From patchwork Fri Feb 11 19:42:57 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Peter_M=C3=BCller?= X-Patchwork-Id: 5145 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4JwPDB0pBZz3wgk for ; Fri, 11 Feb 2022 19:43:06 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4JwPD74dGMz35q; Fri, 11 Feb 2022 19:43:03 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4JwPD72nSNz2ylW; Fri, 11 Feb 2022 19:43:03 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4JwPD61yCXz2yS9 for ; Fri, 11 Feb 2022 19:43:02 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4JwPD501dNz1qH for ; Fri, 11 Feb 2022 19:43:00 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1644608581; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=i19M+utXHL5J+9lRZ6sic4phZbPTUcmVN9Zxgx8eE4U=; b=RPoReAFew9auoInJs+lsOPHHih26ZeLgMA+rtwUguKPsctbjpcnF2sOyJbqNVmImJ5UsbF bkG6HXhFpc0pRMBg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1644608581; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=i19M+utXHL5J+9lRZ6sic4phZbPTUcmVN9Zxgx8eE4U=; b=f+xBEZxi60Ahm6Rv4TojFru4OJqMOH0x4AdtUBh2K79mjj1TPqYTlFY6ANcBpp9cNIjGT4 raAZJaNhAQgP2j71nRpEEXTOxrcIPHvTah5M9eDGIz0QiVDEMBMuQSnLWao8XWwiKSqXEM y1DNNAzddFZGKRAWveTtcBNgfV7Qjr5E2GBPqIB3Vdr4G8IcXidxNkh3dEHU68KbsqiQ33 VSL0ExvJ2TJrKiIeSsjbYglbX57mx2JRZCJLAhQ4+N1sL059fg1oqWCCqVVsJONlI26pkl gHuz6IVpUllUKGrU0mjrR5aLVu/0TxX74Au25bEcXHpGDmNnikcYSbOltS6Y/w== Message-ID: <66e4978d-6ba4-6c14-329c-6f7ae99ed4b2@ipfire.org> Date: Fri, 11 Feb 2022 19:42:57 +0000 MIME-Version: 1.0 Content-Language: en-US To: "IPFire: Development" From: =?utf-8?q?Peter_M=C3=BCller?= Subject: [PATCH v2] Kernel: Block non-UID-0 profiling completely X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" This is recommended by KSPP, Lynis, and others. Indeed, there is no legitimate reason why an unprivileged user on IPFire should do any profiling. Unfortunately, this change never landed in the mainline kernel, hence a distribution patch is necessary. The second version of this patch rebases the kernel patch by Jeff Vander Stoep against Linux 5.15.17 to avoid fuzzying. Tested-by: Peter Müller Signed-off-by: Peter Müller --- config/etc/sysctl.conf | 3 + lfs/linux | 3 + ...rther-restriction-of-perf_event_open.patch | 75 +++++++++++++++++++ 3 files changed, 81 insertions(+) create mode 100644 src/patches/linux/linux-5.15.17-security-perf-allow-further-restriction-of-perf_event_open.patch diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf index c8c775d13..5fc3e3d89 100644 --- a/config/etc/sysctl.conf +++ b/config/etc/sysctl.conf @@ -101,3 +101,6 @@ net.ipv4.tcp_rfc1337 = 1 # Include PID in file names of generated core dumps kernel.core_uses_pid = 1 + +# Block non-uid-0 profiling +kernel.perf_event_paranoid = 3 diff --git a/lfs/linux b/lfs/linux index a8cb9dda3..e6bd14523 100644 --- a/lfs/linux +++ b/lfs/linux @@ -131,6 +131,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) # fix Boot with enabled usercopy hardening cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-5.9-crypto_testmgr_allocate_buffers_with____GFP_COMP.patch + # Patch performance monitoring restrictions to allow further hardening + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-5.15.17-security-perf-allow-further-restriction-of-perf_event_open.patch + ifeq "$(BUILD_ARCH)" "armv6l" # Apply Arm-multiarch kernel patches. cd $(DIR_APP) && xzcat $(DIR_DL)/arm-multi-patches-$(ARM_PATCHES).patch.xz | patch -Np1 diff --git a/src/patches/linux/linux-5.15.17-security-perf-allow-further-restriction-of-perf_event_open.patch b/src/patches/linux/linux-5.15.17-security-perf-allow-further-restriction-of-perf_event_open.patch new file mode 100644 index 000000000..8a578e01c --- /dev/null +++ b/src/patches/linux/linux-5.15.17-security-perf-allow-further-restriction-of-perf_event_open.patch @@ -0,0 +1,75 @@ +From: Jeff Vander Stoep +Date: Wed, 27 Jul 2016 07:45:46 -0700 +Message-Id: <1469630746-32279-1-git-send-email-jeffv@google.com> +Subject: [kernel-hardening] [PATCH 1/2] security, + perf: allow further restriction of perf_event_open + +When kernel.perf_event_paranoid is set to 3 (or greater), disallow +all access to performance events by users without CAP_SYS_ADMIN. + +This new level of restriction is intended to reduce the attack +surface of the kernel. Perf is a valuable tool for developers but +is generally unnecessary and unused on production systems. Perf may +open up an attack vector to vulnerable device-specific drivers as +recently demonstrated in CVE-2016-0805, CVE-2016-0819, +CVE-2016-0843, CVE-2016-3768, and CVE-2016-3843. This new level of +restriction allows for a safe default to be set on production systems +while leaving a simple means for developers to grant access [1]. + +This feature is derived from CONFIG_GRKERNSEC_PERF_HARDEN by Brad +Spengler. It is based on a patch by Ben Hutchings [2]. Ben's patches +have been modified and split up to address on-list feedback. + +kernel.perf_event_paranoid=3 is the default on both Debian [2] and +Android [3]. + +[1] Making perf available to developers on Android: +https://android-review.googlesource.com/#/c/234400/ +[2] Original patch by Ben Hutchings: +https://lkml.org/lkml/2016/1/11/587 +[3] https://android-review.googlesource.com/#/c/234743/ + +Signed-off-by: Jeff Vander Stoep +Reviewed-by: Kees Cook +--- + Documentation/sysctl/kernel.txt | 1 + + include/linux/perf_event.h | 5 +++++ + kernel/events/core.c | 4 ++++ + 3 files changed, 10 insertions(+) + +diff -Naur linux-5.15.22.orig/include/linux/perf_event.h linux-5.15.22/include/linux/perf_event.h +--- linux-5.15.22.orig/include/linux/perf_event.h 2022-02-11 15:39:26.163576222 +0000 ++++ linux-5.15.22/include/linux/perf_event.h 2022-02-11 15:42:16.719697397 +0000 +@@ -1346,6 +1346,11 @@ + return security_perf_event_open(attr, PERF_SECURITY_TRACEPOINT); + } + ++static inline bool perf_paranoid_any(void) ++{ ++ return sysctl_perf_event_paranoid > 2; ++} ++ + extern void perf_event_init(void); + extern void perf_tp_event(u16 event_type, u64 count, void *record, + int entry_size, struct pt_regs *regs, +diff -Naur linux-5.15.22.orig/kernel/events/core.c linux-5.15.22/kernel/events/core.c +--- linux-5.15.22.orig/kernel/events/core.c 2022-02-11 15:39:27.667683028 +0000 ++++ linux-5.15.22/kernel/events/core.c 2022-02-11 15:42:16.723697680 +0000 +@@ -414,6 +414,7 @@ + * 0 - disallow raw tracepoint access for unpriv + * 1 - disallow cpu events for unpriv + * 2 - disallow kernel profiling for unpriv ++ * 3 - disallow all unpriv perf event use + */ + int sysctl_perf_event_paranoid __read_mostly = 2; + +@@ -12090,6 +12091,9 @@ + if (err) + return err; + ++ if (perf_paranoid_any() && !capable(CAP_SYS_ADMIN)) ++ return -EACCES; ++ + err = perf_copy_attr(attr_uptr, &attr); + if (err) + return err;