lkml.org 
[lkml]   [2019]   [Jul]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    Subject[PATCH V37 13/29] x86/msr: Restrict MSR access when the kernel is locked down
    From
    From: Matthew Garrett <mjg59@srcf.ucam.org>

    Writing to MSRs should not be allowed if the kernel is locked down, since
    it could lead to execution of arbitrary code in kernel mode. Based on a
    patch by Kees Cook.

    Signed-off-by: Matthew Garrett <mjg59@google.com>
    Signed-off-by: David Howells <dhowells@redhat.com>
    Acked-by: Kees Cook <keescook@chromium.org>
    Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
    cc: x86@kernel.org
    ---
    arch/x86/kernel/msr.c | 8 ++++++++
    include/linux/security.h | 1 +
    security/lockdown/lockdown.c | 1 +
    3 files changed, 10 insertions(+)

    diff --git a/arch/x86/kernel/msr.c b/arch/x86/kernel/msr.c
    index 3db2252b958d..1547be359d7f 100644
    --- a/arch/x86/kernel/msr.c
    +++ b/arch/x86/kernel/msr.c
    @@ -34,6 +34,7 @@
    #include <linux/notifier.h>
    #include <linux/uaccess.h>
    #include <linux/gfp.h>
    +#include <linux/security.h>

    #include <asm/cpufeature.h>
    #include <asm/msr.h>
    @@ -79,6 +80,10 @@ static ssize_t msr_write(struct file *file, const char __user *buf,
    int err = 0;
    ssize_t bytes = 0;

    + err = security_locked_down(LOCKDOWN_MSR);
    + if (err)
    + return err;
    +
    if (count % 8)
    return -EINVAL; /* Invalid chunk size */

    @@ -130,6 +135,9 @@ static long msr_ioctl(struct file *file, unsigned int ioc, unsigned long arg)
    err = -EFAULT;
    break;
    }
    + err = security_locked_down(LOCKDOWN_MSR);
    + if (err)
    + break;
    err = wrmsr_safe_regs_on_cpu(cpu, regs);
    if (err)
    break;
    diff --git a/include/linux/security.h b/include/linux/security.h
    index 79250b2ffb8f..155ff026eca4 100644
    --- a/include/linux/security.h
    +++ b/include/linux/security.h
    @@ -109,6 +109,7 @@ enum lockdown_reason {
    LOCKDOWN_HIBERNATION,
    LOCKDOWN_PCI_ACCESS,
    LOCKDOWN_IOPORT,
    + LOCKDOWN_MSR,
    LOCKDOWN_INTEGRITY_MAX,
    LOCKDOWN_CONFIDENTIALITY_MAX,
    };
    diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
    index 316f7cf4e996..d99c0bee739d 100644
    --- a/security/lockdown/lockdown.c
    +++ b/security/lockdown/lockdown.c
    @@ -24,6 +24,7 @@ static char *lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = {
    [LOCKDOWN_HIBERNATION] = "hibernation",
    [LOCKDOWN_PCI_ACCESS] = "direct PCI access",
    [LOCKDOWN_IOPORT] = "raw io port access",
    + [LOCKDOWN_MSR] = "raw MSR access",
    [LOCKDOWN_INTEGRITY_MAX] = "integrity",
    [LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality",
    };
    --
    2.22.0.770.g0f2c4a37fd-goog
    \
     
     \ /
      Last update: 2019-08-01 00:40    [W:4.490 / U:0.104 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site