MSEAL_SYSTEM_MAPPINGS depends on !CHECKPOINT_RESTORE because CRIU moves system mappings when restoring a process. Now that sealing can be chosen at boot we should instead use this to determine defaults. Let's add MSEAL_SYSTEM_MAPPINGS_DEFAULT_ON and move the dependency there. Existing configurations retain their behaviour. Kernels built with CHECKPOINT_RESTORE can build sealing in, but will only seal mappings when explicitly requested with mseal_system_mappings=1. Hosts can also share a kernel built with MSEAL_SYSTEM_MAPPINGS=y and MSEAL_SYSTEM_MAPPINGS_DEFAULT_ON=n, enabling sealing only where needed. This lets hosts which need sealing share the kernel image with hosts which need their system mappings to remain movable, which simplifies deployment. Signed-off-by: Chris Down --- .../admin-guide/kernel-parameters.txt | 2 +- Documentation/userspace-api/mseal.rst | 4 +- mm/mseal.c | 3 +- security/Kconfig | 17 +++++++- .../selftests/mseal_system_mappings/Makefile | 2 + .../selftests/mseal_system_mappings/config | 2 + .../mseal_system_mappings/sysmap_is_sealed.c | 42 ++++++++++++++++++- 7 files changed, 66 insertions(+), 6 deletions(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index b1ec9a8a979e..628f4cccd38e 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -4275,7 +4275,7 @@ Kernel parameters whether system mappings are sealed for this boot. See Documentation/userspace-api/mseal.rst. Format: - Default: 1 (enabled). + Default set by CONFIG_MSEAL_SYSTEM_MAPPINGS_DEFAULT_ON. mtdparts= [MTD] See drivers/mtd/parsers/cmdlinepart.c diff --git a/Documentation/userspace-api/mseal.rst b/Documentation/userspace-api/mseal.rst index 4e50215e4762..c1d6dbb006dc 100644 --- a/Documentation/userspace-api/mseal.rst +++ b/Documentation/userspace-api/mseal.rst @@ -143,7 +143,9 @@ Use cases If supported by an architecture (CONFIG_ARCH_SUPPORTS_MSEAL_SYSTEM_MAPPINGS), the CONFIG_MSEAL_SYSTEM_MAPPINGS seals all system mappings of this architecture. The kernel command line parameter - ``mseal_system_mappings=0`` turns this off at boot. + ``mseal_system_mappings=0|1`` turns this off or on at boot. The default is + set by CONFIG_MSEAL_SYSTEM_MAPPINGS_DEFAULT_ON, which is off with + CONFIG_CHECKPOINT_RESTORE. WARNING: This feature breaks programs which rely on relocating or unmapping system mappings. Known broken software at the time diff --git a/mm/mseal.c b/mm/mseal.c index e0563796cfa3..8f2f2a149915 100644 --- a/mm/mseal.c +++ b/mm/mseal.c @@ -19,7 +19,8 @@ #include "internal.h" #ifdef CONFIG_MSEAL_SYSTEM_MAPPINGS -bool mseal_sysmap_enabled __ro_after_init = true; +bool mseal_sysmap_enabled __ro_after_init = + IS_ENABLED(CONFIG_MSEAL_SYSTEM_MAPPINGS_DEFAULT_ON); static int __init early_mseal_sysmap(char *buf) { diff --git a/security/Kconfig b/security/Kconfig index d5e83af1bfc6..6a6323e0897d 100644 --- a/security/Kconfig +++ b/security/Kconfig @@ -53,7 +53,6 @@ config MSEAL_SYSTEM_MAPPINGS bool "mseal system mappings" depends on 64BIT depends on ARCH_SUPPORTS_MSEAL_SYSTEM_MAPPINGS - depends on !CHECKPOINT_RESTORE help Apply mseal on system mappings. The system mappings includes vdso, vvar, vvar_vclock, @@ -67,11 +66,25 @@ config MSEAL_SYSTEM_MAPPINGS of writing includes CHECKPOINT_RESTORE, UML, gVisor, rr. Therefore this config can't be enabled universally. - Sealing can be turned off at boot with "mseal_system_mappings=0". + The "mseal_system_mappings=" kernel command line parameter can + be used to enable or disable sealing at boot. The default is set + by MSEAL_SYSTEM_MAPPINGS_DEFAULT_ON. For complete descriptions of memory sealing, please see Documentation/userspace-api/mseal.rst +config MSEAL_SYSTEM_MAPPINGS_DEFAULT_ON + bool "Seal system mappings by default" + depends on MSEAL_SYSTEM_MAPPINGS + depends on !CHECKPOINT_RESTORE + default y + help + Sets the default for the "mseal_system_mappings=" boot parameter. + + With CHECKPOINT_RESTORE=y, system mappings are only sealed when + "mseal_system_mappings=1" is given, since CRIU needs to move them + when restoring a process. + config SECURITY bool "Enable different security models" depends on SYSFS diff --git a/tools/testing/selftests/mseal_system_mappings/Makefile b/tools/testing/selftests/mseal_system_mappings/Makefile index 2b4504e2f52f..d3b88af06c94 100644 --- a/tools/testing/selftests/mseal_system_mappings/Makefile +++ b/tools/testing/selftests/mseal_system_mappings/Makefile @@ -1,6 +1,8 @@ # SPDX-License-Identifier: GPL-2.0-only CFLAGS += -std=c99 -pthread -Wall $(KHDR_INCLUDES) +LDLIBS += -lz + TEST_GEN_PROGS := sysmap_is_sealed include ../lib.mk diff --git a/tools/testing/selftests/mseal_system_mappings/config b/tools/testing/selftests/mseal_system_mappings/config index 675cb9f37b86..493bbf834a84 100644 --- a/tools/testing/selftests/mseal_system_mappings/config +++ b/tools/testing/selftests/mseal_system_mappings/config @@ -1 +1,3 @@ CONFIG_MSEAL_SYSTEM_MAPPINGS=y +CONFIG_IKCONFIG=y +CONFIG_IKCONFIG_PROC=y diff --git a/tools/testing/selftests/mseal_system_mappings/sysmap_is_sealed.c b/tools/testing/selftests/mseal_system_mappings/sysmap_is_sealed.c index 97348c2a0689..ea75ad537620 100644 --- a/tools/testing/selftests/mseal_system_mappings/sysmap_is_sealed.c +++ b/tools/testing/selftests/mseal_system_mappings/sysmap_is_sealed.c @@ -10,6 +10,8 @@ #include #include #include +#include +#include #include "kselftest.h" #include "kselftest_harness.h" @@ -52,14 +54,52 @@ static int parse_bool(const char *s, bool *res) return -EINVAL; } +static int sysmap_config_expected(int *enabled) +{ + struct utsname uts; + char line[MAX_LINE_LEN]; + bool default_on = false; + gzFile config; + int expected; + + *enabled = -1; + config = gzopen("/proc/config.gz", "rb"); + if (!config && !uname(&uts)) { + snprintf(line, sizeof(line), "/boot/config-%s", uts.release); + config = gzopen(line, "rb"); + } + if (!config) + return -1; + + while (gzgets(config, line, sizeof(line))) { + if (!strcmp(line, "CONFIG_MSEAL_SYSTEM_MAPPINGS=y\n")) + *enabled = 1; + else if (!strcmp(line, + "# CONFIG_MSEAL_SYSTEM_MAPPINGS is not set\n")) + *enabled = 0; + else if (!strcmp(line, + "CONFIG_MSEAL_SYSTEM_MAPPINGS_DEFAULT_ON=y\n")) + default_on = true; + } + if (!gzeof(config)) + *enabled = -1; + expected = *enabled < 0 ? -1 : *enabled && default_on; + gzclose(config); + return expected; +} + static int sysmap_sealed_expected(void) { char cmdline[4096], *tok, *save; - int sealed = 1; + int enabled, sealed; bool value; size_t len; FILE *f; + sealed = sysmap_config_expected(&enabled); + if (!enabled) + return 0; + f = fopen("/proc/cmdline", "r"); if (!f) return -1; -- 2.54.0