Commit | Line | Data |
---|---|---|
000d388e MG |
1 | // SPDX-License-Identifier: GPL-2.0 |
2 | /* Lock down the kernel | |
3 | * | |
4 | * Copyright (C) 2016 Red Hat, Inc. All Rights Reserved. | |
5 | * Written by David Howells (dhowells@redhat.com) | |
6 | * | |
7 | * This program is free software; you can redistribute it and/or | |
8 | * modify it under the terms of the GNU General Public Licence | |
9 | * as published by the Free Software Foundation; either version | |
10 | * 2 of the Licence, or (at your option) any later version. | |
11 | */ | |
12 | ||
13 | #include <linux/security.h> | |
14 | #include <linux/export.h> | |
15 | #include <linux/lsm_hooks.h> | |
16 | ||
17 | static enum lockdown_reason kernel_locked_down; | |
18 | ||
19 | static char *lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = { | |
20 | [LOCKDOWN_NONE] = "none", | |
49fcf732 | 21 | [LOCKDOWN_MODULE_SIGNATURE] = "unsigned module loading", |
9b9d8dda | 22 | [LOCKDOWN_DEV_MEM] = "/dev/mem,kmem,port", |
7d31f460 | 23 | [LOCKDOWN_KEXEC] = "kexec of unsigned images", |
38bd94b8 | 24 | [LOCKDOWN_HIBERNATION] = "hibernation", |
eb627e17 | 25 | [LOCKDOWN_PCI_ACCESS] = "direct PCI access", |
96c4f672 | 26 | [LOCKDOWN_IOPORT] = "raw io port access", |
95f5e95f | 27 | [LOCKDOWN_MSR] = "raw MSR access", |
f474e148 | 28 | [LOCKDOWN_ACPI_TABLES] = "modifying ACPI tables", |
3f19cad3 | 29 | [LOCKDOWN_PCMCIA_CIS] = "direct PCMCIA CIS storage", |
794edf30 | 30 | [LOCKDOWN_TIOCSSERIAL] = "reconfiguration of serial port IO", |
20657f66 | 31 | [LOCKDOWN_MODULE_PARAMETERS] = "unsafe module parameters", |
000d388e MG |
32 | [LOCKDOWN_INTEGRITY_MAX] = "integrity", |
33 | [LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality", | |
34 | }; | |
35 | ||
36 | static enum lockdown_reason lockdown_levels[] = {LOCKDOWN_NONE, | |
37 | LOCKDOWN_INTEGRITY_MAX, | |
38 | LOCKDOWN_CONFIDENTIALITY_MAX}; | |
39 | ||
40 | /* | |
41 | * Put the kernel into lock-down mode. | |
42 | */ | |
43 | static int lock_kernel_down(const char *where, enum lockdown_reason level) | |
44 | { | |
45 | if (kernel_locked_down >= level) | |
46 | return -EPERM; | |
47 | ||
48 | kernel_locked_down = level; | |
49 | pr_notice("Kernel is locked down from %s; see man kernel_lockdown.7\n", | |
50 | where); | |
51 | return 0; | |
52 | } | |
53 | ||
54 | static int __init lockdown_param(char *level) | |
55 | { | |
56 | if (!level) | |
57 | return -EINVAL; | |
58 | ||
59 | if (strcmp(level, "integrity") == 0) | |
60 | lock_kernel_down("command line", LOCKDOWN_INTEGRITY_MAX); | |
61 | else if (strcmp(level, "confidentiality") == 0) | |
62 | lock_kernel_down("command line", LOCKDOWN_CONFIDENTIALITY_MAX); | |
63 | else | |
64 | return -EINVAL; | |
65 | ||
66 | return 0; | |
67 | } | |
68 | ||
69 | early_param("lockdown", lockdown_param); | |
70 | ||
71 | /** | |
72 | * lockdown_is_locked_down - Find out if the kernel is locked down | |
73 | * @what: Tag to use in notice generated if lockdown is in effect | |
74 | */ | |
75 | static int lockdown_is_locked_down(enum lockdown_reason what) | |
76 | { | |
77 | if (kernel_locked_down >= what) { | |
78 | if (lockdown_reasons[what]) | |
79 | pr_notice("Lockdown: %s is restricted; see man kernel_lockdown.7\n", | |
80 | lockdown_reasons[what]); | |
81 | return -EPERM; | |
82 | } | |
83 | ||
84 | return 0; | |
85 | } | |
86 | ||
87 | static struct security_hook_list lockdown_hooks[] __lsm_ro_after_init = { | |
88 | LSM_HOOK_INIT(locked_down, lockdown_is_locked_down), | |
89 | }; | |
90 | ||
91 | static int __init lockdown_lsm_init(void) | |
92 | { | |
93 | #if defined(CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY) | |
94 | lock_kernel_down("Kernel configuration", LOCKDOWN_INTEGRITY_MAX); | |
95 | #elif defined(CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY) | |
96 | lock_kernel_down("Kernel configuration", LOCKDOWN_CONFIDENTIALITY_MAX); | |
97 | #endif | |
98 | security_add_hooks(lockdown_hooks, ARRAY_SIZE(lockdown_hooks), | |
99 | "lockdown"); | |
100 | return 0; | |
101 | } | |
102 | ||
103 | static ssize_t lockdown_read(struct file *filp, char __user *buf, size_t count, | |
104 | loff_t *ppos) | |
105 | { | |
106 | char temp[80]; | |
107 | int i, offset = 0; | |
108 | ||
109 | for (i = 0; i < ARRAY_SIZE(lockdown_levels); i++) { | |
110 | enum lockdown_reason level = lockdown_levels[i]; | |
111 | ||
112 | if (lockdown_reasons[level]) { | |
113 | const char *label = lockdown_reasons[level]; | |
114 | ||
115 | if (kernel_locked_down == level) | |
116 | offset += sprintf(temp+offset, "[%s] ", label); | |
117 | else | |
118 | offset += sprintf(temp+offset, "%s ", label); | |
119 | } | |
120 | } | |
121 | ||
122 | /* Convert the last space to a newline if needed. */ | |
123 | if (offset > 0) | |
124 | temp[offset-1] = '\n'; | |
125 | ||
126 | return simple_read_from_buffer(buf, count, ppos, temp, strlen(temp)); | |
127 | } | |
128 | ||
129 | static ssize_t lockdown_write(struct file *file, const char __user *buf, | |
130 | size_t n, loff_t *ppos) | |
131 | { | |
132 | char *state; | |
133 | int i, len, err = -EINVAL; | |
134 | ||
135 | state = memdup_user_nul(buf, n); | |
136 | if (IS_ERR(state)) | |
137 | return PTR_ERR(state); | |
138 | ||
139 | len = strlen(state); | |
140 | if (len && state[len-1] == '\n') { | |
141 | state[len-1] = '\0'; | |
142 | len--; | |
143 | } | |
144 | ||
145 | for (i = 0; i < ARRAY_SIZE(lockdown_levels); i++) { | |
146 | enum lockdown_reason level = lockdown_levels[i]; | |
147 | const char *label = lockdown_reasons[level]; | |
148 | ||
149 | if (label && !strcmp(state, label)) | |
150 | err = lock_kernel_down("securityfs", level); | |
151 | } | |
152 | ||
153 | kfree(state); | |
154 | return err ? err : n; | |
155 | } | |
156 | ||
157 | static const struct file_operations lockdown_ops = { | |
158 | .read = lockdown_read, | |
159 | .write = lockdown_write, | |
160 | }; | |
161 | ||
162 | static int __init lockdown_secfs_init(void) | |
163 | { | |
164 | struct dentry *dentry; | |
165 | ||
166 | dentry = securityfs_create_file("lockdown", 0600, NULL, NULL, | |
167 | &lockdown_ops); | |
168 | return PTR_ERR_OR_ZERO(dentry); | |
169 | } | |
170 | ||
171 | core_initcall(lockdown_secfs_init); | |
172 | ||
173 | #ifdef CONFIG_SECURITY_LOCKDOWN_LSM_EARLY | |
174 | DEFINE_EARLY_LSM(lockdown) = { | |
175 | #else | |
176 | DEFINE_LSM(lockdown) = { | |
177 | #endif | |
178 | .name = "lockdown", | |
179 | .init = lockdown_lsm_init, | |
180 | }; |