Something went wrong. Try again.
(I'm so sorry!) Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173// SPDX-License-Identifier: GPL-2.0/* Lock down the kernel * * Copyright (C) 2016 Red Hat, Inc. All Rights Reserved. * Written by David Howells (dhowells@redhat.com) * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public Licence * as published by the Free Software Foundation; either version * 2 of the Licence, or (at your option) any later version. */
#include <linux/security.h>#include <linux/export.h>#include <linux/lsm_hooks.h>#include <uapi/linux/lsm.h>
static enum lockdown_reason kernel_locked_down;
static const enum lockdown_reason lockdown_levels[] = {LOCKDOWN_NONE, LOCKDOWN_INTEGRITY_MAX, LOCKDOWN_CONFIDENTIALITY_MAX};
/* * Put the kernel into lock-down mode. */static int lock_kernel_down(const char *where, enum lockdown_reason level){ if (kernel_locked_down >= level) return -EPERM;
kernel_locked_down = level; pr_notice("Kernel is locked down from %s; see man kernel_lockdown.7\n", where); return 0;}
static int __init lockdown_param(char *level){ if (!level) return -EINVAL;
if (strcmp(level, "integrity") == 0) lock_kernel_down("command line", LOCKDOWN_INTEGRITY_MAX); else if (strcmp(level, "confidentiality") == 0) lock_kernel_down("command line", LOCKDOWN_CONFIDENTIALITY_MAX); else return -EINVAL;
return 0;}
early_param("lockdown", lockdown_param);
/** * lockdown_is_locked_down - Find out if the kernel is locked down * @what: Tag to use in notice generated if lockdown is in effect */static int lockdown_is_locked_down(enum lockdown_reason what){ if (WARN(what >= LOCKDOWN_CONFIDENTIALITY_MAX, "Invalid lockdown reason")) return -EPERM;
if (kernel_locked_down >= what) { if (lockdown_reasons[what]) pr_notice_ratelimited("Lockdown: %s: %s is restricted; see man kernel_lockdown.7\n", current->comm, lockdown_reasons[what]); return -EPERM; }
return 0;}
static struct security_hook_list lockdown_hooks[] __ro_after_init = { LSM_HOOK_INIT(locked_down, lockdown_is_locked_down),};
static const struct lsm_id lockdown_lsmid = { .name = "lockdown", .id = LSM_ID_LOCKDOWN,};
static int __init lockdown_lsm_init(void){#if defined(CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY) lock_kernel_down("Kernel configuration", LOCKDOWN_INTEGRITY_MAX);#elif defined(CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY) lock_kernel_down("Kernel configuration", LOCKDOWN_CONFIDENTIALITY_MAX);#endif security_add_hooks(lockdown_hooks, ARRAY_SIZE(lockdown_hooks), &lockdown_lsmid); return 0;}
static ssize_t lockdown_read(struct file *filp, char __user *buf, size_t count, loff_t *ppos){ char temp[80] = ""; int i, offset = 0;
for (i = 0; i < ARRAY_SIZE(lockdown_levels); i++) { enum lockdown_reason level = lockdown_levels[i];
if (lockdown_reasons[level]) { const char *label = lockdown_reasons[level];
if (kernel_locked_down == level) offset += sprintf(temp+offset, "[%s] ", label); else offset += sprintf(temp+offset, "%s ", label); } }
/* Convert the last space to a newline if needed. */ if (offset > 0) temp[offset-1] = '\n';
return simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));}
static ssize_t lockdown_write(struct file *file, const char __user *buf, size_t n, loff_t *ppos){ char *state; int i, len, err = -EINVAL;
state = memdup_user_nul(buf, n); if (IS_ERR(state)) return PTR_ERR(state);
len = strlen(state); if (len && state[len-1] == '\n') { state[len-1] = '\0'; len--; }
for (i = 0; i < ARRAY_SIZE(lockdown_levels); i++) { enum lockdown_reason level = lockdown_levels[i]; const char *label = lockdown_reasons[level];
if (label && !strcmp(state, label)) err = lock_kernel_down("securityfs", level); }
kfree(state); return err ? err : n;}
static const struct file_operations lockdown_ops = { .read = lockdown_read, .write = lockdown_write,};
static int __init lockdown_secfs_init(void){ struct dentry *dentry;
dentry = securityfs_create_file("lockdown", 0644, NULL, NULL, &lockdown_ops); return PTR_ERR_OR_ZERO(dentry);}
#ifdef CONFIG_SECURITY_LOCKDOWN_LSM_EARLYDEFINE_EARLY_LSM(lockdown) = {#elseDEFINE_LSM(lockdown) = {#endif .id = &lockdown_lsmid, .init = lockdown_lsm_init, .initcall_core = lockdown_secfs_init,};