Commit | Line | Data |
---|---|---|
9c92ab61 | 1 | // SPDX-License-Identifier: GPL-2.0-only |
9b091556 KC |
2 | /* |
3 | * Module and Firmware Pinning Security Module | |
4 | * | |
5 | * Copyright 2011-2016 Google Inc. | |
6 | * | |
7 | * Author: Kees Cook <keescook@chromium.org> | |
9b091556 KC |
8 | */ |
9 | ||
10 | #define pr_fmt(fmt) "LoadPin: " fmt | |
11 | ||
12 | #include <linux/module.h> | |
13 | #include <linux/fs.h> | |
9b091556 KC |
14 | #include <linux/lsm_hooks.h> |
15 | #include <linux/mount.h> | |
3f1266f1 | 16 | #include <linux/blkdev.h> |
9b091556 KC |
17 | #include <linux/path.h> |
18 | #include <linux/sched.h> /* current */ | |
19 | #include <linux/string_helpers.h> | |
20 | ||
21 | static void report_load(const char *origin, struct file *file, char *operation) | |
22 | { | |
23 | char *cmdline, *pathname; | |
24 | ||
25 | pathname = kstrdup_quotable_file(file, GFP_KERNEL); | |
26 | cmdline = kstrdup_quotable_cmdline(current, GFP_KERNEL); | |
27 | ||
28 | pr_notice("%s %s obj=%s%s%s pid=%d cmdline=%s%s%s\n", | |
29 | origin, operation, | |
30 | (pathname && pathname[0] != '<') ? "\"" : "", | |
31 | pathname, | |
32 | (pathname && pathname[0] != '<') ? "\"" : "", | |
33 | task_pid_nr(current), | |
34 | cmdline ? "\"" : "", cmdline, cmdline ? "\"" : ""); | |
35 | ||
36 | kfree(cmdline); | |
37 | kfree(pathname); | |
38 | } | |
39 | ||
13523bef | 40 | static int enforce = IS_ENABLED(CONFIG_SECURITY_LOADPIN_ENFORCE); |
0ff98480 KW |
41 | static char *exclude_read_files[READING_MAX_ID]; |
42 | static int ignore_read_file_id[READING_MAX_ID] __ro_after_init; | |
9b091556 KC |
43 | static struct super_block *pinned_root; |
44 | static DEFINE_SPINLOCK(pinned_root_spinlock); | |
45 | ||
46 | #ifdef CONFIG_SYSCTL | |
9b091556 KC |
47 | |
48 | static struct ctl_path loadpin_sysctl_path[] = { | |
49 | { .procname = "kernel", }, | |
50 | { .procname = "loadpin", }, | |
51 | { } | |
52 | }; | |
53 | ||
54 | static struct ctl_table loadpin_sysctl_table[] = { | |
55 | { | |
13523bef KC |
56 | .procname = "enforce", |
57 | .data = &enforce, | |
9b091556 KC |
58 | .maxlen = sizeof(int), |
59 | .mode = 0644, | |
60 | .proc_handler = proc_dointvec_minmax, | |
eec4844f MC |
61 | .extra1 = SYSCTL_ZERO, |
62 | .extra2 = SYSCTL_ONE, | |
9b091556 KC |
63 | }, |
64 | { } | |
65 | }; | |
66 | ||
67 | /* | |
68 | * This must be called after early kernel init, since then the rootdev | |
69 | * is available. | |
70 | */ | |
71 | static void check_pinning_enforcement(struct super_block *mnt_sb) | |
72 | { | |
73 | bool ro = false; | |
74 | ||
75 | /* | |
76 | * If load pinning is not enforced via a read-only block | |
77 | * device, allow sysctl to change modes for testing. | |
78 | */ | |
79 | if (mnt_sb->s_bdev) { | |
f4b626d6 KC |
80 | char bdev[BDEVNAME_SIZE]; |
81 | ||
9b091556 | 82 | ro = bdev_read_only(mnt_sb->s_bdev); |
f4b626d6 KC |
83 | bdevname(mnt_sb->s_bdev, bdev); |
84 | pr_info("%s (%u:%u): %s\n", bdev, | |
9b091556 KC |
85 | MAJOR(mnt_sb->s_bdev->bd_dev), |
86 | MINOR(mnt_sb->s_bdev->bd_dev), | |
87 | ro ? "read-only" : "writable"); | |
88 | } else | |
89 | pr_info("mnt_sb lacks block device, treating as: writable\n"); | |
90 | ||
91 | if (!ro) { | |
92 | if (!register_sysctl_paths(loadpin_sysctl_path, | |
93 | loadpin_sysctl_table)) | |
94 | pr_notice("sysctl registration failed!\n"); | |
95 | else | |
13523bef | 96 | pr_info("enforcement can be disabled.\n"); |
9b091556 KC |
97 | } else |
98 | pr_info("load pinning engaged.\n"); | |
99 | } | |
100 | #else | |
101 | static void check_pinning_enforcement(struct super_block *mnt_sb) | |
102 | { | |
103 | pr_info("load pinning engaged.\n"); | |
104 | } | |
105 | #endif | |
106 | ||
107 | static void loadpin_sb_free_security(struct super_block *mnt_sb) | |
108 | { | |
109 | /* | |
110 | * When unmounting the filesystem we were using for load | |
111 | * pinning, we acknowledge the superblock release, but make sure | |
112 | * no other modules or firmware can be loaded. | |
113 | */ | |
114 | if (!IS_ERR_OR_NULL(pinned_root) && mnt_sb == pinned_root) { | |
115 | pinned_root = ERR_PTR(-EIO); | |
116 | pr_info("umount pinned fs: refusing further loads\n"); | |
117 | } | |
118 | } | |
119 | ||
120 | static int loadpin_read_file(struct file *file, enum kernel_read_file_id id) | |
121 | { | |
122 | struct super_block *load_root; | |
123 | const char *origin = kernel_read_file_id_str(id); | |
124 | ||
0ff98480 KW |
125 | /* If the file id is excluded, ignore the pinning. */ |
126 | if ((unsigned int)id < ARRAY_SIZE(ignore_read_file_id) && | |
127 | ignore_read_file_id[id]) { | |
128 | report_load(origin, file, "pinning-excluded"); | |
129 | return 0; | |
130 | } | |
131 | ||
9b091556 KC |
132 | /* This handles the older init_module API that has a NULL file. */ |
133 | if (!file) { | |
13523bef | 134 | if (!enforce) { |
9b091556 KC |
135 | report_load(origin, NULL, "old-api-pinning-ignored"); |
136 | return 0; | |
137 | } | |
138 | ||
139 | report_load(origin, NULL, "old-api-denied"); | |
140 | return -EPERM; | |
141 | } | |
142 | ||
143 | load_root = file->f_path.mnt->mnt_sb; | |
144 | ||
145 | /* First loaded module/firmware defines the root for all others. */ | |
146 | spin_lock(&pinned_root_spinlock); | |
147 | /* | |
148 | * pinned_root is only NULL at startup. Otherwise, it is either | |
149 | * a valid reference, or an ERR_PTR. | |
150 | */ | |
151 | if (!pinned_root) { | |
152 | pinned_root = load_root; | |
153 | /* | |
154 | * Unlock now since it's only pinned_root we care about. | |
155 | * In the worst case, we will (correctly) report pinning | |
156 | * failures before we have announced that pinning is | |
13523bef | 157 | * enforcing. This would be purely cosmetic. |
9b091556 KC |
158 | */ |
159 | spin_unlock(&pinned_root_spinlock); | |
160 | check_pinning_enforcement(pinned_root); | |
161 | report_load(origin, file, "pinned"); | |
162 | } else { | |
163 | spin_unlock(&pinned_root_spinlock); | |
164 | } | |
165 | ||
166 | if (IS_ERR_OR_NULL(pinned_root) || load_root != pinned_root) { | |
13523bef | 167 | if (unlikely(!enforce)) { |
9b091556 KC |
168 | report_load(origin, file, "pinning-ignored"); |
169 | return 0; | |
170 | } | |
171 | ||
172 | report_load(origin, file, "denied"); | |
173 | return -EPERM; | |
174 | } | |
175 | ||
176 | return 0; | |
177 | } | |
178 | ||
c77b8cdf MZ |
179 | static int loadpin_load_data(enum kernel_load_data_id id) |
180 | { | |
181 | return loadpin_read_file(NULL, (enum kernel_read_file_id) id); | |
182 | } | |
183 | ||
ca97d939 | 184 | static struct security_hook_list loadpin_hooks[] __lsm_ro_after_init = { |
9b091556 KC |
185 | LSM_HOOK_INIT(sb_free_security, loadpin_sb_free_security), |
186 | LSM_HOOK_INIT(kernel_read_file, loadpin_read_file), | |
c77b8cdf | 187 | LSM_HOOK_INIT(kernel_load_data, loadpin_load_data), |
9b091556 KC |
188 | }; |
189 | ||
0ff98480 KW |
190 | static void __init parse_exclude(void) |
191 | { | |
192 | int i, j; | |
193 | char *cur; | |
194 | ||
195 | /* | |
196 | * Make sure all the arrays stay within expected sizes. This | |
197 | * is slightly weird because kernel_read_file_str[] includes | |
198 | * READING_MAX_ID, which isn't actually meaningful here. | |
199 | */ | |
200 | BUILD_BUG_ON(ARRAY_SIZE(exclude_read_files) != | |
201 | ARRAY_SIZE(ignore_read_file_id)); | |
202 | BUILD_BUG_ON(ARRAY_SIZE(kernel_read_file_str) < | |
203 | ARRAY_SIZE(ignore_read_file_id)); | |
204 | ||
205 | for (i = 0; i < ARRAY_SIZE(exclude_read_files); i++) { | |
206 | cur = exclude_read_files[i]; | |
207 | if (!cur) | |
208 | break; | |
209 | if (*cur == '\0') | |
210 | continue; | |
211 | ||
212 | for (j = 0; j < ARRAY_SIZE(ignore_read_file_id); j++) { | |
213 | if (strcmp(cur, kernel_read_file_str[j]) == 0) { | |
214 | pr_info("excluding: %s\n", | |
215 | kernel_read_file_str[j]); | |
216 | ignore_read_file_id[j] = 1; | |
217 | /* | |
218 | * Can not break, because one read_file_str | |
219 | * may map to more than on read_file_id. | |
220 | */ | |
221 | } | |
222 | } | |
223 | } | |
224 | } | |
225 | ||
70b62c25 | 226 | static int __init loadpin_init(void) |
9b091556 | 227 | { |
13523bef KC |
228 | pr_info("ready to pin (currently %senforcing)\n", |
229 | enforce ? "" : "not "); | |
0ff98480 | 230 | parse_exclude(); |
d69dece5 | 231 | security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks), "loadpin"); |
70b62c25 | 232 | return 0; |
9b091556 KC |
233 | } |
234 | ||
70b62c25 KC |
235 | DEFINE_LSM(loadpin) = { |
236 | .name = "loadpin", | |
237 | .init = loadpin_init, | |
238 | }; | |
239 | ||
9b091556 | 240 | /* Should not be mutable after boot, so not listed in sysfs (perm == 0). */ |
13523bef KC |
241 | module_param(enforce, int, 0); |
242 | MODULE_PARM_DESC(enforce, "Enforce module/firmware pinning"); | |
0ff98480 KW |
243 | module_param_array_named(exclude, exclude_read_files, charp, NULL, 0); |
244 | MODULE_PARM_DESC(exclude, "Exclude pinning specific read file types"); |