Messages in this thread | | | Date | Wed, 27 Mar 2019 07:47:55 +0900 | From | Masami Hiramatsu <> | Subject | Re: [PATCH 22/27] Lock down kprobes |
| |
On Tue, 26 Mar 2019 10:41:23 -0700 Matthew Garrett <mjg59@google.com> wrote:
> On Tue, Mar 26, 2019 at 5:30 AM Masami Hiramatsu <mhiramat@kernel.org> wrote: > > > > On Mon, 25 Mar 2019 15:09:49 -0700 > > Matthew Garrett <matthewgarrett@google.com> wrote: > > > > > From: David Howells <dhowells@redhat.com> > > > > > > Disallow the creation of kprobes when the kernel is locked down by > > > preventing their registration. This prevents kprobes from being used to > > > access kernel memory, either to make modifications or to steal crypto data. > > > > Hmm, if you enforce signature check of modules, those modules > > should be allowed to use kprobes? > > I think we should introduce some kind of trust inheritance from > > signed (trusted) modules. > > Is there any way to install a kprobe /without/ it coming from a > module? The presumption in lockdown mode is that module signing is > enforced, so I'll admit to not being entirely clear on why this patch > is needed in that case.
Yes, there are 2 paths, ftrace and perf(bpf). If you want to disable ftrace path (which start from user's input via tracefs), this should be done in trace_kprobe_create()@kernel/trace/trace_kprobe.c. If you want to disable both, __register_trace_kprobe()@kernel/trace/trace_kprobe.c is the best place.
Thank you,
-- Masami Hiramatsu <mhiramat@kernel.org>
| |