Lock down kprobes

Disallow the creation of kprobes when the kernel is locked down by
preventing their registration.  This prevents kprobes from being used to
access kernel memory, either to make modifications or to steal crypto data.

Reported-by: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Gbp-Pq: Topic features/all/lockdown
Gbp-Pq: Name 0026-Lock-down-kprobes.patch

diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index da2ccf14235814df4dc4b21509500d0d777cacb4..26c2c46d7af1cdfae85b6360415a288ab0b60a11 100644 (file)
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1532,6 +1532,9 @@ int register_kprobe(struct kprobe *p)
        struct module *probed_mod;
        kprobe_opcode_t *addr;
 
+       if (kernel_is_locked_down("Use of kprobes"))
+               return -EPERM;
+
        /* Adjust probe address from symbol */
        addr = kprobe_addr(p);
        if (IS_ERR(addr))