LoadPin: report improvement and parameter renaming
- Report human-readable device name during init - Change boot parameter and Kconfig "enabled" to "enforce" -----BEGIN PGP SIGNATURE----- Comment: Kees Cook <kees@outflux.net> iQJKBAABCgA0FiEEpcP2jyKd1g9yPm4TiXL039xtwCYFAlvJEOcWHGtlZXNjb29r QGNocm9taXVtLm9yZwAKCRCJcvTf3G3AJhyQD/4hE+HzgsXh9sgMNVe7A0ZVg5Xr XdNKmU/p5TDK0Tzk0/rfsim/NMxbdbF48Zv9zDBWkL+Qqk6l6kjJh1OZpM2FUcQ0 lGenS3znqq+2PUS/Y/P6/3D4HXO1dm3dWHp2KwCTFWapbptgx5xPGAqNUemS/a4o +hjRWEk4IuY0YQGlLNisoPMCXPsxnLOd2hCARMIxJz8MvcZvKuGlxVOabVAM2Gf0 xKIuUavasIrjs/kc5J0oV/JFHAa3wqjmhcD7GYBo0TbRG7V/YVRKnV7w9RKZeXc+ LmiNtB3li28UdUQTKB4ZI8BLmSWj6VehmsNIf4+tasiSYbBSgoliEn0mYEw398gk Ddb5R4CLDwmzc0cDHJ1NeOYg/j7+v9z0YV0Gq3IyPoExH65TTakmWEKpFeJYJlY7 e3FEFmWy12g44tjLMKKjKFiGYsLh2o87B2GxVNSoM1NnTW5VUWS3JWAjet//tCoQ NwwtPwhvcJfWzRnli7gSdyuFXch4hTGM40bN7MFvVarKdgbGuk05mkhZ2ExrpCZ2 5PjRFrhj+Ubug7pU3HYfphxFb7q/4k7jD+ePayZwL+UUFAN0x+tdgKyhnCCwaEAv paHM9BV0uE5wDScxC0wQzwbqE5T/l1joNpypW2cEEEatfjxTJ32mn+K81YPB7j3U ZNA48iCCw5g2RzUDdA== =eTij -----END PGP SIGNATURE----- Merge tag 'loadpin-security-next' of https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux into next-loadpin LoadPin: report improvement and parameter renaming - Report human-readable device name during init - Change boot parameter and Kconfig "enabled" to "enforce"
This commit is contained in:
James Morris
commit
85a585918f
|
|
@ -10,10 +10,10 @@ config SECURITY_LOADPIN
|
|||
have a root filesystem backed by a read-only device such as
|
||||
dm-verity or a CDROM.
|
||||
|
||||
config SECURITY_LOADPIN_ENABLED
|
||||
config SECURITY_LOADPIN_ENFORCE
|
||||
bool "Enforce LoadPin at boot"
|
||||
depends on SECURITY_LOADPIN
|
||||
help
|
||||
If selected, LoadPin will enforce pinning at boot. If not
|
||||
selected, it can be enabled at boot with the kernel parameter
|
||||
"loadpin.enabled=1".
|
||||
"loadpin.enforce=1".
|
||||
|
|
|
|||
|
|
@ -44,7 +44,7 @@ static void report_load(const char *origin, struct file *file, char *operation)
|
|||
kfree(pathname);
|
||||
}
|
||||
|
||||
static int enabled = IS_ENABLED(CONFIG_SECURITY_LOADPIN_ENABLED);
|
||||
static int enforce = IS_ENABLED(CONFIG_SECURITY_LOADPIN_ENFORCE);
|
||||
static struct super_block *pinned_root;
|
||||
static DEFINE_SPINLOCK(pinned_root_spinlock);
|
||||
|
||||
|
|
@ -60,8 +60,8 @@ static struct ctl_path loadpin_sysctl_path[] = {
|
|||
|
||||
static struct ctl_table loadpin_sysctl_table[] = {
|
||||
{
|
||||
.procname = "enabled",
|
||||
.data = &enabled,
|
||||
.procname = "enforce",
|
||||
.data = &enforce,
|
||||
.maxlen = sizeof(int),
|
||||
.mode = 0644,
|
||||
.proc_handler = proc_dointvec_minmax,
|
||||
|
|
@ -84,8 +84,11 @@ static void check_pinning_enforcement(struct super_block *mnt_sb)
|
|||
* device, allow sysctl to change modes for testing.
|
||||
*/
|
||||
if (mnt_sb->s_bdev) {
|
||||
char bdev[BDEVNAME_SIZE];
|
||||
|
||||
ro = bdev_read_only(mnt_sb->s_bdev);
|
||||
pr_info("dev(%u,%u): %s\n",
|
||||
bdevname(mnt_sb->s_bdev, bdev);
|
||||
pr_info("%s (%u:%u): %s\n", bdev,
|
||||
MAJOR(mnt_sb->s_bdev->bd_dev),
|
||||
MINOR(mnt_sb->s_bdev->bd_dev),
|
||||
ro ? "read-only" : "writable");
|
||||
|
|
@ -97,7 +100,7 @@ static void check_pinning_enforcement(struct super_block *mnt_sb)
|
|||
loadpin_sysctl_table))
|
||||
pr_notice("sysctl registration failed!\n");
|
||||
else
|
||||
pr_info("load pinning can be disabled.\n");
|
||||
pr_info("enforcement can be disabled.\n");
|
||||
} else
|
||||
pr_info("load pinning engaged.\n");
|
||||
}
|
||||
|
|
@ -128,7 +131,7 @@ static int loadpin_read_file(struct file *file, enum kernel_read_file_id id)
|
|||
|
||||
/* This handles the older init_module API that has a NULL file. */
|
||||
if (!file) {
|
||||
if (!enabled) {
|
||||
if (!enforce) {
|
||||
report_load(origin, NULL, "old-api-pinning-ignored");
|
||||
return 0;
|
||||
}
|
||||
|
|
@ -151,7 +154,7 @@ static int loadpin_read_file(struct file *file, enum kernel_read_file_id id)
|
|||
* Unlock now since it's only pinned_root we care about.
|
||||
* In the worst case, we will (correctly) report pinning
|
||||
* failures before we have announced that pinning is
|
||||
* enabled. This would be purely cosmetic.
|
||||
* enforcing. This would be purely cosmetic.
|
||||
*/
|
||||
spin_unlock(&pinned_root_spinlock);
|
||||
check_pinning_enforcement(pinned_root);
|
||||
|
|
@ -161,7 +164,7 @@ static int loadpin_read_file(struct file *file, enum kernel_read_file_id id)
|
|||
}
|
||||
|
||||
if (IS_ERR_OR_NULL(pinned_root) || load_root != pinned_root) {
|
||||
if (unlikely(!enabled)) {
|
||||
if (unlikely(!enforce)) {
|
||||
report_load(origin, file, "pinning-ignored");
|
||||
return 0;
|
||||
}
|
||||
|
|
@ -186,10 +189,11 @@ static struct security_hook_list loadpin_hooks[] __lsm_ro_after_init = {
|
|||
|
||||
void __init loadpin_add_hooks(void)
|
||||
{
|
||||
pr_info("ready to pin (currently %sabled)", enabled ? "en" : "dis");
|
||||
pr_info("ready to pin (currently %senforcing)\n",
|
||||
enforce ? "" : "not ");
|
||||
security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks), "loadpin");
|
||||
}
|
||||
|
||||
/* Should not be mutable after boot, so not listed in sysfs (perm == 0). */
|
||||
module_param(enabled, int, 0);
|
||||
MODULE_PARM_DESC(enabled, "Pin module/firmware loading (default: true)");
|
||||
module_param(enforce, int, 0);
|
||||
MODULE_PARM_DESC(enforce, "Enforce module/firmware pinning");
|
||||
|
|
|
|||
Loading…
Reference in New Issue