security/loadpin/loadpin.c - linux - Git at Google

 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Module and Firmware Pinning Security Module
  *
  * Copyright 2011-2016 Google Inc.
  *
  * Author: Kees Cook <keescook@chromium.org>
  */

 #define pr_fmt(fmt) "LoadPin: " fmt

 #include <linux/module.h>
 #include <linux/fs.h>
 #include <linux/kernel_read_file.h>
 #include <linux/lsm_hooks.h>
 #include <linux/mount.h>
 #include <linux/blkdev.h>
 #include <linux/path.h>
 #include <linux/sched.h>	/* current */
 #include <linux/string_helpers.h>

 static void report_load(const char *origin, struct file *file, char *operation)
 {
 	char *cmdline, *pathname;

 	pathname = kstrdup_quotable_file(file, GFP_KERNEL);
 	cmdline = kstrdup_quotable_cmdline(current, GFP_KERNEL);

 	pr_notice("%s %s obj=%s%s%s pid=%d cmdline=%s%s%s\n",
 		  origin, operation,
 		  (pathname && pathname[0] != '<') ? "\"" : "",
 		  pathname,
 		  (pathname && pathname[0] != '<') ? "\"" : "",
 		  task_pid_nr(current),
 		  cmdline ? "\"" : "", cmdline, cmdline ? "\"" : "");

 	kfree(cmdline);
 	kfree(pathname);
 }

 static int enforce = IS_ENABLED(CONFIG_SECURITY_LOADPIN_ENFORCE);
 static char *exclude_read_files[READING_MAX_ID];
 static int ignore_read_file_id[READING_MAX_ID] __ro_after_init;
 static struct super_block *pinned_root;
 static DEFINE_SPINLOCK(pinned_root_spinlock);

 #ifdef CONFIG_SYSCTL

 static struct ctl_path loadpin_sysctl_path[] = {
 	{ .procname = "kernel", },
 	{ .procname = "loadpin", },
 	{ }
 };

 static struct ctl_table loadpin_sysctl_table[] = {
 	{
 		.procname       = "enforce",
 		.data           = &enforce,
 		.maxlen         = sizeof(int),
 		.mode           = 0644,
 		.proc_handler   = proc_dointvec_minmax,
 		.extra1         = SYSCTL_ZERO,
 		.extra2         = SYSCTL_ONE,
 	},
 	{ }
 };

 /*
  * This must be called after early kernel init, since then the rootdev
  * is available.
  */
 static void check_pinning_enforcement(struct super_block *mnt_sb)
 {
 	bool ro = false;

 	/*
 	 * If load pinning is not enforced via a read-only block
 	 * device, allow sysctl to change modes for testing.
 	 */
 	if (mnt_sb->s_bdev) {
 		ro = bdev_read_only(mnt_sb->s_bdev);
 		pr_info("%pg (%u:%u): %s\n", mnt_sb->s_bdev,
 			MAJOR(mnt_sb->s_bdev->bd_dev),
 			MINOR(mnt_sb->s_bdev->bd_dev),
 			ro ? "read-only" : "writable");
 	} else
 		pr_info("mnt_sb lacks block device, treating as: writable\n");

 	if (!ro) {
 		if (!register_sysctl_paths(loadpin_sysctl_path,
 					   loadpin_sysctl_table))
 			pr_notice("sysctl registration failed!\n");
 		else
 			pr_info("enforcement can be disabled.\n");
 	} else
 		pr_info("load pinning engaged.\n");
 }
 #else
 static void check_pinning_enforcement(struct super_block *mnt_sb)
 {
 	pr_info("load pinning engaged.\n");
 }
 #endif

 static void loadpin_sb_free_security(struct super_block *mnt_sb)
 {
 	/*
 	 * When unmounting the filesystem we were using for load
 	 * pinning, we acknowledge the superblock release, but make sure
 	 * no other modules or firmware can be loaded.
 	 */
 	if (!IS_ERR_OR_NULL(pinned_root) && mnt_sb == pinned_root) {
 		pinned_root = ERR_PTR(-EIO);
 		pr_info("umount pinned fs: refusing further loads\n");
 	}
 }

 static int loadpin_read_file(struct file *file, enum kernel_read_file_id id,
 			     bool contents)
 {
 	struct super_block *load_root;
 	const char *origin = kernel_read_file_id_str(id);

 	/*
 	 * If we will not know that we'll be seeing the full contents
 	 * then we cannot trust a load will be complete and unchanged
 	 * off disk. Treat all contents=false hooks as if there were
 	 * no associated file struct.
 	 */
 	if (!contents)
 		file = NULL;

 	/* If the file id is excluded, ignore the pinning. */
 	if ((unsigned int)id < ARRAY_SIZE(ignore_read_file_id) &&
 	    ignore_read_file_id[id]) {
 		report_load(origin, file, "pinning-excluded");
 		return 0;
 	}

 	/* This handles the older init_module API that has a NULL file. */
 	if (!file) {
 		if (!enforce) {
 			report_load(origin, NULL, "old-api-pinning-ignored");
 			return 0;
 		}

 		report_load(origin, NULL, "old-api-denied");
 		return -EPERM;
 	}

 	load_root = file->f_path.mnt->mnt_sb;

 	/* First loaded module/firmware defines the root for all others. */
 	spin_lock(&pinned_root_spinlock);
 	/*
 	 * pinned_root is only NULL at startup. Otherwise, it is either
 	 * a valid reference, or an ERR_PTR.
 	 */
 	if (!pinned_root) {
 		pinned_root = load_root;
 		/*
 		 * Unlock now since it's only pinned_root we care about.
 		 * In the worst case, we will (correctly) report pinning
 		 * failures before we have announced that pinning is
 		 * enforcing. This would be purely cosmetic.
 		 */
 		spin_unlock(&pinned_root_spinlock);
 		check_pinning_enforcement(pinned_root);
 		report_load(origin, file, "pinned");
 	} else {
 		spin_unlock(&pinned_root_spinlock);
 	}

 	if (IS_ERR_OR_NULL(pinned_root) || load_root != pinned_root) {
 		if (unlikely(!enforce)) {
 			report_load(origin, file, "pinning-ignored");
 			return 0;
 		}

 		report_load(origin, file, "denied");
 		return -EPERM;
 	}

 	return 0;
 }

 static int loadpin_load_data(enum kernel_load_data_id id, bool contents)
 {
 	return loadpin_read_file(NULL, (enum kernel_read_file_id) id, contents);
 }

 static struct security_hook_list loadpin_hooks[] __lsm_ro_after_init = {
 	LSM_HOOK_INIT(sb_free_security, loadpin_sb_free_security),
 	LSM_HOOK_INIT(kernel_read_file, loadpin_read_file),
 	LSM_HOOK_INIT(kernel_load_data, loadpin_load_data),
 };

 static void __init parse_exclude(void)
 {
 	int i, j;
 	char *cur;

 	/*
 	 * Make sure all the arrays stay within expected sizes. This
 	 * is slightly weird because kernel_read_file_str[] includes
 	 * READING_MAX_ID, which isn't actually meaningful here.
 	 */
 	BUILD_BUG_ON(ARRAY_SIZE(exclude_read_files) !=
 		     ARRAY_SIZE(ignore_read_file_id));
 	BUILD_BUG_ON(ARRAY_SIZE(kernel_read_file_str) <
 		     ARRAY_SIZE(ignore_read_file_id));

 	for (i = 0; i < ARRAY_SIZE(exclude_read_files); i++) {
 		cur = exclude_read_files[i];
 		if (!cur)
 			break;
 		if (*cur == '\0')
 			continue;

 		for (j = 0; j < ARRAY_SIZE(ignore_read_file_id); j++) {
 			if (strcmp(cur, kernel_read_file_str[j]) == 0) {
 				pr_info("excluding: %s\n",
 					kernel_read_file_str[j]);
 				ignore_read_file_id[j] = 1;
 				/*
 				 * Can not break, because one read_file_str
 				 * may map to more than on read_file_id.
 				 */
 			}
 		}
 	}
 }

 static int __init loadpin_init(void)
 {
 	pr_info("ready to pin (currently %senforcing)\n",
 		enforce ? "" : "not ");
 	parse_exclude();
 	security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks), "loadpin");
 	return 0;
 }

 DEFINE_LSM(loadpin) = {
 	.name = "loadpin",
 	.init = loadpin_init,
 };

 /* Should not be mutable after boot, so not listed in sysfs (perm == 0). */
 module_param(enforce, int, 0);
 MODULE_PARM_DESC(enforce, "Enforce module/firmware pinning");
 module_param_array_named(exclude, exclude_read_files, charp, NULL, 0);
 MODULE_PARM_DESC(exclude, "Exclude pinning specific read file types");
	// SPDX-License-Identifier: GPL-2.0-only
	/*
	* Module and Firmware Pinning Security Module
	*
	* Copyright 2011-2016 Google Inc.
	*
	* Author: Kees Cook <keescook@chromium.org>
	*/

	#define pr_fmt(fmt) "LoadPin: " fmt

	#include <linux/module.h>
	#include <linux/fs.h>
	#include <linux/kernel_read_file.h>
	#include <linux/lsm_hooks.h>
	#include <linux/mount.h>
	#include <linux/blkdev.h>
	#include <linux/path.h>
	#include <linux/sched.h> /* current */
	#include <linux/string_helpers.h>

	static void report_load(const char origin, struct file file, char *operation)
	{
	char cmdline, pathname;

	pathname = kstrdup_quotable_file(file, GFP_KERNEL);
	cmdline = kstrdup_quotable_cmdline(current, GFP_KERNEL);

	pr_notice("%s %s obj=%s%s%s pid=%d cmdline=%s%s%s\n",
	origin, operation,
	(pathname && pathname[0] != '<') ? "\"" : "",
	pathname,
	(pathname && pathname[0] != '<') ? "\"" : "",
	task_pid_nr(current),
	cmdline ? "\"" : "", cmdline, cmdline ? "\"" : "");

	kfree(cmdline);
	kfree(pathname);
	}

	static int enforce = IS_ENABLED(CONFIG_SECURITY_LOADPIN_ENFORCE);
	static char *exclude_read_files[READING_MAX_ID];
	static int ignore_read_file_id[READING_MAX_ID] __ro_after_init;
	static struct super_block *pinned_root;
	static DEFINE_SPINLOCK(pinned_root_spinlock);

	#ifdef CONFIG_SYSCTL

	static struct ctl_path loadpin_sysctl_path[] = {
	{ .procname = "kernel", },
	{ .procname = "loadpin", },
	{ }
	};

	static struct ctl_table loadpin_sysctl_table[] = {
	{
	.procname = "enforce",
	.data = &enforce,
	.maxlen = sizeof(int),
	.mode = 0644,
	.proc_handler = proc_dointvec_minmax,
	.extra1 = SYSCTL_ZERO,
	.extra2 = SYSCTL_ONE,
	},
	{ }
	};

	/*
	* This must be called after early kernel init, since then the rootdev
	* is available.
	*/
	static void check_pinning_enforcement(struct super_block *mnt_sb)
	{
	bool ro = false;

	/*
	* If load pinning is not enforced via a read-only block
	* device, allow sysctl to change modes for testing.
	*/
	if (mnt_sb->s_bdev) {
	ro = bdev_read_only(mnt_sb->s_bdev);
	pr_info("%pg (%u:%u): %s\n", mnt_sb->s_bdev,
	MAJOR(mnt_sb->s_bdev->bd_dev),
	MINOR(mnt_sb->s_bdev->bd_dev),
	ro ? "read-only" : "writable");
	} else
	pr_info("mnt_sb lacks block device, treating as: writable\n");

	if (!ro) {
	if (!register_sysctl_paths(loadpin_sysctl_path,
	loadpin_sysctl_table))
	pr_notice("sysctl registration failed!\n");
	else
	pr_info("enforcement can be disabled.\n");
	} else
	pr_info("load pinning engaged.\n");
	}
	#else
	static void check_pinning_enforcement(struct super_block *mnt_sb)
	{
	pr_info("load pinning engaged.\n");
	}
	#endif

	static void loadpin_sb_free_security(struct super_block *mnt_sb)
	{
	/*
	* When unmounting the filesystem we were using for load
	* pinning, we acknowledge the superblock release, but make sure
	* no other modules or firmware can be loaded.
	*/
	if (!IS_ERR_OR_NULL(pinned_root) && mnt_sb == pinned_root) {
	pinned_root = ERR_PTR(-EIO);
	pr_info("umount pinned fs: refusing further loads\n");
	}
	}

	static int loadpin_read_file(struct file *file, enum kernel_read_file_id id,
	bool contents)
	{
	struct super_block *load_root;
	const char *origin = kernel_read_file_id_str(id);

	/*
	* If we will not know that we'll be seeing the full contents
	* then we cannot trust a load will be complete and unchanged
	* off disk. Treat all contents=false hooks as if there were
	* no associated file struct.
	*/
	if (!contents)
	file = NULL;

	/* If the file id is excluded, ignore the pinning. */
	if ((unsigned int)id < ARRAY_SIZE(ignore_read_file_id) &&
	ignore_read_file_id[id]) {
	report_load(origin, file, "pinning-excluded");
	return 0;
	}

	/* This handles the older init_module API that has a NULL file. */
	if (!file) {
	if (!enforce) {
	report_load(origin, NULL, "old-api-pinning-ignored");
	return 0;
	}

	report_load(origin, NULL, "old-api-denied");
	return -EPERM;
	}

	load_root = file->f_path.mnt->mnt_sb;

	/* First loaded module/firmware defines the root for all others. */
	spin_lock(&pinned_root_spinlock);
	/*
	* pinned_root is only NULL at startup. Otherwise, it is either
	* a valid reference, or an ERR_PTR.
	*/
	if (!pinned_root) {
	pinned_root = load_root;
	/*
	* Unlock now since it's only pinned_root we care about.
	* In the worst case, we will (correctly) report pinning
	* failures before we have announced that pinning is
	* enforcing. This would be purely cosmetic.
	*/
	spin_unlock(&pinned_root_spinlock);
	check_pinning_enforcement(pinned_root);
	report_load(origin, file, "pinned");
	} else {
	spin_unlock(&pinned_root_spinlock);
	}

	if (IS_ERR_OR_NULL(pinned_root) \|\| load_root != pinned_root) {
	if (unlikely(!enforce)) {
	report_load(origin, file, "pinning-ignored");
	return 0;
	}

	report_load(origin, file, "denied");
	return -EPERM;
	}

	return 0;
	}

	static int loadpin_load_data(enum kernel_load_data_id id, bool contents)
	{
	return loadpin_read_file(NULL, (enum kernel_read_file_id) id, contents);
	}

	static struct security_hook_list loadpin_hooks[] __lsm_ro_after_init = {
	LSM_HOOK_INIT(sb_free_security, loadpin_sb_free_security),
	LSM_HOOK_INIT(kernel_read_file, loadpin_read_file),
	LSM_HOOK_INIT(kernel_load_data, loadpin_load_data),
	};

	static void __init parse_exclude(void)
	{
	int i, j;
	char *cur;

	/*
	* Make sure all the arrays stay within expected sizes. This
	* is slightly weird because kernel_read_file_str[] includes
	* READING_MAX_ID, which isn't actually meaningful here.
	*/
	BUILD_BUG_ON(ARRAY_SIZE(exclude_read_files) !=
	ARRAY_SIZE(ignore_read_file_id));
	BUILD_BUG_ON(ARRAY_SIZE(kernel_read_file_str) <
	ARRAY_SIZE(ignore_read_file_id));

	for (i = 0; i < ARRAY_SIZE(exclude_read_files); i++) {
	cur = exclude_read_files[i];
	if (!cur)
	break;
	if (*cur == '\0')
	continue;

	for (j = 0; j < ARRAY_SIZE(ignore_read_file_id); j++) {
	if (strcmp(cur, kernel_read_file_str[j]) == 0) {
	pr_info("excluding: %s\n",
	kernel_read_file_str[j]);
	ignore_read_file_id[j] = 1;
	/*
	* Can not break, because one read_file_str
	* may map to more than on read_file_id.
	*/
	}
	}
	}
	}

	static int __init loadpin_init(void)
	{
	pr_info("ready to pin (currently %senforcing)\n",
	enforce ? "" : "not ");
	parse_exclude();
	security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks), "loadpin");
	return 0;
	}

	DEFINE_LSM(loadpin) = {
	.name = "loadpin",
	.init = loadpin_init,
	};

	/* Should not be mutable after boot, so not listed in sysfs (perm == 0). */
	module_param(enforce, int, 0);
	MODULE_PARM_DESC(enforce, "Enforce module/firmware pinning");
	module_param_array_named(exclude, exclude_read_files, charp, NULL, 0);
	MODULE_PARM_DESC(exclude, "Exclude pinning specific read file types");