Re: [PATCH 00/24] Kernel lockdown

From: Justin Forbes
Date: Fri Apr 07 2017 - 12:33:09 EST


On Wed, Apr 5, 2017 at 12:07 PM, David Howells <dhowells@xxxxxxxxxx> wrote:
>
> These patches provide a facility by which a variety of avenues by which
> userspace can feasibly modify the running kernel image can be locked down.
> These include:
>
> (*) No unsigned modules and no modules for which can't validate the
> signature.
>
> (*) No use of ioperm(), iopl() and no writing to /dev/port.
>
> (*) No writing to /dev/mem or /dev/kmem.
>
> (*) No hibernation.
>
> (*) Restrict PCI BAR access.
>
> (*) Restrict MSR access.
>
> (*) No kexec_load().
>
> (*) Certain ACPI restrictions.
>
> (*) Restrict debugfs interface to ASUS WMI.
>
> The lock-down can be configured to be triggered by the EFI secure boot
> status, provided the shim isn't insecure. The lock-down can be lifted by
> typing SysRq+x on a keyboard attached to the system.
>
>
> The patches can be found here also:
>
> http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git/log/?h=efi-lockdown
>
> They are dependent on the hwparam branch, which I posted separately.
>
> David
> ---
> Dave Young (1):
> Copy secure_boot flag in boot params across kexec reboot
>
> David Howells (7):
> Add the ability to lock down access to the running kernel image
> efi: Lock down the kernel if booted in secure boot mode
> Enforce module signatures if the kernel is locked down
> scsi: Lock down the eata driver
> Prohibit PCMCIA CIS storage when the kernel is locked down
> Lock down TIOCSSERIAL
> Lock down module params that specify hardware parameters (eg. ioport)
>
> Josh Boyer (3):
> efi: Add EFI_SECURE_BOOT bit
> hibernate: Disable when the kernel is locked down
> acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down
>
> Kyle McMartin (1):
> Add a sysrq option to exit secure boot mode
>
> Lee, Chun-Yi (2):
> kexec_file: Disable at runtime if securelevel has been set
> bpf: Restrict kernel image access functions when the kernel is locked down
>
> Linn Crosetto (2):
> acpi: Disable ACPI table override if the kernel is locked down
> acpi: Disable APEI error injection if the kernel is locked down
>
> Matthew Garrett (8):
> Restrict /dev/mem and /dev/kmem when the kernel is locked down
> kexec: Disable at runtime if the kernel is locked down
> uswsusp: Disable when the kernel is locked down
> PCI: Lock down BAR access when the kernel is locked down
> x86: Lock down IO port access when the kernel is locked down
> x86: Restrict MSR access when the kernel is locked down
> asus-wmi: Restrict debugfs interface when the kernel is locked down
> ACPI: Limit access to custom_method when the kernel is locked down
>
>
> arch/x86/Kconfig | 22 ++++++++++++++++++++
> arch/x86/kernel/ioport.c | 4 ++--
> arch/x86/kernel/kexec-bzimage64.c | 1 +
> arch/x86/kernel/msr.c | 7 ++++++
> arch/x86/kernel/setup.c | 40 ++++++++++++++++++++++++++++++++++++-
> drivers/acpi/apei/einj.c | 3 +++
> drivers/acpi/custom_method.c | 3 +++
> drivers/acpi/osl.c | 2 +-
> drivers/acpi/tables.c | 5 +++++
> drivers/char/mem.c | 8 +++++++
> drivers/input/misc/uinput.c | 1 +
> drivers/pci/pci-sysfs.c | 9 ++++++++
> drivers/pci/proc.c | 8 ++++++-
> drivers/pci/syscall.c | 2 +-
> drivers/pcmcia/cistpl.c | 5 +++++
> drivers/platform/x86/asus-wmi.c | 9 ++++++++
> drivers/scsi/eata.c | 7 ++++++
> drivers/tty/serial/serial_core.c | 6 ++++++
> drivers/tty/sysrq.c | 19 ++++++++++++------
> include/linux/efi.h | 1 +
> include/linux/input.h | 5 +++++
> include/linux/kernel.h | 9 ++++++++
> include/linux/security.h | 11 ++++++++++
> include/linux/sysrq.h | 8 ++++++-
> kernel/debug/kdb/kdb_main.c | 2 +-
> kernel/kexec.c | 7 ++++++
> kernel/kexec_file.c | 6 ++++++
> kernel/module.c | 2 +-
> kernel/params.c | 27 ++++++++++++++++++++-----
> kernel/power/hibernate.c | 2 +-
> kernel/power/user.c | 3 +++
> kernel/trace/bpf_trace.c | 11 ++++++++++
> security/Kconfig | 15 ++++++++++++++
> security/Makefile | 3 +++
> security/lock_down.c | 40 +++++++++++++++++++++++++++++++++++++
> 35 files changed, 291 insertions(+), 22 deletions(-)
> create mode 100644 security/lock_down.c
>

Tested-by: Justin Forbes <jforbes@xxxxxxxxxxxxxxxxx>