Add the ability to lock down access to the running kernel image

Provide a single call to allow kernel code to determine whether the system
should be locked down, thereby disallowing various accesses that might
allow the running kernel image to be changed including the loading of
modules that aren't validly signed with a key we recognise, fiddling with
MSR registers and disallowing hibernation,

Signed-off-by: David Howells <dhowells@redhat.com>
Gbp-Pq: Topic features/all/lockdown
Gbp-Pq: Name 0039-Add-the-ability-to-lock-down-access-to-the-running-k.patch

diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 4b484ab9e1635e6b412038fa2204d3f297a7c97d..be85abf9e0d399087509c78785f9a44665497d21 100644 (file)
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -306,6 +306,15 @@ static inline void refcount_error_report(struct pt_regs *regs, const char *err)
 { }
 #endif
 
+#ifdef CONFIG_LOCK_DOWN_KERNEL
+extern bool kernel_is_locked_down(void);
+#else
+static inline bool kernel_is_locked_down(void)
+{
+       return false;
+}
+#endif
+
 /* Internal, do not use. */
 int __must_check _kstrtoul(const char *s, unsigned int base, unsigned long *res);
 int __must_check _kstrtol(const char *s, unsigned int base, long *res);

diff --git a/include/linux/security.h b/include/linux/security.h
index ce6265960d6c430a90e1ad3c3749d0a438ecaca9..53f4f38f9d1605c84edf08fab03d993eebf5e819 100644 (file)
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1753,5 +1753,16 @@ static inline void free_secdata(void *secdata)
 { }
 #endif /* CONFIG_SECURITY */
 
+#ifdef CONFIG_LOCK_DOWN_KERNEL
+extern void lock_kernel_down(void);
+#ifdef CONFIG_ALLOW_LOCKDOWN_LIFT
+extern void lift_kernel_lockdown(void);
+#endif
+#else
+static inline void lock_kernel_down(void)
+{
+}
+#endif
+
 #endif /* ! __LINUX_SECURITY_H */
 

diff --git a/security/Kconfig b/security/Kconfig
index 5f4946505cfa785b4a2a186ad4921df986b31672..be370ddedd41fe94f6fd4e038f8578b229ba9af5 100644 (file)
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -225,6 +225,21 @@ config STATIC_USERMODEHELPER_PATH
          If you wish for all usermode helper programs to be disabled,
          specify an empty string here (i.e. "").
 
+config LOCK_DOWN_KERNEL
+       bool "Allow the kernel to be 'locked down'"
+       help
+         Allow the kernel to be locked down under certain circumstances, for
+         instance if UEFI secure boot is enabled.  Locking down the kernel
+         turns off various features that might otherwise allow access to the
+         kernel image (eg. setting MSR registers).
+
+config ALLOW_LOCKDOWN_LIFT
+       bool
+       help
+         Allow the lockdown on a kernel to be lifted, thereby restoring the
+         ability of userspace to access the kernel image (eg. by SysRq+x under
+         x86).
+
 source security/selinux/Kconfig
 source security/smack/Kconfig
 source security/tomoyo/Kconfig

diff --git a/security/Makefile b/security/Makefile
index 4d2d3782ddefd3fbdd6d2984a1faa8a2bd6561ae..507ac8c520ce531e5d7cc2b89ae0e6ad412747b5 100644 (file)
--- a/security/Makefile
+++ b/security/Makefile
@@ -30,3 +30,6 @@ obj-$(CONFIG_CGROUP_DEVICE)           += device_cgroup.o
 # Object integrity file lists
 subdir-$(CONFIG_INTEGRITY)             += integrity
 obj-$(CONFIG_INTEGRITY)                        += integrity/
+
+# Allow the kernel to be locked down
+obj-$(CONFIG_LOCK_DOWN_KERNEL)         += lock_down.o

diff --git a/security/lock_down.c b/security/lock_down.c
new file mode 100644 (file)
index 0000000..5788c60
--- /dev/null
+++ b/security/lock_down.c
@@ -0,0 +1,40 @@
+/* Lock down the kernel
+ *
+ * Copyright (C) 2016 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#include <linux/security.h>
+#include <linux/export.h>
+
+static __read_mostly bool kernel_locked_down;
+
+/*
+ * Put the kernel into lock-down mode.
+ */
+void lock_kernel_down(void)
+{
+       kernel_locked_down = true;
+}
+
+/*
+ * Take the kernel out of lockdown mode.
+ */
+void lift_kernel_lockdown(void)
+{
+       kernel_locked_down = false;
+}
+
+/**
+ * kernel_is_locked_down - Find out if the kernel is locked down
+ */
+bool kernel_is_locked_down(void)
+{
+       return kernel_locked_down;
+}
+EXPORT_SYMBOL(kernel_is_locked_down);