Re: [PATCH 2/2] powerpc/rtas: block error injection when locked down
From: Paul Moore <paul@paul-moore.com>
Date: 2022-09-23 01:28:28
Also in:
linux-security-module, lkml
On Thu, Sep 22, 2022 at 3:38 PM Nathan Lynch [off-list ref] wrote:
The error injection facility on pseries VMs allows corruption of arbitrary guest memory, potentially enabling a sufficiently privileged user to disable lockdown or perform other modifications of the running kernel via the rtas syscall. Block the PAPR error injection facility from being opened or called when locked down. Signed-off-by: Nathan Lynch <redacted> --- arch/powerpc/kernel/rtas.c | 25 ++++++++++++++++++++++++- include/linux/security.h | 1 + security/security.c | 1 + 3 files changed, 26 insertions(+), 1 deletion(-)
...
quoted hunk ↗ jump to hunk
diff --git a/include/linux/security.h b/include/linux/security.h index 1ca8dbacd3cc..b5d5138ae66a 100644 --- a/include/linux/security.h +++ b/include/linux/security.h@@ -123,6 +123,7 @@ enum lockdown_reason { LOCKDOWN_BPF_WRITE_USER, LOCKDOWN_DBG_WRITE_KERNEL, LOCKDOWN_DEVICE_TREE, + LOCKDOWN_RTAS_ERROR_INJECTION,
With the understanding that I've never heard of RTAS until now, are there any other RTAS events that would require a lockdown reason? As a follow up, is it important to distinguish between different RTAS lockdown reasons? I'm trying to determine if we can just call it LOCKDOWN_RTAS.
quoted hunk ↗ jump to hunk
LOCKDOWN_INTEGRITY_MAX, LOCKDOWN_KCORE, LOCKDOWN_KPROBES,diff --git a/security/security.c b/security/security.c index 2863fc31eec6..6518b239ada2 100644 --- a/security/security.c +++ b/security/security.c@@ -61,6 +61,7 @@ const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = { [LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM", [LOCKDOWN_DBG_WRITE_KERNEL] = "use of kgdb/kdb to write kernel RAM", [LOCKDOWN_DEVICE_TREE] = "modifying device tree contents", + [LOCKDOWN_RTAS_ERROR_INJECTION] = "RTAS error injection",
See above.
[LOCKDOWN_INTEGRITY_MAX] = "integrity",
[LOCKDOWN_KCORE] = "/proc/kcore access",
[LOCKDOWN_KPROBES] = "use of kprobes",
--
2.37.3-- paul-moore.com