From 59566d9a2cbf6092cd9f7b0990f073c81ce668d3 Mon Sep 17 00:00:00 2001 From: "Justin M. Forbes" Date: Thu, 19 Oct 2017 15:49:02 -0500 Subject: [PATCH] Linux v4.14-rc5-31-g73d3393ada4f --- .../CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ | 1 + .../CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT | 1 + .../CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT | 1 + efi-lockdown.patch | 1779 +++++++++++------ gitrev | 2 +- kernel-aarch64-debug.config | 2 + kernel-aarch64.config | 2 + kernel-armv7hl-debug.config | 2 + kernel-armv7hl-lpae-debug.config | 2 + kernel-armv7hl-lpae.config | 2 + kernel-armv7hl.config | 2 + kernel-i686-PAE.config | 2 + kernel-i686-PAEdebug.config | 2 + kernel-i686-debug.config | 2 + kernel-i686.config | 2 + kernel-ppc64-debug.config | 2 + kernel-ppc64.config | 2 + kernel-ppc64le-debug.config | 2 + kernel-ppc64le.config | 2 + kernel-s390x-debug.config | 2 + kernel-s390x.config | 2 + kernel-x86_64-debug.config | 2 + kernel-x86_64.config | 2 + kernel.spec | 5 +- sources | 2 +- 25 files changed, 1234 insertions(+), 593 deletions(-) create mode 100644 baseconfig/CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ create mode 100644 baseconfig/CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT create mode 100644 baseconfig/x86/x86_64/CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT diff --git a/baseconfig/CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ b/baseconfig/CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ new file mode 100644 index 000000000..40a287f0f --- /dev/null +++ b/baseconfig/CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ @@ -0,0 +1 @@ +CONFIG_ALLOW_LOCKDOWN_LIFT_BY_SYSRQ=y diff --git a/baseconfig/CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT b/baseconfig/CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT new file mode 100644 index 000000000..336528547 --- /dev/null +++ b/baseconfig/CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT @@ -0,0 +1 @@ +# CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT is not set diff --git a/baseconfig/x86/x86_64/CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT b/baseconfig/x86/x86_64/CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT new file mode 100644 index 000000000..4a06cfcc2 --- /dev/null +++ b/baseconfig/x86/x86_64/CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT @@ -0,0 +1 @@ +CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y diff --git a/efi-lockdown.patch b/efi-lockdown.patch index 99ac78d89..a45be8771 100644 --- a/efi-lockdown.patch +++ b/efi-lockdown.patch @@ -1,54 +1,17 @@ -From df7d76ae50f18d4465e59fdf7f19d3df44906cb5 Mon Sep 17 00:00:00 2001 -From: Josh Boyer -Date: Mon, 21 Nov 2016 23:55:55 +0000 -Subject: [PATCH 07/32] efi: Add EFI_SECURE_BOOT bit - -UEFI machines can be booted in Secure Boot mode. Add a EFI_SECURE_BOOT bit -that can be passed to efi_enabled() to find out whether secure boot is -enabled. - -This will be used by the SysRq+x handler, registered by the x86 arch, to find -out whether secure boot mode is enabled so that it can be disabled. - -Signed-off-by: Josh Boyer -Signed-off-by: David Howells ---- - arch/x86/kernel/setup.c | 1 + - include/linux/efi.h | 1 + - 2 files changed, 2 insertions(+) - -diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index 69780ed..447905e 100644 ---- a/arch/x86/kernel/setup.c -+++ b/arch/x86/kernel/setup.c -@@ -1182,6 +1182,7 @@ void __init setup_arch(char **cmdline_p) - pr_info("Secure boot disabled\n"); - break; - case efi_secureboot_mode_enabled: -+ set_bit(EFI_SECURE_BOOT, &efi.flags); - pr_info("Secure boot enabled\n"); - break; - default: -diff --git a/include/linux/efi.h b/include/linux/efi.h -index 94d34e0..6049600 100644 ---- a/include/linux/efi.h -+++ b/include/linux/efi.h -@@ -1069,6 +1069,7 @@ extern int __init efi_setup_pcdp_console(char *); - #define EFI_DBG 8 /* Print additional debug info at runtime */ - #define EFI_NX_PE_DATA 9 /* Can runtime data regions be mapped non-executable? */ - #define EFI_MEM_ATTR 10 /* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */ -+#define EFI_SECURE_BOOT 11 /* Are we in Secure Boot mode? */ - - #ifdef CONFIG_EFI - /* --- -2.7.4 - -From f05a90c19a9613d8d50597319ed91f691e25b689 Mon Sep 17 00:00:00 2001 +From patchwork Thu Oct 19 14:50:40 2017 +Content-Type: text/plain; charset="utf-8" +MIME-Version: 1.0 +Content-Transfer-Encoding: 7bit +Subject: [01/27] Add the ability to lock down access to the running kernel + image From: David Howells -Date: Mon, 21 Nov 2016 23:36:17 +0000 -Subject: [PATCH 09/32] Add the ability to lock down access to the running - kernel image +X-Patchwork-Id: 10017331 +Message-Id: <150842463996.7923.6815305873334959305.stgit@warthog.procyon.org.uk> +To: linux-security-module@vger.kernel.org +Cc: gnomes@lxorguk.ukuu.org.uk, linux-efi@vger.kernel.org, + matthew.garrett@nebula.com, gregkh@linuxfoundation.org, + linux-kernel@vger.kernel.org, dhowells@redhat.com, jforbes@redhat.com +Date: Thu, 19 Oct 2017 15:50:40 +0100 Provide a single call to allow kernel code to determine whether the system should be locked down, thereby disallowing various accesses that might @@ -58,49 +21,55 @@ MSR registers and disallowing hibernation, Signed-off-by: David Howells --- - include/linux/kernel.h | 9 +++++++++ - include/linux/security.h | 11 +++++++++++ - security/Kconfig | 15 +++++++++++++++ - security/Makefile | 3 +++ - security/lock_down.c | 40 ++++++++++++++++++++++++++++++++++++++++ - 5 files changed, 78 insertions(+) + + include/linux/kernel.h | 17 +++++++++++++ + include/linux/security.h | 8 ++++++ + security/Kconfig | 8 ++++++ + security/Makefile | 3 ++ + security/lock_down.c | 60 ++++++++++++++++++++++++++++++++++++++++++++++ + 5 files changed, 96 insertions(+) create mode 100644 security/lock_down.c diff --git a/include/linux/kernel.h b/include/linux/kernel.h -index cb09238..3cd3be9 100644 +index 0ad4c3044cf9..362da2e4bf53 100644 --- a/include/linux/kernel.h +++ b/include/linux/kernel.h -@@ -273,6 +273,15 @@ extern int oops_may_print(void); - void do_exit(long error_code) __noreturn; - void complete_and_exit(struct completion *, long) __noreturn; +@@ -287,6 +287,23 @@ static inline void refcount_error_report(struct pt_regs *regs, const char *err) + { } + #endif +#ifdef CONFIG_LOCK_DOWN_KERNEL -+extern bool kernel_is_locked_down(void); ++extern bool __kernel_is_locked_down(const char *what, bool first); +#else -+static inline bool kernel_is_locked_down(void) ++static inline bool __kernel_is_locked_down(const char *what, bool first) +{ + return false; +} +#endif + - #ifdef CONFIG_ARCH_HAS_REFCOUNT - void refcount_error_report(struct pt_regs *regs, const char *err); - #else ++#define kernel_is_locked_down(what) \ ++ ({ \ ++ static bool message_given; \ ++ bool locked_down = __kernel_is_locked_down(what, !message_given); \ ++ message_given = true; \ ++ locked_down; \ ++ }) ++ + /* Internal, do not use. */ + int __must_check _kstrtoul(const char *s, unsigned int base, unsigned long *res); + int __must_check _kstrtol(const char *s, unsigned int base, long *res); diff --git a/include/linux/security.h b/include/linux/security.h -index d3868f2..187b74b 100644 +index ce6265960d6c..f9a894b42d4c 100644 --- a/include/linux/security.h +++ b/include/linux/security.h -@@ -1679,5 +1679,16 @@ static inline void free_secdata(void *secdata) +@@ -1753,5 +1753,13 @@ static inline void free_secdata(void *secdata) { } #endif /* CONFIG_SECURITY */ +#ifdef CONFIG_LOCK_DOWN_KERNEL -+extern void lock_kernel_down(void); -+#ifdef CONFIG_ALLOW_LOCKDOWN_LIFT -+extern void lift_kernel_lockdown(void); -+#endif ++extern void __init init_lockdown(void); +#else -+static inline void lock_kernel_down(void) ++static inline void __init init_lockdown(void); +{ +} +#endif @@ -108,10 +77,10 @@ index d3868f2..187b74b 100644 #endif /* ! __LINUX_SECURITY_H */ diff --git a/security/Kconfig b/security/Kconfig -index d900f47..d9b391d 100644 +index e8e449444e65..8e01fd59ae7e 100644 --- a/security/Kconfig +++ b/security/Kconfig -@@ -193,6 +193,21 @@ config STATIC_USERMODEHELPER_PATH +@@ -205,6 +205,14 @@ config STATIC_USERMODEHELPER_PATH If you wish for all usermode helper programs to be disabled, specify an empty string here (i.e. ""). @@ -122,19 +91,12 @@ index d900f47..d9b391d 100644 + instance if UEFI secure boot is enabled. Locking down the kernel + turns off various features that might otherwise allow access to the + kernel image (eg. setting MSR registers). -+ -+config ALLOW_LOCKDOWN_LIFT -+ bool -+ help -+ Allow the lockdown on a kernel to be lifted, thereby restoring the -+ ability of userspace to access the kernel image (eg. by SysRq+x under -+ x86). + source security/selinux/Kconfig source security/smack/Kconfig source security/tomoyo/Kconfig diff --git a/security/Makefile b/security/Makefile -index f2d71cd..8c4a43e 100644 +index f2d71cdb8e19..8c4a43e3d4e0 100644 --- a/security/Makefile +++ b/security/Makefile @@ -29,3 +29,6 @@ obj-$(CONFIG_CGROUP_DEVICE) += device_cgroup.o @@ -146,10 +108,10 @@ index f2d71cd..8c4a43e 100644 +obj-$(CONFIG_LOCK_DOWN_KERNEL) += lock_down.o diff --git a/security/lock_down.c b/security/lock_down.c new file mode 100644 -index 0000000..5788c60 +index 000000000000..d8595c0e6673 --- /dev/null +++ b/security/lock_down.c -@@ -0,0 +1,40 @@ +@@ -0,0 +1,60 @@ +/* Lock down the kernel + * + * Copyright (C) 2016 Red Hat, Inc. All Rights Reserved. @@ -164,270 +126,108 @@ index 0000000..5788c60 +#include +#include + -+static __read_mostly bool kernel_locked_down; ++static __ro_after_init bool kernel_locked_down; + +/* + * Put the kernel into lock-down mode. + */ -+void lock_kernel_down(void) ++static void __init lock_kernel_down(const char *where) +{ -+ kernel_locked_down = true; ++ if (!kernel_locked_down) { ++ kernel_locked_down = true; ++ pr_notice("Kernel is locked down from %s; see man kernel_lockdown.7\n", ++ where); ++ } +} + -+/* -+ * Take the kernel out of lockdown mode. -+ */ -+void lift_kernel_lockdown(void) ++static int __init lockdown_param(char *ignored) +{ -+ kernel_locked_down = false; ++ lock_kernel_down("command line"); ++ return 0; ++} ++ ++early_param("lockdown", lockdown_param); ++ ++/* ++ * Lock the kernel down from very early in the arch setup. This must happen ++ * prior to things like ACPI being initialised. ++ */ ++void __init init_lockdown(void) ++{ ++#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT ++ if (efi_enabled(EFI_SECURE_BOOT)) ++ lock_kernel_down("EFI secure boot"); ++#endif +} + +/** + * kernel_is_locked_down - Find out if the kernel is locked down ++ * @what: Tag to use in notice generated if lockdown is in effect + */ -+bool kernel_is_locked_down(void) ++bool __kernel_is_locked_down(const char *what, bool first) +{ ++ if (what && first && kernel_locked_down) ++ pr_notice("Lockdown: %s is restricted; see man kernel_lockdown.7\n", ++ what); + return kernel_locked_down; +} -+EXPORT_SYMBOL(kernel_is_locked_down); --- -2.7.4 ++EXPORT_SYMBOL(__kernel_is_locked_down); -From fb6feb38e297260d050fc477c72683ac51d07ae3 Mon Sep 17 00:00:00 2001 +From patchwork Thu Oct 19 14:50:47 2017 +Content-Type: text/plain; charset="utf-8" +MIME-Version: 1.0 +Content-Transfer-Encoding: 7bit +Subject: [02/27] Add a SysRq option to lift kernel lockdown From: David Howells -Date: Mon, 21 Nov 2016 23:55:55 +0000 -Subject: [PATCH 10/32] efi: Lock down the kernel if booted in secure boot mode +X-Patchwork-Id: 10017333 +Message-Id: <150842464774.7923.7951986297563109339.stgit@warthog.procyon.org.uk> +To: linux-security-module@vger.kernel.org +Cc: gnomes@lxorguk.ukuu.org.uk, linux-efi@vger.kernel.org, + matthew.garrett@nebula.com, gregkh@linuxfoundation.org, + linux-kernel@vger.kernel.org, dhowells@redhat.com, jforbes@redhat.com +Date: Thu, 19 Oct 2017 15:50:47 +0100 -UEFI Secure Boot provides a mechanism for ensuring that the firmware will -only load signed bootloaders and kernels. Certain use cases may also -require that all kernel modules also be signed. Add a configuration option -that to lock down the kernel - which includes requiring validly signed -modules - if the kernel is secure-booted. - -Signed-off-by: David Howells ---- - arch/x86/Kconfig | 12 ++++++++++++ - arch/x86/kernel/setup.c | 8 +++++++- - 2 files changed, 19 insertions(+), 1 deletion(-) - -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 874c123..a315974 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -1816,6 +1816,18 @@ config EFI_MIXED - - If unsure, say N. - -+config EFI_SECURE_BOOT_LOCK_DOWN -+ def_bool n -+ depends on EFI -+ prompt "Lock down the kernel when UEFI Secure Boot is enabled" -+ ---help--- -+ UEFI Secure Boot provides a mechanism for ensuring that the firmware -+ will only load signed bootloaders and kernels. Certain use cases may -+ also require that all kernel modules also be signed and that -+ userspace is prevented from directly changing the running kernel -+ image. Say Y here to automatically lock down the kernel when a -+ system boots with UEFI Secure Boot enabled. -+ - config SECCOMP - def_bool y - prompt "Enable seccomp to safely compute untrusted bytecode" -diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index 447905e..d44e60e 100644 ---- a/arch/x86/kernel/setup.c -+++ b/arch/x86/kernel/setup.c -@@ -69,6 +69,7 @@ - #include - #include - #include -+#include - - #include - #include