Commit 85a58591 authored by James Morris's avatar James Morris

Merge tag 'loadpin-security-next' of...

Merge tag 'loadpin-security-next' of https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux into next-loadpin

LoadPin: report improvement and parameter renaming

- Report human-readable device name during init
- Change boot parameter and Kconfig "enabled" to "enforce"
parents 3f6caaf5 13523bef
...@@ -10,10 +10,10 @@ config SECURITY_LOADPIN ...@@ -10,10 +10,10 @@ config SECURITY_LOADPIN
have a root filesystem backed by a read-only device such as have a root filesystem backed by a read-only device such as
dm-verity or a CDROM. dm-verity or a CDROM.
config SECURITY_LOADPIN_ENABLED config SECURITY_LOADPIN_ENFORCE
bool "Enforce LoadPin at boot" bool "Enforce LoadPin at boot"
depends on SECURITY_LOADPIN depends on SECURITY_LOADPIN
help help
If selected, LoadPin will enforce pinning at boot. If not If selected, LoadPin will enforce pinning at boot. If not
selected, it can be enabled at boot with the kernel parameter selected, it can be enabled at boot with the kernel parameter
"loadpin.enabled=1". "loadpin.enforce=1".
...@@ -44,7 +44,7 @@ static void report_load(const char *origin, struct file *file, char *operation) ...@@ -44,7 +44,7 @@ static void report_load(const char *origin, struct file *file, char *operation)
kfree(pathname); kfree(pathname);
} }
static int enabled = IS_ENABLED(CONFIG_SECURITY_LOADPIN_ENABLED); static int enforce = IS_ENABLED(CONFIG_SECURITY_LOADPIN_ENFORCE);
static struct super_block *pinned_root; static struct super_block *pinned_root;
static DEFINE_SPINLOCK(pinned_root_spinlock); static DEFINE_SPINLOCK(pinned_root_spinlock);
...@@ -60,8 +60,8 @@ static struct ctl_path loadpin_sysctl_path[] = { ...@@ -60,8 +60,8 @@ static struct ctl_path loadpin_sysctl_path[] = {
static struct ctl_table loadpin_sysctl_table[] = { static struct ctl_table loadpin_sysctl_table[] = {
{ {
.procname = "enabled", .procname = "enforce",
.data = &enabled, .data = &enforce,
.maxlen = sizeof(int), .maxlen = sizeof(int),
.mode = 0644, .mode = 0644,
.proc_handler = proc_dointvec_minmax, .proc_handler = proc_dointvec_minmax,
...@@ -84,8 +84,11 @@ static void check_pinning_enforcement(struct super_block *mnt_sb) ...@@ -84,8 +84,11 @@ static void check_pinning_enforcement(struct super_block *mnt_sb)
* device, allow sysctl to change modes for testing. * device, allow sysctl to change modes for testing.
*/ */
if (mnt_sb->s_bdev) { if (mnt_sb->s_bdev) {
char bdev[BDEVNAME_SIZE];
ro = bdev_read_only(mnt_sb->s_bdev); ro = bdev_read_only(mnt_sb->s_bdev);
pr_info("dev(%u,%u): %s\n", bdevname(mnt_sb->s_bdev, bdev);
pr_info("%s (%u:%u): %s\n", bdev,
MAJOR(mnt_sb->s_bdev->bd_dev), MAJOR(mnt_sb->s_bdev->bd_dev),
MINOR(mnt_sb->s_bdev->bd_dev), MINOR(mnt_sb->s_bdev->bd_dev),
ro ? "read-only" : "writable"); ro ? "read-only" : "writable");
...@@ -97,7 +100,7 @@ static void check_pinning_enforcement(struct super_block *mnt_sb) ...@@ -97,7 +100,7 @@ static void check_pinning_enforcement(struct super_block *mnt_sb)
loadpin_sysctl_table)) loadpin_sysctl_table))
pr_notice("sysctl registration failed!\n"); pr_notice("sysctl registration failed!\n");
else else
pr_info("load pinning can be disabled.\n"); pr_info("enforcement can be disabled.\n");
} else } else
pr_info("load pinning engaged.\n"); pr_info("load pinning engaged.\n");
} }
...@@ -128,7 +131,7 @@ static int loadpin_read_file(struct file *file, enum kernel_read_file_id id) ...@@ -128,7 +131,7 @@ static int loadpin_read_file(struct file *file, enum kernel_read_file_id id)
/* This handles the older init_module API that has a NULL file. */ /* This handles the older init_module API that has a NULL file. */
if (!file) { if (!file) {
if (!enabled) { if (!enforce) {
report_load(origin, NULL, "old-api-pinning-ignored"); report_load(origin, NULL, "old-api-pinning-ignored");
return 0; return 0;
} }
...@@ -151,7 +154,7 @@ static int loadpin_read_file(struct file *file, enum kernel_read_file_id id) ...@@ -151,7 +154,7 @@ static int loadpin_read_file(struct file *file, enum kernel_read_file_id id)
* Unlock now since it's only pinned_root we care about. * Unlock now since it's only pinned_root we care about.
* In the worst case, we will (correctly) report pinning * In the worst case, we will (correctly) report pinning
* failures before we have announced that pinning is * failures before we have announced that pinning is
* enabled. This would be purely cosmetic. * enforcing. This would be purely cosmetic.
*/ */
spin_unlock(&pinned_root_spinlock); spin_unlock(&pinned_root_spinlock);
check_pinning_enforcement(pinned_root); check_pinning_enforcement(pinned_root);
...@@ -161,7 +164,7 @@ static int loadpin_read_file(struct file *file, enum kernel_read_file_id id) ...@@ -161,7 +164,7 @@ static int loadpin_read_file(struct file *file, enum kernel_read_file_id id)
} }
if (IS_ERR_OR_NULL(pinned_root) || load_root != pinned_root) { if (IS_ERR_OR_NULL(pinned_root) || load_root != pinned_root) {
if (unlikely(!enabled)) { if (unlikely(!enforce)) {
report_load(origin, file, "pinning-ignored"); report_load(origin, file, "pinning-ignored");
return 0; return 0;
} }
...@@ -186,10 +189,11 @@ static struct security_hook_list loadpin_hooks[] __lsm_ro_after_init = { ...@@ -186,10 +189,11 @@ static struct security_hook_list loadpin_hooks[] __lsm_ro_after_init = {
void __init loadpin_add_hooks(void) void __init loadpin_add_hooks(void)
{ {
pr_info("ready to pin (currently %sabled)", enabled ? "en" : "dis"); pr_info("ready to pin (currently %senforcing)\n",
enforce ? "" : "not ");
security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks), "loadpin"); security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks), "loadpin");
} }
/* Should not be mutable after boot, so not listed in sysfs (perm == 0). */ /* Should not be mutable after boot, so not listed in sysfs (perm == 0). */
module_param(enabled, int, 0); module_param(enforce, int, 0);
MODULE_PARM_DESC(enabled, "Pin module/firmware loading (default: true)"); MODULE_PARM_DESC(enforce, "Enforce module/firmware pinning");
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment