From 6736286c444e8f27819681f8236a7aade9f15b64 Mon Sep 17 00:00:00 2001 From: Matthew Garrett Date: Wed, 5 Apr 2017 17:40:30 +0100 Subject: [PATCH] Restrict /dev/mem and /dev/kmem when the kernel is locked down Allowing users to write to address space makes it possible for the kernel to be subverted, avoiding module loading restrictions. Prevent this when the kernel has been locked down. Signed-off-by: Matthew Garrett Signed-off-by: David Howells Gbp-Pq: Topic features/all/lockdown Gbp-Pq: Name 0042-Restrict-dev-mem-and-dev-kmem-when-the-kernel-is-loc.patch --- drivers/char/mem.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/char/mem.c b/drivers/char/mem.c index 593a8818aca..ba68add9677 100644 --- a/drivers/char/mem.c +++ b/drivers/char/mem.c @@ -179,6 +179,9 @@ static ssize_t write_mem(struct file *file, const char __user *buf, if (p != *ppos) return -EFBIG; + if (kernel_is_locked_down()) + return -EPERM; + if (!valid_phys_addr_range(p, count)) return -EFAULT; @@ -540,6 +543,9 @@ static ssize_t write_kmem(struct file *file, const char __user *buf, char *kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */ int err = 0; + if (kernel_is_locked_down()) + return -EPERM; + if (p < (unsigned long) high_memory) { unsigned long to_write = min_t(unsigned long, count, (unsigned long)high_memory - p); -- 2.30.2