security/lockdown/lockdown.c

0001 // SPDX-License-Identifier: GPL-2.0
0002 /* Lock down the kernel
0003  *
0004  * Copyright (C) 2016 Red Hat, Inc. All Rights Reserved.
0005  * Written by David Howells (dhowells@redhat.com)
0006  *
0007  * This program is free software; you can redistribute it and/or
0008  * modify it under the terms of the GNU General Public Licence
0009  * as published by the Free Software Foundation; either version
0010  * 2 of the Licence, or (at your option) any later version.
0011  */
0012
0013 #include <linux/security.h>
0014 #include <linux/export.h>
0015 #include <linux/lsm_hooks.h>
0016
0017 static enum lockdown_reason kernel_locked_down;
0018
0019 static const enum lockdown_reason lockdown_levels[] = {LOCKDOWN_NONE,
0020                          LOCKDOWN_INTEGRITY_MAX,
0021                          LOCKDOWN_CONFIDENTIALITY_MAX};
0022
0023 /*
0024  * Put the kernel into lock-down mode.
0025  */
0026 static int lock_kernel_down(const char *where, enum lockdown_reason level)
0027 {
0028     if (kernel_locked_down >= level)
0029         return -EPERM;
0030
0031     kernel_locked_down = level;
0032     pr_notice("Kernel is locked down from %s; see man kernel_lockdown.7\n",
0033           where);
0034     return 0;
0035 }
0036
0037 static int __init lockdown_param(char *level)
0038 {
0039     if (!level)
0040         return -EINVAL;
0041
0042     if (strcmp(level, "integrity") == 0)
0043         lock_kernel_down("command line", LOCKDOWN_INTEGRITY_MAX);
0044     else if (strcmp(level, "confidentiality") == 0)
0045         lock_kernel_down("command line", LOCKDOWN_CONFIDENTIALITY_MAX);
0046     else
0047         return -EINVAL;
0048
0049     return 0;
0050 }
0051
0052 early_param("lockdown", lockdown_param);
0053
0054 /**
0055  * lockdown_is_locked_down - Find out if the kernel is locked down
0056  * @what: Tag to use in notice generated if lockdown is in effect
0057  */
0058 static int lockdown_is_locked_down(enum lockdown_reason what)
0059 {
0060     if (WARN(what >= LOCKDOWN_CONFIDENTIALITY_MAX,
0061          "Invalid lockdown reason"))
0062         return -EPERM;
0063
0064     if (kernel_locked_down >= what) {
0065         if (lockdown_reasons[what])
0066             pr_notice("Lockdown: %s: %s is restricted; see man kernel_lockdown.7\n",
0067                   current->comm, lockdown_reasons[what]);
0068         return -EPERM;
0069     }
0070
0071     return 0;
0072 }
0073
0074 static struct security_hook_list lockdown_hooks[] __lsm_ro_after_init = {
0075     LSM_HOOK_INIT(locked_down, lockdown_is_locked_down),
0076 };
0077
0078 static int __init lockdown_lsm_init(void)
0079 {
0080 #if defined(CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY)
0081     lock_kernel_down("Kernel configuration", LOCKDOWN_INTEGRITY_MAX);
0082 #elif defined(CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY)
0083     lock_kernel_down("Kernel configuration", LOCKDOWN_CONFIDENTIALITY_MAX);
0084 #endif
0085     security_add_hooks(lockdown_hooks, ARRAY_SIZE(lockdown_hooks),
0086                "lockdown");
0087     return 0;
0088 }
0089
0090 static ssize_t lockdown_read(struct file *filp, char __user *buf, size_t count,
0091                  loff_t *ppos)
0092 {
0093     char temp[80];
0094     int i, offset = 0;
0095
0096     for (i = 0; i < ARRAY_SIZE(lockdown_levels); i++) {
0097         enum lockdown_reason level = lockdown_levels[i];
0098
0099         if (lockdown_reasons[level]) {
0100             const char *label = lockdown_reasons[level];
0101
0102             if (kernel_locked_down == level)
0103                 offset += sprintf(temp+offset, "[%s] ", label);
0104             else
0105                 offset += sprintf(temp+offset, "%s ", label);
0106         }
0107     }
0108
0109     /* Convert the last space to a newline if needed. */
0110     if (offset > 0)
0111         temp[offset-1] = '\n';
0112
0113     return simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
0114 }
0115
0116 static ssize_t lockdown_write(struct file *file, const char __user *buf,
0117                   size_t n, loff_t *ppos)
0118 {
0119     char *state;
0120     int i, len, err = -EINVAL;
0121
0122     state = memdup_user_nul(buf, n);
0123     if (IS_ERR(state))
0124         return PTR_ERR(state);
0125
0126     len = strlen(state);
0127     if (len && state[len-1] == '\n') {
0128         state[len-1] = '\0';
0129         len--;
0130     }
0131
0132     for (i = 0; i < ARRAY_SIZE(lockdown_levels); i++) {
0133         enum lockdown_reason level = lockdown_levels[i];
0134         const char *label = lockdown_reasons[level];
0135
0136         if (label && !strcmp(state, label))
0137             err = lock_kernel_down("securityfs", level);
0138     }
0139
0140     kfree(state);
0141     return err ? err : n;
0142 }
0143
0144 static const struct file_operations lockdown_ops = {
0145     .read  = lockdown_read,
0146     .write = lockdown_write,
0147 };
0148
0149 static int __init lockdown_secfs_init(void)
0150 {
0151     struct dentry *dentry;
0152
0153     dentry = securityfs_create_file("lockdown", 0644, NULL, NULL,
0154                     &lockdown_ops);
0155     return PTR_ERR_OR_ZERO(dentry);
0156 }
0157
0158 core_initcall(lockdown_secfs_init);
0159
0160 #ifdef CONFIG_SECURITY_LOCKDOWN_LSM_EARLY
0161 DEFINE_EARLY_LSM(lockdown) = {
0162 #else
0163 DEFINE_LSM(lockdown) = {
0164 #endif
0165     .name = "lockdown",
0166     .init = lockdown_lsm_init,
0167 };