Thread (57 messages) 57 messages, 15 authors, 2018-05-23
STALE2944d

[PATCH 21/24] Lock down kprobes

From: David Howells <dhowells@redhat.com>
Date: 2018-04-11 16:27:00
Also in: linux-man, linux-security-module, lkml
Subsystem: kprobes, the rest · Maintainers: Naveen N Rao, "David S. Miller", Masami Hiramatsu, Linus Torvalds

Disallow the creation of kprobes when the kernel is locked down by
preventing their registration.  This prevents kprobes from being used to
access kernel memory, either to make modifications or to steal crypto data.

Reported-by: Alexei Starovoitov <redacted>
Signed-off-by: David Howells <dhowells@redhat.com>
---

 kernel/kprobes.c |    3 +++
 1 file changed, 3 insertions(+)
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 102160ff5c66..4f5757732553 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1561,6 +1561,9 @@ int register_kprobe(struct kprobe *p)
 	struct module *probed_mod;
 	kprobe_opcode_t *addr;
 
+	if (kernel_is_locked_down("Use of kprobes"))
+		return -EPERM;
+
 	/* Adjust probe address from symbol */
 	addr = kprobe_addr(p);
 	if (IS_ERR(addr))
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help