Lock down kprobes

Disallow the creation of kprobes when the kernel is locked down by
preventing their registration.  This prevents kprobes from being used to
access kernel memory, either to make modifications or to steal crypto data.

Reported-by: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Gbp-Pq: Topic features/all/lockdown
Gbp-Pq: Name 0024-Lock-down-kprobes.patch

diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index ebe8315a756a2593f0e9bab3f37efe7885a347ed..2cce4b714e3f7a83141b7024f8b05def553afdd8 100644 (file)
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1557,6 +1557,9 @@ int register_kprobe(struct kprobe *p)
        struct module *probed_mod;
        kprobe_opcode_t *addr;
 
+       if (kernel_is_locked_down("Use of kprobes"))
+               return -EPERM;
+
        /* Adjust probe address from symbol */
        addr = kprobe_addr(p);
        if (IS_ERR(addr))