From patchwork Fri Aug 30 15:45:49 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ben Hutchings X-Patchwork-Id: 11124271 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id EA8E313B1 for ; Fri, 30 Aug 2019 15:45:53 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id D004723407 for ; Fri, 30 Aug 2019 15:45:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727936AbfH3Ppx (ORCPT ); Fri, 30 Aug 2019 11:45:53 -0400 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:59562 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727304AbfH3Ppx (ORCPT ); Fri, 30 Aug 2019 11:45:53 -0400 Received: from ben by shadbolt.decadent.org.uk with local (Exim 4.89) (envelope-from ) id 1i3j5x-0007Pk-B7; Fri, 30 Aug 2019 16:45:49 +0100 Date: Fri, 30 Aug 2019 16:45:49 +0100 From: Ben Hutchings To: jmorris@namei.org Cc: linux-security-module@vger.kernel.org, Matthew Garrett , David Howells , Ian Abbott , H Hartley Sweeten Message-ID: <20190830154549.vss6h5tlrl6d5r5y@decadent.org.uk> MIME-Version: 1.0 Content-Disposition: inline User-Agent: NeoMutt/20170113 (1.7.2) X-SA-Exim-Connect-IP: X-SA-Exim-Mail-From: ben@decadent.org.uk X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shadbolt.decadent.org.uk X-Spam-Level: X-Spam-Status: No, score=-0.0 required=5.0 tests=NO_RELAYS autolearn=disabled version=3.4.2 Subject: [PATCH 1/2] staging: comedi: Restrict COMEDI_DEVCONFIG when the kernel is locked down X-SA-Exim-Version: 4.2.1 (built Tue, 02 Aug 2016 21:08:31 +0000) X-SA-Exim-Scanned: Yes (on shadbolt.decadent.org.uk) Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: The COMEDI_DEVCONFIG ioctl can be used to configure I/O addresses and other hardware settings for non plug-and-play devices such as ISA cards. This should be disabled to preserve the kernel's integrity when it is locked down. Signed-off-by: Ben Hutchings Cc: Matthew Garrett Cc: David Howells Cc: Ian Abbott Cc: H Hartley Sweeten --- drivers/staging/comedi/comedi_fops.c | 6 ++++++ include/linux/security.h | 1 + security/lockdown/lockdown.c | 1 + 3 files changed, 8 insertions(+) diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c index f6d1287c7b83..fdf030e53035 100644 --- a/drivers/staging/comedi/comedi_fops.c +++ b/drivers/staging/comedi/comedi_fops.c @@ -27,6 +27,7 @@ #include #include +#include #include "comedi_internal.h" @@ -813,11 +814,16 @@ static int do_devconfig_ioctl(struct comedi_device *dev, struct comedi_devconfig __user *arg) { struct comedi_devconfig it; + int ret; lockdep_assert_held(&dev->mutex); if (!capable(CAP_SYS_ADMIN)) return -EPERM; + ret = security_locked_down(LOCKDOWN_COMEDI_DEVCONFIG); + if (ret) + return ret; + if (!arg) { if (is_device_busy(dev)) return -EBUSY; diff --git a/include/linux/security.h b/include/linux/security.h index 429f9f03372b..b16365dccfc5 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -113,6 +113,7 @@ enum lockdown_reason { LOCKDOWN_ACPI_TABLES, LOCKDOWN_PCMCIA_CIS, LOCKDOWN_TIOCSSERIAL, + LOCKDOWN_COMEDI_DEVCONFIG, LOCKDOWN_MODULE_PARAMETERS, LOCKDOWN_MMIOTRACE, LOCKDOWN_DEBUGFS, diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c index 0068cec77c05..971bb99b9051 100644 --- a/security/lockdown/lockdown.c +++ b/security/lockdown/lockdown.c @@ -28,6 +28,7 @@ static char *lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = { [LOCKDOWN_ACPI_TABLES] = "modifying ACPI tables", [LOCKDOWN_PCMCIA_CIS] = "direct PCMCIA CIS storage", [LOCKDOWN_TIOCSSERIAL] = "reconfiguration of serial port IO", + [LOCKDOWN_COMEDI_DEVCONFIG] = "reconfiguration of Comedi legacy device", [LOCKDOWN_MODULE_PARAMETERS] = "unsafe module parameters", [LOCKDOWN_MMIOTRACE] = "unsafe mmio", [LOCKDOWN_DEBUGFS] = "debugfs access", From patchwork Fri Aug 30 15:47:20 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ben Hutchings X-Patchwork-Id: 11124273 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id EBD861398 for ; Fri, 30 Aug 2019 15:47:29 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id D096B23427 for ; Fri, 30 Aug 2019 15:47:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728058AbfH3Pr2 (ORCPT ); Fri, 30 Aug 2019 11:47:28 -0400 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:59580 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727820AbfH3Pr2 (ORCPT ); Fri, 30 Aug 2019 11:47:28 -0400 Received: from ben by shadbolt.decadent.org.uk with local (Exim 4.89) (envelope-from ) id 1i3j7R-0007T1-0P; Fri, 30 Aug 2019 16:47:21 +0100 Date: Fri, 30 Aug 2019 16:47:20 +0100 From: Ben Hutchings To: jmorris@namei.org Cc: linux-security-module@vger.kernel.org, Matthew Garrett , David Howells , Joern Engel , linux-mtd@lists.infradead.org Message-ID: <20190830154720.eekfjt6c4jzvlbfz@decadent.org.uk> References: <20190830154549.vss6h5tlrl6d5r5y@decadent.org.uk> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20190830154549.vss6h5tlrl6d5r5y@decadent.org.uk> User-Agent: NeoMutt/20170113 (1.7.2) X-SA-Exim-Connect-IP: X-SA-Exim-Mail-From: ben@decadent.org.uk X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shadbolt.decadent.org.uk X-Spam-Level: X-Spam-Status: No, score=-0.0 required=5.0 tests=NO_RELAYS autolearn=disabled version=3.4.2 Subject: [PATCH 2/2] mtd: phram,slram: Disable when the kernel is locked down X-SA-Exim-Version: 4.2.1 (built Tue, 02 Aug 2016 21:08:31 +0000) X-SA-Exim-Scanned: Yes (on shadbolt.decadent.org.uk) Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: These drivers allow mapping arbitrary memory ranges as MTD devices. This should be disabled to preserve the kernel's integrity when it is locked down. * Add the HWPARAM flag to the module parameters * When slram is built-in, it uses __setup() to read kernel parameters, so add an explicit check security_locked_down() check Signed-off-by: Ben Hutchings Cc: Matthew Garrett Cc: David Howells Cc: Joern Engel Cc: linux-mtd@lists.infradead.org Reviewed-by: Matthew Garrett Acked-by: Richard Weinberger --- drivers/mtd/devices/phram.c | 6 +++++- drivers/mtd/devices/slram.c | 9 ++++++++- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c index c467286ca007..9c18b4bb2ed9 100644 --- a/drivers/mtd/devices/phram.c +++ b/drivers/mtd/devices/phram.c @@ -294,7 +294,11 @@ static int phram_param_call(const char *val, const struct kernel_param *kp) #endif } -module_param_call(phram, phram_param_call, NULL, NULL, 000); +static const struct kernel_param_ops phram_param_ops = { + .set = phram_param_call +}; +__module_param_call(MODULE_PARAM_PREFIX, phram, &phram_param_ops, NULL, + 000, -1, KERNEL_PARAM_FL_HWPARAM | hwparam_iomem); MODULE_PARM_DESC(phram, "Memory region to map. \"phram=,,\""); diff --git a/drivers/mtd/devices/slram.c b/drivers/mtd/devices/slram.c index 28131a127d06..d92a2461e2ce 100644 --- a/drivers/mtd/devices/slram.c +++ b/drivers/mtd/devices/slram.c @@ -43,6 +43,7 @@ #include #include #include +#include #include @@ -65,7 +66,7 @@ typedef struct slram_mtd_list { #ifdef MODULE static char *map[SLRAM_MAX_DEVICES_PARAMS]; -module_param_array(map, charp, NULL, 0); +module_param_hw_array(map, charp, iomem, NULL, 0); MODULE_PARM_DESC(map, "List of memory regions to map. \"map=, , \""); #else static char *map; @@ -281,11 +282,17 @@ static int __init init_slram(void) #ifndef MODULE char *devstart; char *devlength; + int ret; if (!map) { E("slram: not enough parameters.\n"); return(-EINVAL); } + + ret = security_locked_down(LOCKDOWN_MODULE_PARAMETERS); + if (ret) + return ret; + while (map) { devname = devstart = devlength = NULL;