Commit | Line | Data |
---|---|---|
9c92ab61 | 1 | // SPDX-License-Identifier: GPL-2.0-only |
9b091556 KC |
2 | /* |
3 | * Module and Firmware Pinning Security Module | |
4 | * | |
5 | * Copyright 2011-2016 Google Inc. | |
6 | * | |
7 | * Author: Kees Cook <keescook@chromium.org> | |
9b091556 KC |
8 | */ |
9 | ||
10 | #define pr_fmt(fmt) "LoadPin: " fmt | |
11 | ||
12 | #include <linux/module.h> | |
13 | #include <linux/fs.h> | |
b89999d0 | 14 | #include <linux/kernel_read_file.h> |
9b091556 KC |
15 | #include <linux/lsm_hooks.h> |
16 | #include <linux/mount.h> | |
3f1266f1 | 17 | #include <linux/blkdev.h> |
9b091556 KC |
18 | #include <linux/path.h> |
19 | #include <linux/sched.h> /* current */ | |
20 | #include <linux/string_helpers.h> | |
21 | ||
22 | static void report_load(const char *origin, struct file *file, char *operation) | |
23 | { | |
24 | char *cmdline, *pathname; | |
25 | ||
26 | pathname = kstrdup_quotable_file(file, GFP_KERNEL); | |
27 | cmdline = kstrdup_quotable_cmdline(current, GFP_KERNEL); | |
28 | ||
29 | pr_notice("%s %s obj=%s%s%s pid=%d cmdline=%s%s%s\n", | |
30 | origin, operation, | |
31 | (pathname && pathname[0] != '<') ? "\"" : "", | |
32 | pathname, | |
33 | (pathname && pathname[0] != '<') ? "\"" : "", | |
34 | task_pid_nr(current), | |
35 | cmdline ? "\"" : "", cmdline, cmdline ? "\"" : ""); | |
36 | ||
37 | kfree(cmdline); | |
38 | kfree(pathname); | |
39 | } | |
40 | ||
13523bef | 41 | static int enforce = IS_ENABLED(CONFIG_SECURITY_LOADPIN_ENFORCE); |
0ff98480 KW |
42 | static char *exclude_read_files[READING_MAX_ID]; |
43 | static int ignore_read_file_id[READING_MAX_ID] __ro_after_init; | |
9b091556 KC |
44 | static struct super_block *pinned_root; |
45 | static DEFINE_SPINLOCK(pinned_root_spinlock); | |
46 | ||
47 | #ifdef CONFIG_SYSCTL | |
9b091556 KC |
48 | |
49 | static struct ctl_path loadpin_sysctl_path[] = { | |
50 | { .procname = "kernel", }, | |
51 | { .procname = "loadpin", }, | |
52 | { } | |
53 | }; | |
54 | ||
55 | static struct ctl_table loadpin_sysctl_table[] = { | |
56 | { | |
13523bef KC |
57 | .procname = "enforce", |
58 | .data = &enforce, | |
9b091556 KC |
59 | .maxlen = sizeof(int), |
60 | .mode = 0644, | |
61 | .proc_handler = proc_dointvec_minmax, | |
eec4844f MC |
62 | .extra1 = SYSCTL_ZERO, |
63 | .extra2 = SYSCTL_ONE, | |
9b091556 KC |
64 | }, |
65 | { } | |
66 | }; | |
67 | ||
68 | /* | |
69 | * This must be called after early kernel init, since then the rootdev | |
70 | * is available. | |
71 | */ | |
72 | static void check_pinning_enforcement(struct super_block *mnt_sb) | |
73 | { | |
74 | bool ro = false; | |
75 | ||
76 | /* | |
77 | * If load pinning is not enforced via a read-only block | |
78 | * device, allow sysctl to change modes for testing. | |
79 | */ | |
80 | if (mnt_sb->s_bdev) { | |
81 | ro = bdev_read_only(mnt_sb->s_bdev); | |
ed5edd5a | 82 | pr_info("%pg (%u:%u): %s\n", mnt_sb->s_bdev, |
9b091556 KC |
83 | MAJOR(mnt_sb->s_bdev->bd_dev), |
84 | MINOR(mnt_sb->s_bdev->bd_dev), | |
85 | ro ? "read-only" : "writable"); | |
86 | } else | |
87 | pr_info("mnt_sb lacks block device, treating as: writable\n"); | |
88 | ||
89 | if (!ro) { | |
90 | if (!register_sysctl_paths(loadpin_sysctl_path, | |
91 | loadpin_sysctl_table)) | |
92 | pr_notice("sysctl registration failed!\n"); | |
93 | else | |
13523bef | 94 | pr_info("enforcement can be disabled.\n"); |
9b091556 KC |
95 | } else |
96 | pr_info("load pinning engaged.\n"); | |
97 | } | |
98 | #else | |
99 | static void check_pinning_enforcement(struct super_block *mnt_sb) | |
100 | { | |
101 | pr_info("load pinning engaged.\n"); | |
102 | } | |
103 | #endif | |
104 | ||
105 | static void loadpin_sb_free_security(struct super_block *mnt_sb) | |
106 | { | |
107 | /* | |
108 | * When unmounting the filesystem we were using for load | |
109 | * pinning, we acknowledge the superblock release, but make sure | |
110 | * no other modules or firmware can be loaded. | |
111 | */ | |
112 | if (!IS_ERR_OR_NULL(pinned_root) && mnt_sb == pinned_root) { | |
113 | pinned_root = ERR_PTR(-EIO); | |
114 | pr_info("umount pinned fs: refusing further loads\n"); | |
115 | } | |
116 | } | |
117 | ||
2039bda1 KC |
118 | static int loadpin_read_file(struct file *file, enum kernel_read_file_id id, |
119 | bool contents) | |
9b091556 KC |
120 | { |
121 | struct super_block *load_root; | |
122 | const char *origin = kernel_read_file_id_str(id); | |
123 | ||
2039bda1 KC |
124 | /* |
125 | * If we will not know that we'll be seeing the full contents | |
126 | * then we cannot trust a load will be complete and unchanged | |
127 | * off disk. Treat all contents=false hooks as if there were | |
128 | * no associated file struct. | |
129 | */ | |
130 | if (!contents) | |
131 | file = NULL; | |
132 | ||
0ff98480 KW |
133 | /* If the file id is excluded, ignore the pinning. */ |
134 | if ((unsigned int)id < ARRAY_SIZE(ignore_read_file_id) && | |
135 | ignore_read_file_id[id]) { | |
136 | report_load(origin, file, "pinning-excluded"); | |
137 | return 0; | |
138 | } | |
139 | ||
9b091556 KC |
140 | /* This handles the older init_module API that has a NULL file. */ |
141 | if (!file) { | |
13523bef | 142 | if (!enforce) { |
9b091556 KC |
143 | report_load(origin, NULL, "old-api-pinning-ignored"); |
144 | return 0; | |
145 | } | |
146 | ||
147 | report_load(origin, NULL, "old-api-denied"); | |
148 | return -EPERM; | |
149 | } | |
150 | ||
151 | load_root = file->f_path.mnt->mnt_sb; | |
152 | ||
153 | /* First loaded module/firmware defines the root for all others. */ | |
154 | spin_lock(&pinned_root_spinlock); | |
155 | /* | |
156 | * pinned_root is only NULL at startup. Otherwise, it is either | |
157 | * a valid reference, or an ERR_PTR. | |
158 | */ | |
159 | if (!pinned_root) { | |
160 | pinned_root = load_root; | |
161 | /* | |
162 | * Unlock now since it's only pinned_root we care about. | |
163 | * In the worst case, we will (correctly) report pinning | |
164 | * failures before we have announced that pinning is | |
13523bef | 165 | * enforcing. This would be purely cosmetic. |
9b091556 KC |
166 | */ |
167 | spin_unlock(&pinned_root_spinlock); | |
168 | check_pinning_enforcement(pinned_root); | |
169 | report_load(origin, file, "pinned"); | |
170 | } else { | |
171 | spin_unlock(&pinned_root_spinlock); | |
172 | } | |
173 | ||
174 | if (IS_ERR_OR_NULL(pinned_root) || load_root != pinned_root) { | |
13523bef | 175 | if (unlikely(!enforce)) { |
9b091556 KC |
176 | report_load(origin, file, "pinning-ignored"); |
177 | return 0; | |
178 | } | |
179 | ||
180 | report_load(origin, file, "denied"); | |
181 | return -EPERM; | |
182 | } | |
183 | ||
184 | return 0; | |
185 | } | |
186 | ||
b64fcae7 | 187 | static int loadpin_load_data(enum kernel_load_data_id id, bool contents) |
c77b8cdf | 188 | { |
2039bda1 | 189 | return loadpin_read_file(NULL, (enum kernel_read_file_id) id, contents); |
c77b8cdf MZ |
190 | } |
191 | ||
ca97d939 | 192 | static struct security_hook_list loadpin_hooks[] __lsm_ro_after_init = { |
9b091556 KC |
193 | LSM_HOOK_INIT(sb_free_security, loadpin_sb_free_security), |
194 | LSM_HOOK_INIT(kernel_read_file, loadpin_read_file), | |
c77b8cdf | 195 | LSM_HOOK_INIT(kernel_load_data, loadpin_load_data), |
9b091556 KC |
196 | }; |
197 | ||
0ff98480 KW |
198 | static void __init parse_exclude(void) |
199 | { | |
200 | int i, j; | |
201 | char *cur; | |
202 | ||
203 | /* | |
204 | * Make sure all the arrays stay within expected sizes. This | |
205 | * is slightly weird because kernel_read_file_str[] includes | |
206 | * READING_MAX_ID, which isn't actually meaningful here. | |
207 | */ | |
208 | BUILD_BUG_ON(ARRAY_SIZE(exclude_read_files) != | |
209 | ARRAY_SIZE(ignore_read_file_id)); | |
210 | BUILD_BUG_ON(ARRAY_SIZE(kernel_read_file_str) < | |
211 | ARRAY_SIZE(ignore_read_file_id)); | |
212 | ||
213 | for (i = 0; i < ARRAY_SIZE(exclude_read_files); i++) { | |
214 | cur = exclude_read_files[i]; | |
215 | if (!cur) | |
216 | break; | |
217 | if (*cur == '\0') | |
218 | continue; | |
219 | ||
220 | for (j = 0; j < ARRAY_SIZE(ignore_read_file_id); j++) { | |
221 | if (strcmp(cur, kernel_read_file_str[j]) == 0) { | |
222 | pr_info("excluding: %s\n", | |
223 | kernel_read_file_str[j]); | |
224 | ignore_read_file_id[j] = 1; | |
225 | /* | |
226 | * Can not break, because one read_file_str | |
227 | * may map to more than on read_file_id. | |
228 | */ | |
229 | } | |
230 | } | |
231 | } | |
232 | } | |
233 | ||
70b62c25 | 234 | static int __init loadpin_init(void) |
9b091556 | 235 | { |
13523bef KC |
236 | pr_info("ready to pin (currently %senforcing)\n", |
237 | enforce ? "" : "not "); | |
0ff98480 | 238 | parse_exclude(); |
d69dece5 | 239 | security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks), "loadpin"); |
70b62c25 | 240 | return 0; |
9b091556 KC |
241 | } |
242 | ||
70b62c25 KC |
243 | DEFINE_LSM(loadpin) = { |
244 | .name = "loadpin", | |
245 | .init = loadpin_init, | |
246 | }; | |
247 | ||
9b091556 | 248 | /* Should not be mutable after boot, so not listed in sysfs (perm == 0). */ |
13523bef KC |
249 | module_param(enforce, int, 0); |
250 | MODULE_PARM_DESC(enforce, "Enforce module/firmware pinning"); | |
0ff98480 KW |
251 | module_param_array_named(exclude, exclude_read_files, charp, NULL, 0); |
252 | MODULE_PARM_DESC(exclude, "Exclude pinning specific read file types"); |