Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-13 06:32:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

lkdtm: add usercopy test for blocking kernel text

Browse Source 
The upcoming HARDENED_USERCOPY checks will also block access to the
kernel text, so provide a test for this as well.

Signed-off-by: Kees Cook <keescook@chromium.org>
This commit is contained in:
Kees Cook 2016-06-23 22:01:26 -07:00
parent e2402b1d21
commit 6c3521400c
1 changed files with 34 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
drivers/misc/lkdtm_core.c
View File

@ -120,6 +120,7 @@ enum ctype {
CT_USERCOPY_STACK_FRAME_TO,
CT_USERCOPY_STACK_FRAME_FROM,
CT_USERCOPY_STACK_BEYOND,
CT_USERCOPY_KERNEL,
};
static char* cp_name[] = {
@ -171,6 +172,7 @@ static char* cp_type[] = {
"USERCOPY_STACK_FRAME_TO",
"USERCOPY_STACK_FRAME_FROM",
"USERCOPY_STACK_BEYOND",
"USERCOPY_KERNEL",
};
static struct jprobe lkdtm;
@ -495,6 +497,35 @@ free_user:
vm_munmap(user_addr, PAGE_SIZE);
}
static void do_usercopy_kernel(void)
{
unsigned long user_addr;
user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
PROT_READ | PROT_WRITE | PROT_EXEC,
MAP_ANONYMOUS | MAP_PRIVATE, 0);
if (user_addr >= TASK_SIZE) {
pr_warn("Failed to allocate user memory\n");
return;
}
pr_info("attempting good copy_to_user from kernel rodata\n");
if (copy_to_user((void __user *)user_addr, test_text,
sizeof(test_text))) {
pr_warn("copy_to_user failed unexpectedly?!\n");
goto free_user;
}
pr_info("attempting bad copy_to_user from kernel text\n");
if (copy_to_user((void __user *)user_addr, vm_mmap, PAGE_SIZE)) {
pr_warn("copy_to_user failed, but lacked Oops\n");
goto free_user;
}
free_user:
vm_munmap(user_addr, PAGE_SIZE);
}
static void do_usercopy_heap_size(bool to_user)
{
unsigned long user_addr;
@ -957,6 +988,9 @@ static void lkdtm_do_action(enum ctype which)
case CT_USERCOPY_STACK_BEYOND:
do_usercopy_stack(true, false);
break;
case CT_USERCOPY_KERNEL:
do_usercopy_kernel();
break;
case CT_NONE:
default:
break;