-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy path0005.patch
More file actions
160 lines (151 loc) · 5.5 KB
/
0005.patch
File metadata and controls
160 lines (151 loc) · 5.5 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
diff -rcNP void-hardened-kernel 2/Documentation/admin-guide/kernel-parameters.txt void-hardened-kernel/Documentation/admin-guide/kernel-parameters.txt
*** void-hardened-kernel 2/Documentation/admin-guide/kernel-parameters.txt 2021-04-08 00:01:58.000000000 +0300
--- void-hardened-kernel/Documentation/admin-guide/kernel-parameters.txt 2021-04-11 22:39:31.000000000 +0300
***************
*** 2689,2694 ****
--- 2689,2698 ----
log everything. Information is printed at KERN_DEBUG
so loglevel=8 may also need to be specified.
+ modharden= [SECURITY]
+ on - Restrict module auto-loading to CAP_SYS_MODULE
+ off - Don't restrict module auto-loading
+
module.sig_enforce
[KNL] When CONFIG_MODULE_SIG is set, this means that
modules without (valid) signatures will fail to load.
diff -rcNP void-hardened-kernel 2/Documentation/admin-guide/sysctl/kernel.rst void-hardened-kernel/Documentation/admin-guide/sysctl/kernel.rst
*** void-hardened-kernel 2/Documentation/admin-guide/sysctl/kernel.rst 2021-04-08 00:01:58.000000000 +0300
--- void-hardened-kernel/Documentation/admin-guide/sysctl/kernel.rst 2021-04-11 22:39:31.000000000 +0300
***************
*** 469,474 ****
--- 469,488 ----
0, the cache is disabled. Enabled if nonzero.
+ modharden:
+ ==========
+
+ This toggle indicates whether unprivileged users are allowed to
+ auto-load kernel modules.
+
+ When modharden is set to (0) there are no restrictions. When
+ modharden is set to (1), only users with ``CAP_SYS_MODULE`` are
+ permitted to load kernel modules
+
+ The kernel config option ``CONFIG_SECURITY_MODHARDEN`` sets the
+ default value of modharden.
+
+
modules_disabled:
=================
diff -rcNP void-hardened-kernel 2/include/linux/kmod.h void-hardened-kernel/include/linux/kmod.h
*** void-hardened-kernel 2/include/linux/kmod.h 2021-04-08 00:01:58.000000000 +0300
--- void-hardened-kernel/include/linux/kmod.h 2021-04-11 22:39:31.000000000 +0300
***************
*** 22,27 ****
--- 22,28 ----
* usually useless though. */
extern __printf(2, 3)
int __request_module(bool wait, const char *name, ...);
+ extern int modharden;
#define request_module(mod...) __request_module(true, mod)
#define request_module_nowait(mod...) __request_module(false, mod)
#define try_then_request_module(x, mod...) \
diff -rcNP void-hardened-kernel 2/kernel/kmod.c void-hardened-kernel/kernel/kmod.c
*** void-hardened-kernel 2/kernel/kmod.c 2021-04-08 00:01:58.000000000 +0300
--- void-hardened-kernel/kernel/kmod.c 2021-04-11 22:39:31.000000000 +0300
***************
*** 106,111 ****
--- 106,128 ----
return -ENOMEM;
}
+ int modharden __read_mostly = IS_ENABLED(CONFIG_SECURITY_MODHARDEN);
+
+ static int __init enable_modharden(char *level)
+ {
+ if (!level)
+ return -EINVAL;
+
+ if (strcmp(level, "on") == 0)
+ modharden = 1;
+ else if (strcmp(level, "off") == 0)
+ modharden = 0;
+ else
+ return -EINVAL;
+
+ return 0;
+ }
+ early_param("modharden", enable_modharden);
/**
* __request_module - try to load a kernel module
* @wait: wait (or not) for the operation to complete
***************
*** 149,154 ****
--- 166,176 ----
if (ret)
return ret;
+ if (modharden && !capable(CAP_SYS_MODULE)) {
+ printk(KERN_ALERT "denied attempt to auto-load module %s\n", module_name);
+ return -EPERM;
+ }
+
if (atomic_dec_if_positive(&kmod_concurrent_max) < 0) {
pr_warn_ratelimited("request_module: kmod_concurrent_max (%u) close to 0 (max_modprobes: %u), for module %s, throttling...",
atomic_read(&kmod_concurrent_max),
diff -rcNP void-hardened-kernel 2/kernel/sysctl.c void-hardened-kernel/kernel/sysctl.c
*** void-hardened-kernel 2/kernel/sysctl.c 2021-04-08 00:01:58.000000000 +0300
--- void-hardened-kernel/kernel/sysctl.c 2021-04-11 22:39:31.000000000 +0300
***************
*** 730,735 ****
--- 730,744 ----
.extra1 = SYSCTL_ONE,
.extra2 = SYSCTL_ONE,
},
+ {
+ .procname = "modharden",
+ .data = &modharden,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_minmax,
+ .extra1 = SYSCTL_ZERO,
+ .extra2 = SYSCTL_ONE,
+ },
#endif
#ifdef CONFIG_UEVENT_HELPER
{
diff -rcNP void-hardened-kernel 2/security/Kconfig void-hardened-kernel/security/Kconfig
*** void-hardened-kernel 2/security/Kconfig 2021-04-08 00:01:58.000000000 +0300
--- void-hardened-kernel/security/Kconfig 2021-04-11 22:43:45.000000000 +0300
***************
*** 42,47 ****
--- 42,69 ----
If you are unsure how to answer this question, answer N.
+ config SECURITY_MODHARDEN
+ bool "Harden module auto-loading"
+ default n
+ depends on MODULES
+ help
+ If you say Y here, module auto-loading in response to use of some
+ feature implemented by an unloaded module will be restricted to
+ CAP_SYS_MODULE. Enabling this option helps defend against attacks
+ by unprivileged users who abuse the auto-loading behavior to
+ cause a vulnerable module to load that is then exploited.
+
+ If this option prevents a legitimate use of auto-loading for a
+ non-root user, the administrator can execute modprobe manually
+ with the exact name of the module mentioned in the alert log.
+ Alternatively, the administrator can add the module to the list
+ of modules loaded at boot by modifying init scripts.
+
+ This setting can be overridden at runtime via the
+ kernel.modharden sysctl.
+
+ If unsure say N.
+
config SECURITY
bool "Enable different security models"
depends on SYSFS
***************
*** 353,356 ****
source "security/Kconfig.hardening"
endmenu
-
--- 375,377 ----