On Tue, Apr 09, 2024 at 08:57:50PM +0300, Adrian Ratiu wrote: > Some systems might have difficulty changing their bootloaders > to enable the newly added restrict_proc_mem* params, for e.g. > remote embedded doing OTA updates, so this provides a set of > Kconfigs to set /proc/pid/mem restrictions at build-time. > > The boot params take precedence over the Kconfig values. This > can be reversed, but doing it this way I think makes sense. > > Another idea is to have a global bool Kconfig which can enable > or disable this mechanism in its entirety, however it does not > seem necessary since all three knobs default to off, the branch > logic overhead is rather minimal and I assume most of systems > will want to restrict at least the use of FOLL_FORCE. > > Cc: Guenter Roeck <groeck@xxxxxxxxxxxx> > Cc: Doug Anderson <dianders@xxxxxxxxxxxx> > Cc: Kees Cook <keescook@xxxxxxxxxxxx> > Cc: Jann Horn <jannh@xxxxxxxxxx> > Cc: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> > Cc: Randy Dunlap <rdunlap@xxxxxxxxxxxxx> > Cc: Christian Brauner <brauner@xxxxxxxxxx> > Signed-off-by: Adrian Ratiu <adrian.ratiu@xxxxxxxxxxxxx> > --- > fs/proc/base.c | 33 +++++++++++++++++++++++++++++++++ > security/Kconfig | 42 ++++++++++++++++++++++++++++++++++++++++++ > 2 files changed, 75 insertions(+) > > diff --git a/fs/proc/base.c b/fs/proc/base.c > index c733836c42a65..e8ee848fc4a98 100644 > --- a/fs/proc/base.c > +++ b/fs/proc/base.c > @@ -889,6 +889,17 @@ static int __mem_open_check_access_restriction(struct file *file) > !__mem_open_current_is_ptracer(file)) > return -EACCES; > > +#ifdef CONFIG_SECURITY_PROC_MEM_WRITE_RESTRICT No, please. :) Just use use the _MAYBE/_maybe variants of the static branch DECLAREs and branches, and make Kconfigs for: CONFIG_PROC_MEM_RESTRICT_READ_DEFAULT CONFIG_PROC_MEM_RESTRICT_WRITE_DEFAULT CONFIG_PROC_MEM_RESTRICT_FOLL_FORCE_DEFAULT Like: DECLARE_STATIC_KEY_MAYBE(CONFIG_PROC_MEM_RESTRICT_READ_DEFAULT, proc_mem_restrict_read); and then later: if (static_branch_maybe(CONFIG_PROC_MEM_RESTRICT_READ_DEFAULT, &proc_mem_restrict_read)) ... Then all builds of the kernel will have it available, but system builders who want it enabled by default will get a slightly more optimized "if". -Kees -- Kees Cook
