kevin/linux
1
Fork 0
Code

initramfs,lsm: add a security hook to do_populate_rootfs()

Browse Source 
This patch introduces a new hook to notify security system that the
content of initramfs has been unpacked into the rootfs.

Upon receiving this notification, the security system can activate
a policy to allow only files that originated from the initramfs to
execute or load into kernel during the early stages of booting.

This approach is crucial for minimizing the attack surface by
ensuring that only trusted files from the initramfs are operational
in the critical boot phase.

Signed-off-by: Fan Wu <wufan@linux.microsoft.com>
[PM: subject line tweak]
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Fan Wu 2024-08-02 23:08:19 -07:00 committed by Paul Moore
parent 52443cb60c
commit 2fea0c26b8
4 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/linux/lsm_hook_defs.h
View File

@ -449,3 +449,5 @@ LSM_HOOK(int, 0, uring_override_creds, const struct cred *new)
LSM_HOOK(int, 0, uring_sqpoll, void) LSM_HOOK(int, 0, uring_sqpoll, void)
LSM_HOOK(int, 0, uring_cmd, struct io_uring_cmd *ioucmd) LSM_HOOK(int, 0, uring_cmd, struct io_uring_cmd *ioucmd)
#endif /* CONFIG_IO_URING */ #endif /* CONFIG_IO_URING */
LSM_HOOK(void, LSM_RET_VOID, initramfs_populated, void)

8
include/linux/security.h
View File

@ -2256,4 +2256,12 @@ static inline int security_uring_cmd(struct io_uring_cmd *ioucmd)
#endif /* CONFIG_SECURITY */ #endif /* CONFIG_SECURITY */
#endif /* CONFIG_IO_URING */ #endif /* CONFIG_IO_URING */
#ifdef CONFIG_SECURITY
extern void security_initramfs_populated(void);
#else
static inline void security_initramfs_populated(void)
{
}
#endif /* CONFIG_SECURITY */
#endif /* ! __LINUX_SECURITY_H */ #endif /* ! __LINUX_SECURITY_H */

3
init/initramfs.c
View File

@ -17,6 +17,7 @@
#include <linux/namei.h> #include <linux/namei.h>
#include <linux/init_syscalls.h> #include <linux/init_syscalls.h>
#include <linux/umh.h> #include <linux/umh.h>
#include <linux/security.h>
#include "do_mounts.h" #include "do_mounts.h"
@ -712,6 +713,8 @@ static void __init do_populate_rootfs(void *unused, async_cookie_t cookie)
} }
done: done:
security_initramfs_populated();
/* /*
* If the initrd region is overlapped with crashkernel reserved region, * If the initrd region is overlapped with crashkernel reserved region,
* free only memory that is not part of crashkernel region. * free only memory that is not part of crashkernel region.

10
security/security.c
View File

@ -5778,3 +5778,13 @@ int security_uring_cmd(struct io_uring_cmd *ioucmd)
return call_int_hook(uring_cmd, ioucmd); return call_int_hook(uring_cmd, ioucmd);
} }
#endif /* CONFIG_IO_URING */ #endif /* CONFIG_IO_URING */
/**
* security_initramfs_populated() - Notify LSMs that initramfs has been loaded
*
* Tells the LSMs the initramfs has been unpacked into the rootfs.
*/
void security_initramfs_populated(void)
{
call_void_hook(initramfs_populated);
}