diff mbox series

Kernel: Enable YAMA support

Message ID	3c36dd77-0929-7134-7627-a3bf365cb22d@ipfire.org
State	Accepted
Commit	9b28e9d02be9c0e0c488434cfd731d47bb227838
Headers	Message-ID: <3c36dd77-0929-7134-7627-a3bf365cb22d@ipfire.org> Date: Sat, 11 Jun 2022 18:53:10 +0000 MIME-Version: 1.0 Content-Language: en-US To: "IPFire: Development" <development@lists.ipfire.org> From: =?utf-8?q?Peter_M=C3=BCller?= <peter.mueller@ipfire.org> Subject: [PATCH] Kernel: Enable YAMA support Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: list Errors-To: development-bounces@lists.ipfire.org Sender: "Development" <development-bounces@lists.ipfire.org>
Series	Kernel: Enable YAMA support \| Kernel: Enable YAMA support

Commit Message

Peter Müller June 11, 2022, 6:53 p.m. UTC

  See https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html for
the upstream rationale. Enabling YAMA gives us the benefit of additional
hardening options available, without any obvious downsides.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
---
 config/kernel/kernel.config.aarch64-ipfire | 2 +-
 config/kernel/kernel.config.armv6l-ipfire  | 2 +-
 config/kernel/kernel.config.riscv64-ipfire | 2 +-
 config/kernel/kernel.config.x86_64-ipfire  | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

Comments

Michael Tremer June 13, 2022, 1:31 p.m. UTC | #1

Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>

> On 11 Jun 2022, at 19:53, Peter Müller <peter.mueller@ipfire.org> wrote:
> 
> See https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html for
> the upstream rationale. Enabling YAMA gives us the benefit of additional
> hardening options available, without any obvious downsides.
> 
> Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
> ---
> config/kernel/kernel.config.aarch64-ipfire | 2 +-
> config/kernel/kernel.config.armv6l-ipfire  | 2 +-
> config/kernel/kernel.config.riscv64-ipfire | 2 +-
> config/kernel/kernel.config.x86_64-ipfire  | 2 +-
> 4 files changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire
> index 6dfeae595..7e63b77ca 100644
> --- a/config/kernel/kernel.config.aarch64-ipfire
> +++ b/config/kernel/kernel.config.aarch64-ipfire
> @@ -7555,7 +7555,7 @@ CONFIG_FORTIFY_SOURCE=y
> # CONFIG_SECURITY_TOMOYO is not set
> # CONFIG_SECURITY_APPARMOR is not set
> # CONFIG_SECURITY_LOADPIN is not set
> -# CONFIG_SECURITY_YAMA is not set
> +CONFIG_SECURITY_YAMA=y
> # CONFIG_SECURITY_SAFESETID is not set
> CONFIG_SECURITY_LOCKDOWN_LSM=y
> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
> diff --git a/config/kernel/kernel.config.armv6l-ipfire b/config/kernel/kernel.config.armv6l-ipfire
> index 1bb745a87..1b6440b11 100644
> --- a/config/kernel/kernel.config.armv6l-ipfire
> +++ b/config/kernel/kernel.config.armv6l-ipfire
> @@ -7561,7 +7561,7 @@ CONFIG_HARDENED_USERCOPY_PAGESPAN=y
> # CONFIG_SECURITY_TOMOYO is not set
> # CONFIG_SECURITY_APPARMOR is not set
> # CONFIG_SECURITY_LOADPIN is not set
> -# CONFIG_SECURITY_YAMA is not set
> +CONFIG_SECURITY_YAMA=y
> # CONFIG_SECURITY_SAFESETID is not set
> CONFIG_SECURITY_LOCKDOWN_LSM=y
> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
> diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire
> index 2d1fdbd28..2d6bb3a2c 100644
> --- a/config/kernel/kernel.config.riscv64-ipfire
> +++ b/config/kernel/kernel.config.riscv64-ipfire
> @@ -6193,7 +6193,7 @@ CONFIG_FORTIFY_SOURCE=y
> # CONFIG_SECURITY_TOMOYO is not set
> # CONFIG_SECURITY_APPARMOR is not set
> # CONFIG_SECURITY_LOADPIN is not set
> -# CONFIG_SECURITY_YAMA is not set
> +CONFIG_SECURITY_YAMA=y
> # CONFIG_SECURITY_SAFESETID is not set
> CONFIG_SECURITY_LOCKDOWN_LSM=y
> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
> diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire
> index b84698235..0efe14c41 100644
> --- a/config/kernel/kernel.config.x86_64-ipfire
> +++ b/config/kernel/kernel.config.x86_64-ipfire
> @@ -6971,7 +6971,7 @@ CONFIG_FORTIFY_SOURCE=y
> # CONFIG_SECURITY_TOMOYO is not set
> # CONFIG_SECURITY_APPARMOR is not set
> # CONFIG_SECURITY_LOADPIN is not set
> -# CONFIG_SECURITY_YAMA is not set
> +CONFIG_SECURITY_YAMA=y
> # CONFIG_SECURITY_SAFESETID is not set
> CONFIG_SECURITY_LOCKDOWN_LSM=y
> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
> -- 
> 2.35.3

Michael Tremer June 29, 2022, 6:08 p.m. UTC | #2

I believe this stops strace from working. See screenshot.

If I remember our conversation correctly, this should have worked for root. Is my assumption correct?

-Michael



> On 13 Jun 2022, at 14:31, Michael Tremer <michael.tremer@ipfire.org> wrote:
> 
> Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
> 
>> On 11 Jun 2022, at 19:53, Peter Müller <peter.mueller@ipfire.org> wrote:
>> 
>> See https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html for
>> the upstream rationale. Enabling YAMA gives us the benefit of additional
>> hardening options available, without any obvious downsides.
>> 
>> Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
>> ---
>> config/kernel/kernel.config.aarch64-ipfire | 2 +-
>> config/kernel/kernel.config.armv6l-ipfire  | 2 +-
>> config/kernel/kernel.config.riscv64-ipfire | 2 +-
>> config/kernel/kernel.config.x86_64-ipfire  | 2 +-
>> 4 files changed, 4 insertions(+), 4 deletions(-)
>> 
>> diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire
>> index 6dfeae595..7e63b77ca 100644
>> --- a/config/kernel/kernel.config.aarch64-ipfire
>> +++ b/config/kernel/kernel.config.aarch64-ipfire
>> @@ -7555,7 +7555,7 @@ CONFIG_FORTIFY_SOURCE=y
>> # CONFIG_SECURITY_TOMOYO is not set
>> # CONFIG_SECURITY_APPARMOR is not set
>> # CONFIG_SECURITY_LOADPIN is not set
>> -# CONFIG_SECURITY_YAMA is not set
>> +CONFIG_SECURITY_YAMA=y
>> # CONFIG_SECURITY_SAFESETID is not set
>> CONFIG_SECURITY_LOCKDOWN_LSM=y
>> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
>> diff --git a/config/kernel/kernel.config.armv6l-ipfire b/config/kernel/kernel.config.armv6l-ipfire
>> index 1bb745a87..1b6440b11 100644
>> --- a/config/kernel/kernel.config.armv6l-ipfire
>> +++ b/config/kernel/kernel.config.armv6l-ipfire
>> @@ -7561,7 +7561,7 @@ CONFIG_HARDENED_USERCOPY_PAGESPAN=y
>> # CONFIG_SECURITY_TOMOYO is not set
>> # CONFIG_SECURITY_APPARMOR is not set
>> # CONFIG_SECURITY_LOADPIN is not set
>> -# CONFIG_SECURITY_YAMA is not set
>> +CONFIG_SECURITY_YAMA=y
>> # CONFIG_SECURITY_SAFESETID is not set
>> CONFIG_SECURITY_LOCKDOWN_LSM=y
>> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
>> diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire
>> index 2d1fdbd28..2d6bb3a2c 100644
>> --- a/config/kernel/kernel.config.riscv64-ipfire
>> +++ b/config/kernel/kernel.config.riscv64-ipfire
>> @@ -6193,7 +6193,7 @@ CONFIG_FORTIFY_SOURCE=y
>> # CONFIG_SECURITY_TOMOYO is not set
>> # CONFIG_SECURITY_APPARMOR is not set
>> # CONFIG_SECURITY_LOADPIN is not set
>> -# CONFIG_SECURITY_YAMA is not set
>> +CONFIG_SECURITY_YAMA=y
>> # CONFIG_SECURITY_SAFESETID is not set
>> CONFIG_SECURITY_LOCKDOWN_LSM=y
>> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
>> diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire
>> index b84698235..0efe14c41 100644
>> --- a/config/kernel/kernel.config.x86_64-ipfire
>> +++ b/config/kernel/kernel.config.x86_64-ipfire
>> @@ -6971,7 +6971,7 @@ CONFIG_FORTIFY_SOURCE=y
>> # CONFIG_SECURITY_TOMOYO is not set
>> # CONFIG_SECURITY_APPARMOR is not set
>> # CONFIG_SECURITY_LOADPIN is not set
>> -# CONFIG_SECURITY_YAMA is not set
>> +CONFIG_SECURITY_YAMA=y
>> # CONFIG_SECURITY_SAFESETID is not set
>> CONFIG_SECURITY_LOCKDOWN_LSM=y
>> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
>> -- 
>> 2.35.3
>

Peter Müller June 29, 2022, 8:09 p.m. UTC | #3

Hello Michael,

thank you for reporting this.

Commit 5086ed681da4784474f0f71aaa70ec1d4940897c resolves the issue. As the sysctl value
cannot be decreased once it has been set to "3" (one of the few times where Linux seems
to actually show a mature approach to security by default), a reboot is required to apply
the change.

Thanks, and best regards,
Peter Müller


> I believe this stops strace from working. See screenshot.
> 
> If I remember our conversation correctly, this should have worked for root. Is my assumption correct?
> 
> -Michael
> 
> 
> 
>> On 13 Jun 2022, at 14:31, Michael Tremer <michael.tremer@ipfire.org> wrote:
>>
>> Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
>>
>>> On 11 Jun 2022, at 19:53, Peter Müller <peter.mueller@ipfire.org> wrote:
>>>
>>> See https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html for
>>> the upstream rationale. Enabling YAMA gives us the benefit of additional
>>> hardening options available, without any obvious downsides.
>>>
>>> Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
>>> ---
>>> config/kernel/kernel.config.aarch64-ipfire | 2 +-
>>> config/kernel/kernel.config.armv6l-ipfire  | 2 +-
>>> config/kernel/kernel.config.riscv64-ipfire | 2 +-
>>> config/kernel/kernel.config.x86_64-ipfire  | 2 +-
>>> 4 files changed, 4 insertions(+), 4 deletions(-)
>>>
>>> diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire
>>> index 6dfeae595..7e63b77ca 100644
>>> --- a/config/kernel/kernel.config.aarch64-ipfire
>>> +++ b/config/kernel/kernel.config.aarch64-ipfire
>>> @@ -7555,7 +7555,7 @@ CONFIG_FORTIFY_SOURCE=y
>>> # CONFIG_SECURITY_TOMOYO is not set
>>> # CONFIG_SECURITY_APPARMOR is not set
>>> # CONFIG_SECURITY_LOADPIN is not set
>>> -# CONFIG_SECURITY_YAMA is not set
>>> +CONFIG_SECURITY_YAMA=y
>>> # CONFIG_SECURITY_SAFESETID is not set
>>> CONFIG_SECURITY_LOCKDOWN_LSM=y
>>> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
>>> diff --git a/config/kernel/kernel.config.armv6l-ipfire b/config/kernel/kernel.config.armv6l-ipfire
>>> index 1bb745a87..1b6440b11 100644
>>> --- a/config/kernel/kernel.config.armv6l-ipfire
>>> +++ b/config/kernel/kernel.config.armv6l-ipfire
>>> @@ -7561,7 +7561,7 @@ CONFIG_HARDENED_USERCOPY_PAGESPAN=y
>>> # CONFIG_SECURITY_TOMOYO is not set
>>> # CONFIG_SECURITY_APPARMOR is not set
>>> # CONFIG_SECURITY_LOADPIN is not set
>>> -# CONFIG_SECURITY_YAMA is not set
>>> +CONFIG_SECURITY_YAMA=y
>>> # CONFIG_SECURITY_SAFESETID is not set
>>> CONFIG_SECURITY_LOCKDOWN_LSM=y
>>> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
>>> diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire
>>> index 2d1fdbd28..2d6bb3a2c 100644
>>> --- a/config/kernel/kernel.config.riscv64-ipfire
>>> +++ b/config/kernel/kernel.config.riscv64-ipfire
>>> @@ -6193,7 +6193,7 @@ CONFIG_FORTIFY_SOURCE=y
>>> # CONFIG_SECURITY_TOMOYO is not set
>>> # CONFIG_SECURITY_APPARMOR is not set
>>> # CONFIG_SECURITY_LOADPIN is not set
>>> -# CONFIG_SECURITY_YAMA is not set
>>> +CONFIG_SECURITY_YAMA=y
>>> # CONFIG_SECURITY_SAFESETID is not set
>>> CONFIG_SECURITY_LOCKDOWN_LSM=y
>>> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
>>> diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire
>>> index b84698235..0efe14c41 100644
>>> --- a/config/kernel/kernel.config.x86_64-ipfire
>>> +++ b/config/kernel/kernel.config.x86_64-ipfire
>>> @@ -6971,7 +6971,7 @@ CONFIG_FORTIFY_SOURCE=y
>>> # CONFIG_SECURITY_TOMOYO is not set
>>> # CONFIG_SECURITY_APPARMOR is not set
>>> # CONFIG_SECURITY_LOADPIN is not set
>>> -# CONFIG_SECURITY_YAMA is not set
>>> +CONFIG_SECURITY_YAMA=y
>>> # CONFIG_SECURITY_SAFESETID is not set
>>> CONFIG_SECURITY_LOCKDOWN_LSM=y
>>> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
>>> -- 
>>> 2.35.3
>>
> 
>

Michael Tremer June 30, 2022, 10:17 a.m. UTC | #4

Yes, I did figure that one out.

However, I disagree with making debugging that difficult. Anything that is running in production cannot be easily rebooted to just change a sysctl setting.

Is there any harm in setting it to 2? I understand it that only root is allowed to perform ptrace().

If an attacker has already gained root privileges I do not consider this a large benefit to further exploit the system.

-Michael

> On 29 Jun 2022, at 21:09, Peter Müller <peter.mueller@ipfire.org> wrote:
> 
> Hello Michael,
> 
> thank you for reporting this.
> 
> Commit 5086ed681da4784474f0f71aaa70ec1d4940897c resolves the issue. As the sysctl value
> cannot be decreased once it has been set to "3" (one of the few times where Linux seems
> to actually show a mature approach to security by default), a reboot is required to apply
> the change.
> 
> Thanks, and best regards,
> Peter Müller
> 
> 
>> I believe this stops strace from working. See screenshot.
>> 
>> If I remember our conversation correctly, this should have worked for root. Is my assumption correct?
>> 
>> -Michael
>> 
>> 
>> 
>>> On 13 Jun 2022, at 14:31, Michael Tremer <michael.tremer@ipfire.org> wrote:
>>> 
>>> Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
>>> 
>>>> On 11 Jun 2022, at 19:53, Peter Müller <peter.mueller@ipfire.org> wrote:
>>>> 
>>>> See https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html for
>>>> the upstream rationale. Enabling YAMA gives us the benefit of additional
>>>> hardening options available, without any obvious downsides.
>>>> 
>>>> Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
>>>> ---
>>>> config/kernel/kernel.config.aarch64-ipfire | 2 +-
>>>> config/kernel/kernel.config.armv6l-ipfire  | 2 +-
>>>> config/kernel/kernel.config.riscv64-ipfire | 2 +-
>>>> config/kernel/kernel.config.x86_64-ipfire  | 2 +-
>>>> 4 files changed, 4 insertions(+), 4 deletions(-)
>>>> 
>>>> diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire
>>>> index 6dfeae595..7e63b77ca 100644
>>>> --- a/config/kernel/kernel.config.aarch64-ipfire
>>>> +++ b/config/kernel/kernel.config.aarch64-ipfire
>>>> @@ -7555,7 +7555,7 @@ CONFIG_FORTIFY_SOURCE=y
>>>> # CONFIG_SECURITY_TOMOYO is not set
>>>> # CONFIG_SECURITY_APPARMOR is not set
>>>> # CONFIG_SECURITY_LOADPIN is not set
>>>> -# CONFIG_SECURITY_YAMA is not set
>>>> +CONFIG_SECURITY_YAMA=y
>>>> # CONFIG_SECURITY_SAFESETID is not set
>>>> CONFIG_SECURITY_LOCKDOWN_LSM=y
>>>> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
>>>> diff --git a/config/kernel/kernel.config.armv6l-ipfire b/config/kernel/kernel.config.armv6l-ipfire
>>>> index 1bb745a87..1b6440b11 100644
>>>> --- a/config/kernel/kernel.config.armv6l-ipfire
>>>> +++ b/config/kernel/kernel.config.armv6l-ipfire
>>>> @@ -7561,7 +7561,7 @@ CONFIG_HARDENED_USERCOPY_PAGESPAN=y
>>>> # CONFIG_SECURITY_TOMOYO is not set
>>>> # CONFIG_SECURITY_APPARMOR is not set
>>>> # CONFIG_SECURITY_LOADPIN is not set
>>>> -# CONFIG_SECURITY_YAMA is not set
>>>> +CONFIG_SECURITY_YAMA=y
>>>> # CONFIG_SECURITY_SAFESETID is not set
>>>> CONFIG_SECURITY_LOCKDOWN_LSM=y
>>>> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
>>>> diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire
>>>> index 2d1fdbd28..2d6bb3a2c 100644
>>>> --- a/config/kernel/kernel.config.riscv64-ipfire
>>>> +++ b/config/kernel/kernel.config.riscv64-ipfire
>>>> @@ -6193,7 +6193,7 @@ CONFIG_FORTIFY_SOURCE=y
>>>> # CONFIG_SECURITY_TOMOYO is not set
>>>> # CONFIG_SECURITY_APPARMOR is not set
>>>> # CONFIG_SECURITY_LOADPIN is not set
>>>> -# CONFIG_SECURITY_YAMA is not set
>>>> +CONFIG_SECURITY_YAMA=y
>>>> # CONFIG_SECURITY_SAFESETID is not set
>>>> CONFIG_SECURITY_LOCKDOWN_LSM=y
>>>> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
>>>> diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire
>>>> index b84698235..0efe14c41 100644
>>>> --- a/config/kernel/kernel.config.x86_64-ipfire
>>>> +++ b/config/kernel/kernel.config.x86_64-ipfire
>>>> @@ -6971,7 +6971,7 @@ CONFIG_FORTIFY_SOURCE=y
>>>> # CONFIG_SECURITY_TOMOYO is not set
>>>> # CONFIG_SECURITY_APPARMOR is not set
>>>> # CONFIG_SECURITY_LOADPIN is not set
>>>> -# CONFIG_SECURITY_YAMA is not set
>>>> +CONFIG_SECURITY_YAMA=y
>>>> # CONFIG_SECURITY_SAFESETID is not set
>>>> CONFIG_SECURITY_LOCKDOWN_LSM=y
>>>> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
>>>> -- 
>>>> 2.35.3
>>> 
>> 
>>

Peter Müller July 1, 2022, 8:55 a.m. UTC | #5

Hello Michael,

thanks for you reply.

> Yes, I did figure that one out.
> 
> However, I disagree with making debugging that difficult. Anything that is running in production cannot be easily rebooted to just change a sysctl setting.

In this case, this came from the kernel itself - and in my opinion, it makes sense to make this
irreversible if ptrace() has been already completely forbidden. I wish more sysctl's would adapt
such a "fuse" behaviour...

> Is there any harm in setting it to 2? I understand it that only root is allowed to perform ptrace().

No, I don't think so, it just fell through the cracks on my end when I was implementing this.

> If an attacker has already gained root privileges I do not consider this a large benefit to further exploit the system.

ACK.

Thanks, and best regards,
Peter Müller

> 
> -Michael
> 
>> On 29 Jun 2022, at 21:09, Peter Müller <peter.mueller@ipfire.org> wrote:
>>
>> Hello Michael,
>>
>> thank you for reporting this.
>>
>> Commit 5086ed681da4784474f0f71aaa70ec1d4940897c resolves the issue. As the sysctl value
>> cannot be decreased once it has been set to "3" (one of the few times where Linux seems
>> to actually show a mature approach to security by default), a reboot is required to apply
>> the change.
>>
>> Thanks, and best regards,
>> Peter Müller
>>
>>
>>> I believe this stops strace from working. See screenshot.
>>>
>>> If I remember our conversation correctly, this should have worked for root. Is my assumption correct?
>>>
>>> -Michael
>>>
>>>
>>>
>>>> On 13 Jun 2022, at 14:31, Michael Tremer <michael.tremer@ipfire.org> wrote:
>>>>
>>>> Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
>>>>
>>>>> On 11 Jun 2022, at 19:53, Peter Müller <peter.mueller@ipfire.org> wrote:
>>>>>
>>>>> See https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html for
>>>>> the upstream rationale. Enabling YAMA gives us the benefit of additional
>>>>> hardening options available, without any obvious downsides.
>>>>>
>>>>> Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
>>>>> ---
>>>>> config/kernel/kernel.config.aarch64-ipfire | 2 +-
>>>>> config/kernel/kernel.config.armv6l-ipfire  | 2 +-
>>>>> config/kernel/kernel.config.riscv64-ipfire | 2 +-
>>>>> config/kernel/kernel.config.x86_64-ipfire  | 2 +-
>>>>> 4 files changed, 4 insertions(+), 4 deletions(-)
>>>>>
>>>>> diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire
>>>>> index 6dfeae595..7e63b77ca 100644
>>>>> --- a/config/kernel/kernel.config.aarch64-ipfire
>>>>> +++ b/config/kernel/kernel.config.aarch64-ipfire
>>>>> @@ -7555,7 +7555,7 @@ CONFIG_FORTIFY_SOURCE=y
>>>>> # CONFIG_SECURITY_TOMOYO is not set
>>>>> # CONFIG_SECURITY_APPARMOR is not set
>>>>> # CONFIG_SECURITY_LOADPIN is not set
>>>>> -# CONFIG_SECURITY_YAMA is not set
>>>>> +CONFIG_SECURITY_YAMA=y
>>>>> # CONFIG_SECURITY_SAFESETID is not set
>>>>> CONFIG_SECURITY_LOCKDOWN_LSM=y
>>>>> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
>>>>> diff --git a/config/kernel/kernel.config.armv6l-ipfire b/config/kernel/kernel.config.armv6l-ipfire
>>>>> index 1bb745a87..1b6440b11 100644
>>>>> --- a/config/kernel/kernel.config.armv6l-ipfire
>>>>> +++ b/config/kernel/kernel.config.armv6l-ipfire
>>>>> @@ -7561,7 +7561,7 @@ CONFIG_HARDENED_USERCOPY_PAGESPAN=y
>>>>> # CONFIG_SECURITY_TOMOYO is not set
>>>>> # CONFIG_SECURITY_APPARMOR is not set
>>>>> # CONFIG_SECURITY_LOADPIN is not set
>>>>> -# CONFIG_SECURITY_YAMA is not set
>>>>> +CONFIG_SECURITY_YAMA=y
>>>>> # CONFIG_SECURITY_SAFESETID is not set
>>>>> CONFIG_SECURITY_LOCKDOWN_LSM=y
>>>>> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
>>>>> diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire
>>>>> index 2d1fdbd28..2d6bb3a2c 100644
>>>>> --- a/config/kernel/kernel.config.riscv64-ipfire
>>>>> +++ b/config/kernel/kernel.config.riscv64-ipfire
>>>>> @@ -6193,7 +6193,7 @@ CONFIG_FORTIFY_SOURCE=y
>>>>> # CONFIG_SECURITY_TOMOYO is not set
>>>>> # CONFIG_SECURITY_APPARMOR is not set
>>>>> # CONFIG_SECURITY_LOADPIN is not set
>>>>> -# CONFIG_SECURITY_YAMA is not set
>>>>> +CONFIG_SECURITY_YAMA=y
>>>>> # CONFIG_SECURITY_SAFESETID is not set
>>>>> CONFIG_SECURITY_LOCKDOWN_LSM=y
>>>>> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
>>>>> diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire
>>>>> index b84698235..0efe14c41 100644
>>>>> --- a/config/kernel/kernel.config.x86_64-ipfire
>>>>> +++ b/config/kernel/kernel.config.x86_64-ipfire
>>>>> @@ -6971,7 +6971,7 @@ CONFIG_FORTIFY_SOURCE=y
>>>>> # CONFIG_SECURITY_TOMOYO is not set
>>>>> # CONFIG_SECURITY_APPARMOR is not set
>>>>> # CONFIG_SECURITY_LOADPIN is not set
>>>>> -# CONFIG_SECURITY_YAMA is not set
>>>>> +CONFIG_SECURITY_YAMA=y
>>>>> # CONFIG_SECURITY_SAFESETID is not set
>>>>> CONFIG_SECURITY_LOCKDOWN_LSM=y
>>>>> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
>>>>> -- 
>>>>> 2.35.3
>>>>
>>>
>>>
>

Michael Tremer July 1, 2022, 10:42 a.m. UTC | #6

Hello,

> On 1 Jul 2022, at 09:55, Peter Müller <peter.mueller@ipfire.org> wrote:
> 
> Hello Michael,
> 
> thanks for you reply.
> 
>> Yes, I did figure that one out.
>> However, I disagree with making debugging that difficult. Anything that is running in production cannot be easily rebooted to just change a sysctl setting.
> 
> In this case, this came from the kernel itself - and in my opinion, it makes sense to make this
> irreversible if ptrace() has been already completely forbidden. I wish more sysctl's would adapt
> such a "fuse" behaviour...

I would kind of prefer to configure this at compile time.

>> Is there any harm in setting it to 2? I understand it that only root is allowed to perform ptrace().
> 
> No, I don't think so, it just fell through the cracks on my end when I was implementing this.

Thank you.

>> If an attacker has already gained root privileges I do not consider this a large benefit to further exploit the system.
> 
> ACK.
> 
> Thanks, and best regards,
> Peter Müller
> 
>> -Michael
>>> On 29 Jun 2022, at 21:09, Peter Müller <peter.mueller@ipfire.org> wrote:
>>> 
>>> Hello Michael,
>>> 
>>> thank you for reporting this.
>>> 
>>> Commit 5086ed681da4784474f0f71aaa70ec1d4940897c resolves the issue. As the sysctl value
>>> cannot be decreased once it has been set to "3" (one of the few times where Linux seems
>>> to actually show a mature approach to security by default), a reboot is required to apply
>>> the change.
>>> 
>>> Thanks, and best regards,
>>> Peter Müller
>>> 
>>> 
>>>> I believe this stops strace from working. See screenshot.
>>>> 
>>>> If I remember our conversation correctly, this should have worked for root. Is my assumption correct?
>>>> 
>>>> -Michael
>>>> 
>>>> 
>>>> 
>>>>> On 13 Jun 2022, at 14:31, Michael Tremer <michael.tremer@ipfire.org> wrote:
>>>>> 
>>>>> Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
>>>>> 
>>>>>> On 11 Jun 2022, at 19:53, Peter Müller <peter.mueller@ipfire.org> wrote:
>>>>>> 
>>>>>> See https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html for
>>>>>> the upstream rationale. Enabling YAMA gives us the benefit of additional
>>>>>> hardening options available, without any obvious downsides.
>>>>>> 
>>>>>> Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
>>>>>> ---
>>>>>> config/kernel/kernel.config.aarch64-ipfire | 2 +-
>>>>>> config/kernel/kernel.config.armv6l-ipfire  | 2 +-
>>>>>> config/kernel/kernel.config.riscv64-ipfire | 2 +-
>>>>>> config/kernel/kernel.config.x86_64-ipfire  | 2 +-
>>>>>> 4 files changed, 4 insertions(+), 4 deletions(-)
>>>>>> 
>>>>>> diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire
>>>>>> index 6dfeae595..7e63b77ca 100644
>>>>>> --- a/config/kernel/kernel.config.aarch64-ipfire
>>>>>> +++ b/config/kernel/kernel.config.aarch64-ipfire
>>>>>> @@ -7555,7 +7555,7 @@ CONFIG_FORTIFY_SOURCE=y
>>>>>> # CONFIG_SECURITY_TOMOYO is not set
>>>>>> # CONFIG_SECURITY_APPARMOR is not set
>>>>>> # CONFIG_SECURITY_LOADPIN is not set
>>>>>> -# CONFIG_SECURITY_YAMA is not set
>>>>>> +CONFIG_SECURITY_YAMA=y
>>>>>> # CONFIG_SECURITY_SAFESETID is not set
>>>>>> CONFIG_SECURITY_LOCKDOWN_LSM=y
>>>>>> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
>>>>>> diff --git a/config/kernel/kernel.config.armv6l-ipfire b/config/kernel/kernel.config.armv6l-ipfire
>>>>>> index 1bb745a87..1b6440b11 100644
>>>>>> --- a/config/kernel/kernel.config.armv6l-ipfire
>>>>>> +++ b/config/kernel/kernel.config.armv6l-ipfire
>>>>>> @@ -7561,7 +7561,7 @@ CONFIG_HARDENED_USERCOPY_PAGESPAN=y
>>>>>> # CONFIG_SECURITY_TOMOYO is not set
>>>>>> # CONFIG_SECURITY_APPARMOR is not set
>>>>>> # CONFIG_SECURITY_LOADPIN is not set
>>>>>> -# CONFIG_SECURITY_YAMA is not set
>>>>>> +CONFIG_SECURITY_YAMA=y
>>>>>> # CONFIG_SECURITY_SAFESETID is not set
>>>>>> CONFIG_SECURITY_LOCKDOWN_LSM=y
>>>>>> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
>>>>>> diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire
>>>>>> index 2d1fdbd28..2d6bb3a2c 100644
>>>>>> --- a/config/kernel/kernel.config.riscv64-ipfire
>>>>>> +++ b/config/kernel/kernel.config.riscv64-ipfire
>>>>>> @@ -6193,7 +6193,7 @@ CONFIG_FORTIFY_SOURCE=y
>>>>>> # CONFIG_SECURITY_TOMOYO is not set
>>>>>> # CONFIG_SECURITY_APPARMOR is not set
>>>>>> # CONFIG_SECURITY_LOADPIN is not set
>>>>>> -# CONFIG_SECURITY_YAMA is not set
>>>>>> +CONFIG_SECURITY_YAMA=y
>>>>>> # CONFIG_SECURITY_SAFESETID is not set
>>>>>> CONFIG_SECURITY_LOCKDOWN_LSM=y
>>>>>> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
>>>>>> diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire
>>>>>> index b84698235..0efe14c41 100644
>>>>>> --- a/config/kernel/kernel.config.x86_64-ipfire
>>>>>> +++ b/config/kernel/kernel.config.x86_64-ipfire
>>>>>> @@ -6971,7 +6971,7 @@ CONFIG_FORTIFY_SOURCE=y
>>>>>> # CONFIG_SECURITY_TOMOYO is not set
>>>>>> # CONFIG_SECURITY_APPARMOR is not set
>>>>>> # CONFIG_SECURITY_LOADPIN is not set
>>>>>> -# CONFIG_SECURITY_YAMA is not set
>>>>>> +CONFIG_SECURITY_YAMA=y
>>>>>> # CONFIG_SECURITY_SAFESETID is not set
>>>>>> CONFIG_SECURITY_LOCKDOWN_LSM=y
>>>>>> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
>>>>>> -- 
>>>>>> 2.35.3
>>>>> 
>>>> 
>>>>

diff mbox series

Patch

diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire
index 6dfeae595..7e63b77ca 100644
--- a/config/kernel/kernel.config.aarch64-ipfire
+++ b/config/kernel/kernel.config.aarch64-ipfire
@@ -7555,7 +7555,7 @@  CONFIG_FORTIFY_SOURCE=y
 # CONFIG_SECURITY_TOMOYO is not set
 # CONFIG_SECURITY_APPARMOR is not set
 # CONFIG_SECURITY_LOADPIN is not set
-# CONFIG_SECURITY_YAMA is not set
+CONFIG_SECURITY_YAMA=y
 # CONFIG_SECURITY_SAFESETID is not set
 CONFIG_SECURITY_LOCKDOWN_LSM=y
 CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
diff --git a/config/kernel/kernel.config.armv6l-ipfire b/config/kernel/kernel.config.armv6l-ipfire
index 1bb745a87..1b6440b11 100644
--- a/config/kernel/kernel.config.armv6l-ipfire
+++ b/config/kernel/kernel.config.armv6l-ipfire
@@ -7561,7 +7561,7 @@  CONFIG_HARDENED_USERCOPY_PAGESPAN=y
 # CONFIG_SECURITY_TOMOYO is not set
 # CONFIG_SECURITY_APPARMOR is not set
 # CONFIG_SECURITY_LOADPIN is not set
-# CONFIG_SECURITY_YAMA is not set
+CONFIG_SECURITY_YAMA=y
 # CONFIG_SECURITY_SAFESETID is not set
 CONFIG_SECURITY_LOCKDOWN_LSM=y
 CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire
index 2d1fdbd28..2d6bb3a2c 100644
--- a/config/kernel/kernel.config.riscv64-ipfire
+++ b/config/kernel/kernel.config.riscv64-ipfire
@@ -6193,7 +6193,7 @@  CONFIG_FORTIFY_SOURCE=y
 # CONFIG_SECURITY_TOMOYO is not set
 # CONFIG_SECURITY_APPARMOR is not set
 # CONFIG_SECURITY_LOADPIN is not set
-# CONFIG_SECURITY_YAMA is not set
+CONFIG_SECURITY_YAMA=y
 # CONFIG_SECURITY_SAFESETID is not set
 CONFIG_SECURITY_LOCKDOWN_LSM=y
 CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire
index b84698235..0efe14c41 100644
--- a/config/kernel/kernel.config.x86_64-ipfire
+++ b/config/kernel/kernel.config.x86_64-ipfire
@@ -6971,7 +6971,7 @@  CONFIG_FORTIFY_SOURCE=y
 # CONFIG_SECURITY_TOMOYO is not set
 # CONFIG_SECURITY_APPARMOR is not set
 # CONFIG_SECURITY_LOADPIN is not set
-# CONFIG_SECURITY_YAMA is not set
+CONFIG_SECURITY_YAMA=y
 # CONFIG_SECURITY_SAFESETID is not set
 CONFIG_SECURITY_LOCKDOWN_LSM=y
 CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y