Re: [PATCH V32 22/27] bpf: Restrict bpf when kernel lockdown is in confidentiality mode
From: Jann Horn <jannh@google.com>
Date: 2019-04-30 19:19:49
Also in:
bpf, linux-api, linux-security-module, lkml
+bpf list On Wed, Apr 3, 2019 at 8:34 PM Matthew Garrett [off-list ref] wrote:
quoted hunk ↗ jump to hunk
There are some bpf functions can be used to read kernel memory: bpf_probe_read, bpf_probe_write_user and bpf_trace_printk. These allow private keys in kernel memory (e.g. the hibernation image signing key) to be read by an eBPF program and kernel memory to be altered without restriction. Disable them if the kernel has been locked down in confidentiality mode. Suggested-by: Alexei Starovoitov <redacted> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Matthew Garrett <redacted> cc: netdev@vger.kernel.org cc: Chun-Yi Lee <jlee@suse.com> cc: Alexei Starovoitov <redacted> Cc: Daniel Borkmann <daniel@iogearbox.net> --- kernel/trace/bpf_trace.c | 11 +++++++++++ 1 file changed, 11 insertions(+)diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index 8b068adb9da1..9e8eda605b5e 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c@@ -137,6 +137,9 @@ BPF_CALL_3(bpf_probe_read, void *, dst, u32, size, const void *, unsafe_ptr) { int ret; + if (kernel_is_locked_down("BPF", LOCKDOWN_CONFIDENTIALITY)) + return -EINVAL; + ret = probe_kernel_read(dst, unsafe_ptr, size); if (unlikely(ret < 0)) memset(dst, 0, size);
This looks wrong. bpf_probe_read_proto is declared with an ARG_PTR_TO_UNINIT_MEM argument, so if you don't do a "memset(dst, 0, size);" like in the probe_kernel_read() error path, the BPF program can read uninitialized memory.