After doing some research it appears that for Intel chips, only a single
register needs to be writeable. I'm not sure about AMD etc.

intel-undervolt/blob/master/config.h:

    #define MSR_ADDR_TEMPERATURE 0x1a2
    #define MSR_ADDR_UNITS 0x606
    #define MSR_ADDR_VOLTAGE 0x150

Perhaps add an MSR whitelist to allow writing, if
LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY=Y and
CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=Y?

CONFIG_SECURITY_LOCKDOWN_LSM_EARLY is likely what prevents Apparmor or
some other LSM policy manager allow this behavior...

as an option at build time would be more sensible?

On 12/1/19 2:53 PM, Matt Parnell wrote:

That is, I was intending to use lockdown from boot, which isn't
changeable after the fact if I'm not mistaken. How possible is granular
control of what is and is not locked down?

On 11/30/19 1:09 PM, Matt Parnell wrote:

quoted

I can see how using a policy would be beneficial; I only did this
because as I understood it, policy wouldn't be able to change these
particular settings since anything attempting to do so would be from
userspace.

On 11/30/19 12:36 PM, Kees Cook wrote:

quoted

On Sat, Nov 30, 2019 at 12:49:48AM -0600, Matt Parnell wrote:

quoted

From 452b8460e464422d268659a8abb93353a182f8c8 Mon Sep 17 00:00:00 2001
From: Matt Parnell <redacted>
Date: Sat, 30 Nov 2019 00:44:09 -0600
Subject: [PATCH] Kernel Lockdown: Add an option to allow raw MSR access even
 in confidentiality mode.

For Intel CPUs, some of the MDS mitigations utilize the new "flush" MSR, and
while this isn't something normally used in userspace, it does cause false
positives for the "Forshadow" vulnerability.

Additionally, Intel CPUs use MSRs for voltage and frequency controls,
which in
many cases is useful for undervolting to avoid excess heat.

Signed-off-by: Matt Parnell <redacted>

I would expect this to just be implemented via LSM policy, not ifdefs
and Kconfig?

-Kees

quoted

---
 arch/x86/kernel/msr.c     |  5 ++++-
 security/lockdown/Kconfig | 12 ++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kernel/msr.c b/arch/x86/kernel/msr.c
index 1547be359d7f..4adce59455c3 100644
--- a/arch/x86/kernel/msr.c
+++ b/arch/x86/kernel/msr.c

@@ -80,10 +80,11 @@ static ssize_t msr_write(struct file *file, const

char __user *buf,
     int err = 0;
     ssize_t bytes = 0;
 
+#if defined(LOCK_DOWN_DENY_RAW_MSR)
     err = security_locked_down(LOCKDOWN_MSR);
     if (err)
         return err;
-
+#endif
     if (count % 8)
         return -EINVAL;    /* Invalid chunk size */
 

@@ -135,9 +136,11 @@ static long msr_ioctl(struct file *file, unsigned

int ioc, unsigned long arg)
             err = -EFAULT;
             break;
         }
+#if defined(LOCK_DOWN_DENY_RAW_MSR)
         err = security_locked_down(LOCKDOWN_MSR);
         if (err)
             break;
+#endif
         err = wrmsr_safe_regs_on_cpu(cpu, regs);
         if (err)
             break;

diff --git a/security/lockdown/Kconfig b/security/lockdown/Kconfig
index e84ddf484010..f4fe72c4bf8f 100644
--- a/security/lockdown/Kconfig
+++ b/security/lockdown/Kconfig

@@ -44,4 +44,16 @@ config LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY

      code to read confidential material held inside the kernel are
      disabled.
 
+config LOCK_DOWN_DENY_RAW_MSR
+    bool "Lock down and deny raw MSR access"
+    depends on LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY
+    default y
+    help
+      Some Intel based systems require raw MSR access to use the flush
+      MSR for MDS mitigation confirmation. Raw access can also be used
+      to undervolt many Intel CPUs.
+
+      Say Y to prevent access or N to allow raw MSR access for such
+      cases.
+
 endchoice
-- 
2.24.0