1/*
  2 * Module and Firmware Pinning Security Module
  3 *
  4 * Copyright 2011-2016 Google Inc.
  5 *
  6 * Author: Kees Cook <keescook@chromium.org>
  7 *
  8 * This software is licensed under the terms of the GNU General Public
  9 * License version 2, as published by the Free Software Foundation, and
 10 * may be copied, distributed, and modified under those terms.
 11 *
 12 * This program is distributed in the hope that it will be useful,
 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 15 * GNU General Public License for more details.
 16 */
 17
 18#define pr_fmt(fmt) "LoadPin: " fmt
 19
 20#include <linux/module.h>
 21#include <linux/fs.h>
 22#include <linux/lsm_hooks.h>
 23#include <linux/mount.h>
 24#include <linux/path.h>
 25#include <linux/sched.h>	/* current */
 26#include <linux/string_helpers.h>
 27
 28static void report_load(const char *origin, struct file *file, char *operation)
 29{
 30	char *cmdline, *pathname;
 31
 32	pathname = kstrdup_quotable_file(file, GFP_KERNEL);
 33	cmdline = kstrdup_quotable_cmdline(current, GFP_KERNEL);
 34
 35	pr_notice("%s %s obj=%s%s%s pid=%d cmdline=%s%s%s\n",
 36		  origin, operation,
 37		  (pathname && pathname[0] != '<') ? "\"" : "",
 38		  pathname,
 39		  (pathname && pathname[0] != '<') ? "\"" : "",
 40		  task_pid_nr(current),
 41		  cmdline ? "\"" : "", cmdline, cmdline ? "\"" : "");
 42
 43	kfree(cmdline);
 44	kfree(pathname);
 45}
 46
 47static int enabled = IS_ENABLED(CONFIG_SECURITY_LOADPIN_ENABLED);
 48static struct super_block *pinned_root;
 49static DEFINE_SPINLOCK(pinned_root_spinlock);
 50
 51#ifdef CONFIG_SYSCTL
 52static int zero;
 53static int one = 1;
 54
 55static struct ctl_path loadpin_sysctl_path[] = {
 56	{ .procname = "kernel", },
 57	{ .procname = "loadpin", },
 58	{ }
 59};
 60
 61static struct ctl_table loadpin_sysctl_table[] = {
 62	{
 63		.procname       = "enabled",
 64		.data           = &enabled,
 65		.maxlen         = sizeof(int),
 66		.mode           = 0644,
 67		.proc_handler   = proc_dointvec_minmax,
 68		.extra1         = &zero,
 69		.extra2         = &one,
 70	},
 71	{ }
 72};
 73
 74/*
 75 * This must be called after early kernel init, since then the rootdev
 76 * is available.
 77 */
 78static void check_pinning_enforcement(struct super_block *mnt_sb)
 79{
 80	bool ro = false;
 81
 82	/*
 83	 * If load pinning is not enforced via a read-only block
 84	 * device, allow sysctl to change modes for testing.
 85	 */
 86	if (mnt_sb->s_bdev) {
 87		ro = bdev_read_only(mnt_sb->s_bdev);
 88		pr_info("dev(%u,%u): %s\n",
 89			MAJOR(mnt_sb->s_bdev->bd_dev),
 90			MINOR(mnt_sb->s_bdev->bd_dev),
 91			ro ? "read-only" : "writable");
 92	} else
 93		pr_info("mnt_sb lacks block device, treating as: writable\n");
 94
 95	if (!ro) {
 96		if (!register_sysctl_paths(loadpin_sysctl_path,
 97					   loadpin_sysctl_table))
 98			pr_notice("sysctl registration failed!\n");
 99		else
100			pr_info("load pinning can be disabled.\n");
101	} else
102		pr_info("load pinning engaged.\n");
103}
104#else
105static void check_pinning_enforcement(struct super_block *mnt_sb)
106{
107	pr_info("load pinning engaged.\n");
108}
109#endif
110
111static void loadpin_sb_free_security(struct super_block *mnt_sb)
112{
113	/*
114	 * When unmounting the filesystem we were using for load
115	 * pinning, we acknowledge the superblock release, but make sure
116	 * no other modules or firmware can be loaded.
117	 */
118	if (!IS_ERR_OR_NULL(pinned_root) && mnt_sb == pinned_root) {
119		pinned_root = ERR_PTR(-EIO);
120		pr_info("umount pinned fs: refusing further loads\n");
121	}
122}
123
124static int loadpin_read_file(struct file *file, enum kernel_read_file_id id)
125{
126	struct super_block *load_root;
127	const char *origin = kernel_read_file_id_str(id);
128
129	/* This handles the older init_module API that has a NULL file. */
130	if (!file) {
131		if (!enabled) {
132			report_load(origin, NULL, "old-api-pinning-ignored");
133			return 0;
134		}
135
136		report_load(origin, NULL, "old-api-denied");
137		return -EPERM;
138	}
139
140	load_root = file->f_path.mnt->mnt_sb;
141
142	/* First loaded module/firmware defines the root for all others. */
143	spin_lock(&pinned_root_spinlock);
144	/*
145	 * pinned_root is only NULL at startup. Otherwise, it is either
146	 * a valid reference, or an ERR_PTR.
147	 */
148	if (!pinned_root) {
149		pinned_root = load_root;
150		/*
151		 * Unlock now since it's only pinned_root we care about.
152		 * In the worst case, we will (correctly) report pinning
153		 * failures before we have announced that pinning is
154		 * enabled. This would be purely cosmetic.
155		 */
156		spin_unlock(&pinned_root_spinlock);
157		check_pinning_enforcement(pinned_root);
158		report_load(origin, file, "pinned");
159	} else {
160		spin_unlock(&pinned_root_spinlock);
161	}
162
163	if (IS_ERR_OR_NULL(pinned_root) || load_root != pinned_root) {
164		if (unlikely(!enabled)) {
165			report_load(origin, file, "pinning-ignored");
166			return 0;
167		}
168
169		report_load(origin, file, "denied");
170		return -EPERM;
171	}
172
173	return 0;
174}
175
176static struct security_hook_list loadpin_hooks[] __lsm_ro_after_init = {
177	LSM_HOOK_INIT(sb_free_security, loadpin_sb_free_security),
178	LSM_HOOK_INIT(kernel_read_file, loadpin_read_file),
179};
180
181void __init loadpin_add_hooks(void)
182{
183	pr_info("ready to pin (currently %sabled)", enabled ? "en" : "dis");
184	security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks), "loadpin");
185}
186
187/* Should not be mutable after boot, so not listed in sysfs (perm == 0). */
188module_param(enabled, int, 0);
189MODULE_PARM_DESC(enabled, "Pin module/firmware loading (default: true)");