available.
- */
- static void check_pinning_enforcement(struct super_block *mnt_sb)
- {
- bool ro = false;
- /*
- * If load pinning is not enforced via a read-only block
- * device, allow sysctl to change modes for testing.
- */
- if (mnt_sb->s_bdev) {
- char bdev[BDEVNAME_SIZE];
- ro = bdev_read_only(mnt_sb->s_bdev);
- bdevname(mnt_sb->s_bdev, bdev);
- pr_info("%s (%u:%u): %s\n", bdev,
- MAJOR(mnt_sb->s_bdev->bd_dev),
- MINOR(mnt_sb->s_bdev->bd_dev),
- ro ? "read-only" : "writable");
- } else
- pr_info("mnt_sb lacks block device, treating as: writable\n");
- if (!ro) {
- if (!register_sysctl_paths(loadpin_sysctl_path,
- loadpin_sysctl_table))
- pr_notice("sysctl registration failed!\n");
- else
- pr_info("enforcement can be disabled.\n");
- } else
- pr_info("load pinning engaged.\n");
- }
- #else
- static void check_pinning_enforcement(struct super_block *mnt_sb)
- {
- pr_info("load pinning engaged.\n");
- }
- #endif
- static void loadpin_sb_free_security(struct super_block *mnt_sb)
- {
- /*
- * When unmounting the filesystem we were using for load
- * pinning, we acknowledge the superblock release, but make sure
- * no other modules or firmware can be loaded.
- */
- if (!IS_ERR_OR_NULL(pinned_root) && mnt_sb == pinned_root) {
- pinned_root = ERR_PTR(-EIO);
- pr_info("umount pinned fs: refusing further loads\n");
- }
- }
- static int loadpin_read_file(struct file *file, enum kernel_read_file_id id,
- bool contents)
- {
- struct super_block *load_root;
- const char *origin = kernel_read_file_id_str(id);
- /*
- * If we will not know that we'll be seeing the full contents
- * then we cannot trust a load will be complete and unchanged
- * off disk. Treat all contents=false hooks as if there were
- * no associated file struct.
- */
- if (!contents)
- file = NULL;
- /* If the file id is excluded, ignore the pinning. */
- if ((unsigned int)id < ARRAY_SIZE(ignore_read_file_id) &&
- ignore_read_file_id[id]) {
- report_load(origin, file, "pinning-excluded");
- return 0;
- }
- /* This handles the older init_module API that has a NULL file. */
- if (!file) {
- if (!enforce) {
- report_load(origin, NULL, "old-api-pinning-ignored");
- return 0;
- }
- report_load(origin, NULL, "old-api-denied");
- return -EPERM;
- }
- load_root = file->f_path.mnt->mnt_sb;
- /* First loaded module/firmware defines the root for all others. */
- spin_lock(&pinned_root_spinlock);
- /*
- * pinned_root is only NULL at startup. Otherwise, it is either
- * a valid reference, or an ERR_PTR.
- */
- if (!pinned_root) {
- pinned_root = load_root;
- /*
- * Unlock now since it's only pinned_root we care about.
- * In the worst case, we will (correctly) report pinning
- * failures before we have announced that pinning is
- * enforcing. This would be purely cosmetic.
- */
- spin_unlock(&pinned_root_spinlock);
- check_pinning_enforcement(pinned_root);
- report_load(origin, file, "pinned");
- } else {
- spin_unlock(&pinned_root_spinlock);
- }
- if (IS_ERR_OR_NULL(pinned_root) || load_root != pinned_root) {
- if (unlikely(!enforce)) {
- report_load(origin, file, "pinning-ignored");
- return 0;
- }
- report_load(origin, file, "denied");
- return -EPERM;
- }
- return 0;
- }
- static int loadpin_load_data(enum kernel_load_data_id id, bool contents)
- {
- return loadpin_read_file(NULL, (enum kernel_read_file_id) id, contents);
- }
- static struct security_hook_list loadpin_hooks[] __lsm_ro_after_init = {
- LSM_HOOK_INIT(sb_free_security, loadpin_sb_free_security),
- LSM_HOOK_INIT(kernel_read_file, loadpin_read_file),
- LSM_HOOK_INIT(kernel_load_data, loadpin_load_data),
- };
- static void __init parse_exclude(void)
- {
- int i, j;
- char *cur;
- /*
- * Make sure all the arrays stay within expected sizes. This
- * is slightly weird because kernel_read_file_str[] includes
- * READING_MAX_ID, which isn't actually meaningful here.
- */
- BUILD_BUG_ON(ARRAY_SIZE(exclude_read_files) !=
- ARRAY_SIZE(ignore_read_file_id));
- BUILD_BUG_ON(ARRAY_SIZE(kernel_read_file_str) <
- ARRAY_SIZE(ignore_read_file_id));
- for (i = 0; i < ARRAY_SIZE(exclude_read_files); i++) {
- cur = exclude_read_files[i];
- if (!cur)
- break;
- if (*cur == '\0')
- continue;
- for (j = 0; j < ARRAY_SIZE(ignore_read_file_id); j++) {
- if (strcmp(cur, kernel_read_file_str[j]) == 0) {
- pr_info("excluding: %s\n",
- kernel_read_file_str[j]);
- ignore_read_file_id[j] = 1;
- /*
- * Can not break, because one read_file_str
- * may map to more than on read_file_id.
- */
- }
- }
- }
- }
- static int __init loadpin_init(void)
- {
- pr_info("ready to pin (currently %senforcing)\n",
- enforce ? "" : "not ");
- parse_exclude();
- security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks), "loadpin");
- return 0;
- }
- DEFINE_LSM(loadpin) = {
- .name = "loadpin",
- .init = loadpin_init,
- };
- /* Should not be mutable after boot, so not listed in sysfs (perm == 0). */
- module_param(enforce, int, 0);
- MODULE_PARM_DESC(enforce, "Enforce module/firmware pinning");
- module_param_array_named(exclude, exclude_read_files, charp, NULL, 0);
- MODULE_PARM_DESC(exclude, "Exclude pinning specific read file types");
|