Commit a42aaad2 authored by Ricardo Ribalda's avatar Ricardo Ribalda Committed by Andrew Morton
Browse files

kexec: introduce sysctl parameters kexec_load_limit_* 

kexec allows replacing the current kernel with a different one.  This is
usually a source of concerns for sysadmins that want to harden a system.

Linux already provides a way to disable loading new kexec kernel via
kexec_load_disabled, but that control is very coard, it is all or nothing
and does not make distinction between a panic kexec and a normal kexec.

This patch introduces new sysctl parameters, with finer tuning to specify
how many times a kexec kernel can be loaded.  The sysadmin can set
different limits for kexec panic and kexec reboot kernels.  The value can
be modified at runtime via sysctl, but only with a stricter value.

With these new parameters on place, a system with loadpin and verity
enabled, using the following kernel parameters:
sysctl.kexec_load_limit_reboot=0 sysct.kexec_load_limit_panic=1 can have a
good warranty that if initrd tries to load a panic kernel, a malitious
user will have small chances to replace that kernel with a different one,
even if they can trigger timeouts on the disk where the panic kernel
lives.

Link: https://lkml.kernel.org/r/20221114-disable-kexec-reset-v6-3-6a8531a09b9a@chromium.org


Signed-off-by: default avatarRicardo Ribalda <ribalda@chromium.org>
Reviewed-by: default avatarSteven Rostedt (Google) <rostedt@goodmis.org>
Acked-by: default avatarBaoquan He <bhe@redhat.com>
Cc: Bagas Sanjaya <bagasdotme@gmail.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Guilherme G. Piccoli <gpiccoli@igalia.com> # Steam Deck
Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Philipp Rudo <prudo@redhat.com>
Cc: Ross Zwisler <zwisler@kernel.org>
Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent 7e99f8b6

Documentation/admin-guide/sysctl/kernel.rst

+18 −0
Original line number Diff line number Diff line
@@ -464,6 +464,24 @@ allowing a system to set up (and later use) an image without it being 
altered.

Generally used together with the `modules_disabled`_ sysctl.



kexec_load_limit_panic

======================



This parameter specifies a limit to the number of times the syscalls

``kexec_load`` and ``kexec_file_load`` can be called with a crash

image. It can only be set with a more restrictive value than the

current one.



== ======================================================

-1 Unlimited calls to kexec. This is the default setting.

N  Number of calls left.

== ======================================================



kexec_load_limit_reboot

=======================



Similar functionality as ``kexec_load_limit_panic``, but for a normal

image.



kptr_restrict

=============

include/linux/kexec.h

+1 −1
Original line number Diff line number Diff line
@@ -404,7 +404,7 @@ extern int kimage_crash_copy_vmcoreinfo(struct kimage *image); 
extern struct kimage *kexec_image;

extern struct kimage *kexec_crash_image;



bool kexec_load_permitted(void);

bool kexec_load_permitted(int kexec_image_type);



#ifndef kexec_flush_icache_page

#define kexec_flush_icache_page(page)

kernel/kexec.c

+3 −1
Original line number Diff line number Diff line
@@ -190,10 +190,12 @@ static int do_kexec_load(unsigned long entry, unsigned long nr_segments, 
static inline int kexec_load_check(unsigned long nr_segments,

				   unsigned long flags)

{

	int image_type = (flags & KEXEC_ON_CRASH) ?

			 KEXEC_TYPE_CRASH : KEXEC_TYPE_DEFAULT;

	int result;



	/* We only trust the superuser with rebooting the system. */

	if (!kexec_load_permitted())

	if (!kexec_load_permitted(image_type))

		return -EPERM;



	/* Permit LSMs and IMA to fail the kexec */

kernel/kexec_core.c

+85 −2
Original line number Diff line number Diff line
@@ -920,10 +920,64 @@ int kimage_load_segment(struct kimage *image, 
	return result;

}



struct kexec_load_limit {

	/* Mutex protects the limit count. */

	struct mutex mutex;

	int limit;

};



static struct kexec_load_limit load_limit_reboot = {

	.mutex = __MUTEX_INITIALIZER(load_limit_reboot.mutex),

	.limit = -1,

};



static struct kexec_load_limit load_limit_panic = {

	.mutex = __MUTEX_INITIALIZER(load_limit_panic.mutex),

	.limit = -1,

};



struct kimage *kexec_image;

struct kimage *kexec_crash_image;

static int kexec_load_disabled;



#ifdef CONFIG_SYSCTL

static int kexec_limit_handler(struct ctl_table *table, int write,

			       void *buffer, size_t *lenp, loff_t *ppos)

{

	struct kexec_load_limit *limit = table->data;

	int val;

	struct ctl_table tmp = {

		.data = &val,

		.maxlen = sizeof(val),

		.mode = table->mode,

	};

	int ret;



	if (write) {

		ret = proc_dointvec(&tmp, write, buffer, lenp, ppos);

		if (ret)

			return ret;



		if (val < 0)

			return -EINVAL;



		mutex_lock(&limit->mutex);

		if (limit->limit != -1 && val >= limit->limit)

			ret = -EINVAL;

		else

			limit->limit = val;

		mutex_unlock(&limit->mutex);



		return ret;

	}



	mutex_lock(&limit->mutex);

	val = limit->limit;

	mutex_unlock(&limit->mutex);



	return proc_dointvec(&tmp, write, buffer, lenp, ppos);

}



static struct ctl_table kexec_core_sysctls[] = {

	{

		.procname	= "kexec_load_disabled",
@@ -935,6 +989,18 @@ static struct ctl_table kexec_core_sysctls[] = { 
		.extra1		= SYSCTL_ONE,

		.extra2		= SYSCTL_ONE,

	},

	{

		.procname	= "kexec_load_limit_panic",

		.data		= &load_limit_panic,

		.mode		= 0644,

		.proc_handler	= kexec_limit_handler,

	},

	{

		.procname	= "kexec_load_limit_reboot",

		.data		= &load_limit_reboot,

		.mode		= 0644,

		.proc_handler	= kexec_limit_handler,

	},

	{ }

};
@@ -946,13 +1012,30 @@ static int __init kexec_core_sysctl_init(void) 
late_initcall(kexec_core_sysctl_init);

#endif



bool kexec_load_permitted(void)

bool kexec_load_permitted(int kexec_image_type)

{

	struct kexec_load_limit *limit;



	/*

	 * Only the superuser can use the kexec syscall and if it has not

	 * been disabled.

	 */

	return capable(CAP_SYS_BOOT) && !kexec_load_disabled;

	if (!capable(CAP_SYS_BOOT) || kexec_load_disabled)

		return false;



	/* Check limit counter and decrease it.*/

	limit = (kexec_image_type == KEXEC_TYPE_CRASH) ?

		&load_limit_panic : &load_limit_reboot;

	mutex_lock(&limit->mutex);

	if (!limit->limit) {

		mutex_unlock(&limit->mutex);

		return false;

	}

	if (limit->limit != -1)

		limit->limit--;

	mutex_unlock(&limit->mutex);



	return true;

}



/*

kernel/kexec_file.c

+7 −4
Original line number Diff line number Diff line
@@ -326,11 +326,13 @@ SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd, 
		unsigned long, cmdline_len, const char __user *, cmdline_ptr,

		unsigned long, flags)

{

	int ret = 0, i;

	int image_type = (flags & KEXEC_FILE_ON_CRASH) ?

			 KEXEC_TYPE_CRASH : KEXEC_TYPE_DEFAULT;

	struct kimage **dest_image, *image;

	int ret = 0, i;



	/* We only trust the superuser with rebooting the system. */

	if (!kexec_load_permitted())

	if (!kexec_load_permitted(image_type))

		return -EPERM;



	/* Make sure we have a legal set of flags */
@@ -342,11 +344,12 @@ SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd, 
	if (!kexec_trylock())

		return -EBUSY;



	dest_image = &kexec_image;

	if (flags & KEXEC_FILE_ON_CRASH) {

	if (image_type == KEXEC_TYPE_CRASH) {

		dest_image = &kexec_crash_image;

		if (kexec_crash_image)

			arch_kexec_unprotect_crashkres();

	} else {

		dest_image = &kexec_image;

	}



	if (flags & KEXEC_FILE_UNLOAD)