Commit | Line | Data |
---|---|---|
000d388e MG |
1 | // SPDX-License-Identifier: GPL-2.0 |
2 | /* Lock down the kernel | |
3 | * | |
4 | * Copyright (C) 2016 Red Hat, Inc. All Rights Reserved. | |
5 | * Written by David Howells (dhowells@redhat.com) | |
6 | * | |
7 | * This program is free software; you can redistribute it and/or | |
8 | * modify it under the terms of the GNU General Public Licence | |
9 | * as published by the Free Software Foundation; either version | |
10 | * 2 of the Licence, or (at your option) any later version. | |
11 | */ | |
12 | ||
13 | #include <linux/security.h> | |
14 | #include <linux/export.h> | |
15 | #include <linux/lsm_hooks.h> | |
16 | ||
17 | static enum lockdown_reason kernel_locked_down; | |
18 | ||
19 | static char *lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = { | |
20 | [LOCKDOWN_NONE] = "none", | |
49fcf732 | 21 | [LOCKDOWN_MODULE_SIGNATURE] = "unsigned module loading", |
9b9d8dda | 22 | [LOCKDOWN_DEV_MEM] = "/dev/mem,kmem,port", |
7d31f460 | 23 | [LOCKDOWN_KEXEC] = "kexec of unsigned images", |
38bd94b8 | 24 | [LOCKDOWN_HIBERNATION] = "hibernation", |
eb627e17 | 25 | [LOCKDOWN_PCI_ACCESS] = "direct PCI access", |
96c4f672 | 26 | [LOCKDOWN_IOPORT] = "raw io port access", |
95f5e95f | 27 | [LOCKDOWN_MSR] = "raw MSR access", |
f474e148 | 28 | [LOCKDOWN_ACPI_TABLES] = "modifying ACPI tables", |
3f19cad3 | 29 | [LOCKDOWN_PCMCIA_CIS] = "direct PCMCIA CIS storage", |
794edf30 | 30 | [LOCKDOWN_TIOCSSERIAL] = "reconfiguration of serial port IO", |
000d388e MG |
31 | [LOCKDOWN_INTEGRITY_MAX] = "integrity", |
32 | [LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality", | |
33 | }; | |
34 | ||
35 | static enum lockdown_reason lockdown_levels[] = {LOCKDOWN_NONE, | |
36 | LOCKDOWN_INTEGRITY_MAX, | |
37 | LOCKDOWN_CONFIDENTIALITY_MAX}; | |
38 | ||
39 | /* | |
40 | * Put the kernel into lock-down mode. | |
41 | */ | |
42 | static int lock_kernel_down(const char *where, enum lockdown_reason level) | |
43 | { | |
44 | if (kernel_locked_down >= level) | |
45 | return -EPERM; | |
46 | ||
47 | kernel_locked_down = level; | |
48 | pr_notice("Kernel is locked down from %s; see man kernel_lockdown.7\n", | |
49 | where); | |
50 | return 0; | |
51 | } | |
52 | ||
53 | static int __init lockdown_param(char *level) | |
54 | { | |
55 | if (!level) | |
56 | return -EINVAL; | |
57 | ||
58 | if (strcmp(level, "integrity") == 0) | |
59 | lock_kernel_down("command line", LOCKDOWN_INTEGRITY_MAX); | |
60 | else if (strcmp(level, "confidentiality") == 0) | |
61 | lock_kernel_down("command line", LOCKDOWN_CONFIDENTIALITY_MAX); | |
62 | else | |
63 | return -EINVAL; | |
64 | ||
65 | return 0; | |
66 | } | |
67 | ||
68 | early_param("lockdown", lockdown_param); | |
69 | ||
70 | /** | |
71 | * lockdown_is_locked_down - Find out if the kernel is locked down | |
72 | * @what: Tag to use in notice generated if lockdown is in effect | |
73 | */ | |
74 | static int lockdown_is_locked_down(enum lockdown_reason what) | |
75 | { | |
76 | if (kernel_locked_down >= what) { | |
77 | if (lockdown_reasons[what]) | |
78 | pr_notice("Lockdown: %s is restricted; see man kernel_lockdown.7\n", | |
79 | lockdown_reasons[what]); | |
80 | return -EPERM; | |
81 | } | |
82 | ||
83 | return 0; | |
84 | } | |
85 | ||
86 | static struct security_hook_list lockdown_hooks[] __lsm_ro_after_init = { | |
87 | LSM_HOOK_INIT(locked_down, lockdown_is_locked_down), | |
88 | }; | |
89 | ||
90 | static int __init lockdown_lsm_init(void) | |
91 | { | |
92 | #if defined(CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY) | |
93 | lock_kernel_down("Kernel configuration", LOCKDOWN_INTEGRITY_MAX); | |
94 | #elif defined(CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY) | |
95 | lock_kernel_down("Kernel configuration", LOCKDOWN_CONFIDENTIALITY_MAX); | |
96 | #endif | |
97 | security_add_hooks(lockdown_hooks, ARRAY_SIZE(lockdown_hooks), | |
98 | "lockdown"); | |
99 | return 0; | |
100 | } | |
101 | ||
102 | static ssize_t lockdown_read(struct file *filp, char __user *buf, size_t count, | |
103 | loff_t *ppos) | |
104 | { | |
105 | char temp[80]; | |
106 | int i, offset = 0; | |
107 | ||
108 | for (i = 0; i < ARRAY_SIZE(lockdown_levels); i++) { | |
109 | enum lockdown_reason level = lockdown_levels[i]; | |
110 | ||
111 | if (lockdown_reasons[level]) { | |
112 | const char *label = lockdown_reasons[level]; | |
113 | ||
114 | if (kernel_locked_down == level) | |
115 | offset += sprintf(temp+offset, "[%s] ", label); | |
116 | else | |
117 | offset += sprintf(temp+offset, "%s ", label); | |
118 | } | |
119 | } | |
120 | ||
121 | /* Convert the last space to a newline if needed. */ | |
122 | if (offset > 0) | |
123 | temp[offset-1] = '\n'; | |
124 | ||
125 | return simple_read_from_buffer(buf, count, ppos, temp, strlen(temp)); | |
126 | } | |
127 | ||
128 | static ssize_t lockdown_write(struct file *file, const char __user *buf, | |
129 | size_t n, loff_t *ppos) | |
130 | { | |
131 | char *state; | |
132 | int i, len, err = -EINVAL; | |
133 | ||
134 | state = memdup_user_nul(buf, n); | |
135 | if (IS_ERR(state)) | |
136 | return PTR_ERR(state); | |
137 | ||
138 | len = strlen(state); | |
139 | if (len && state[len-1] == '\n') { | |
140 | state[len-1] = '\0'; | |
141 | len--; | |
142 | } | |
143 | ||
144 | for (i = 0; i < ARRAY_SIZE(lockdown_levels); i++) { | |
145 | enum lockdown_reason level = lockdown_levels[i]; | |
146 | const char *label = lockdown_reasons[level]; | |
147 | ||
148 | if (label && !strcmp(state, label)) | |
149 | err = lock_kernel_down("securityfs", level); | |
150 | } | |
151 | ||
152 | kfree(state); | |
153 | return err ? err : n; | |
154 | } | |
155 | ||
156 | static const struct file_operations lockdown_ops = { | |
157 | .read = lockdown_read, | |
158 | .write = lockdown_write, | |
159 | }; | |
160 | ||
161 | static int __init lockdown_secfs_init(void) | |
162 | { | |
163 | struct dentry *dentry; | |
164 | ||
165 | dentry = securityfs_create_file("lockdown", 0600, NULL, NULL, | |
166 | &lockdown_ops); | |
167 | return PTR_ERR_OR_ZERO(dentry); | |
168 | } | |
169 | ||
170 | core_initcall(lockdown_secfs_init); | |
171 | ||
172 | #ifdef CONFIG_SECURITY_LOCKDOWN_LSM_EARLY | |
173 | DEFINE_EARLY_LSM(lockdown) = { | |
174 | #else | |
175 | DEFINE_LSM(lockdown) = { | |
176 | #endif | |
177 | .name = "lockdown", | |
178 | .init = lockdown_lsm_init, | |
179 | }; |