Re: [PATCH 18/24] Lock down module params that specify hardware parameters (eg. ioport)
From: Randy Dunlap <rdunlap@infradead.org>
Date: 2018-04-11 17:22:50
Also in:
linux-man, linux-security-module, lkml
On 04/11/2018 09:26 AM, David Howells wrote:
quoted hunk ↗ jump to hunk
Provided an annotation for module parameters that specify hardware parameters (such as io ports, iomem addresses, irqs, dma channels, fixed dma buffers and other types). Suggested-by: Alan Cox <redacted> Signed-off-by: David Howells <dhowells@redhat.com> --- kernel/params.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-)diff --git a/kernel/params.c b/kernel/params.c index cc9108c2a1fd..2c08c4aa376b 100644 --- a/kernel/params.c +++ b/kernel/params.c@@ -108,13 +108,19 @@ bool parameq(const char *a, const char *b) return parameqn(a, b, strlen(a)+1); } -static void param_check_unsafe(const struct kernel_param *kp) +static bool param_check_unsafe(const struct kernel_param *kp, + const char *doing) { if (kp->flags & KERNEL_PARAM_FL_UNSAFE) { pr_warn("Setting dangerous option %s - tainting kernel\n", kp->name); add_taint(TAINT_USER, LOCKDEP_STILL_OK); } + + if (kp->flags & KERNEL_PARAM_FL_HWPARAM && + kernel_is_locked_down("Command line-specified device addresses, irqs and dma channels"))
s/dma/DMA/ Other patches use PCI instead of pci, CIS instead of cis, MMIO instead of mmio, BPF instead of bpf, MSR instead of msr, etc...
+ return false; + return true; } static int parse_one(char *param,
-- ~Randy