Commit b0c8fdc7 authored by David Howells's avatar David Howells Committed by James Morris
Browse files

lockdown: Lock down perf when in confidentiality mode 



Disallow the use of certain perf facilities that might allow userspace to
access kernel data.

Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Signed-off-by: default avatarMatthew Garrett <mjg59@google.com>
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent 9d1f8be5

include/linux/security.h

+1 −0
Original line number Diff line number Diff line
@@ -119,6 +119,7 @@ enum lockdown_reason { 
	LOCKDOWN_KCORE,

	LOCKDOWN_KPROBES,

	LOCKDOWN_BPF_READ,

	LOCKDOWN_PERF,

	LOCKDOWN_CONFIDENTIALITY_MAX,

};

kernel/events/core.c

+7 −0
Original line number Diff line number Diff line
@@ -10798,6 +10798,13 @@ SYSCALL_DEFINE5(perf_event_open, 
	    perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN))

		return -EACCES;



	err = security_locked_down(LOCKDOWN_PERF);

	if (err && (attr.sample_type & PERF_SAMPLE_REGS_INTR))

		/* REGS_INTR can leak data, lockdown must prevent this */

		return err;



	err = 0;



	/*

	 * In cgroup mode, the pid argument is used to pass the fd

	 * opened to the cgroup directory in cgroupfs. The cpu argument

security/lockdown/lockdown.c

+1 −0
Original line number Diff line number Diff line
@@ -34,6 +34,7 @@ static char *lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = { 
	[LOCKDOWN_KCORE] = "/proc/kcore access",

	[LOCKDOWN_KPROBES] = "use of kprobes",

	[LOCKDOWN_BPF_READ] = "use of bpf to read kernel RAM",

	[LOCKDOWN_PERF] = "unsafe use of perf",

	[LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality",

};

CRA Git | Maintained and supported by SUSTech CRA and CCSE