18c8249
From d4ae417828427de74e9f857f9caa49580aecf1fe Mon Sep 17 00:00:00 2001
6a91557
From: Matthew Garrett <matthew.garrett@nebula.com>
6a91557
Date: Fri, 9 Mar 2012 09:28:15 -0500
18c8249
Subject: [PATCH 06/20] Restrict /dev/mem and /dev/kmem when module loading is
6a91557
 restricted
6a91557
6a91557
Allowing users to write to address space makes it possible for the kernel
6a91557
to be subverted, avoiding module loading restrictions. Prevent this when
6a91557
any restrictions have been imposed on loading modules.
6a91557
6a91557
Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
6a91557
---
6a91557
 drivers/char/mem.c | 6 ++++++
6a91557
 1 file changed, 6 insertions(+)
6a91557
6a91557
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
84326ca
index 53fe675f9bd7..b52c88860532 100644
6a91557
--- a/drivers/char/mem.c
6a91557
+++ b/drivers/char/mem.c
208228c
@@ -167,6 +167,9 @@ static ssize_t write_mem(struct file *file, const char __user *buf,
6a91557
 	if (p != *ppos)
6a91557
 		return -EFBIG;
6a91557
 
6a91557
+	if (secure_modules())
6a91557
+		return -EPERM;
6a91557
+
6a91557
 	if (!valid_phys_addr_range(p, count))
6a91557
 		return -EFAULT;
6a91557
 
f1193f2
@@ -513,6 +516,9 @@ static ssize_t write_kmem(struct file *file, const char __user *buf,
6a91557
 	char *kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */
6a91557
 	int err = 0;
6a91557
 
6a91557
+	if (secure_modules())
6a91557
+		return -EPERM;
6a91557
+
6a91557
 	if (p < (unsigned long) high_memory) {
6a91557
 		unsigned long to_write = min_t(unsigned long, count,
6a91557
 					       (unsigned long)high_memory - p);
18c8249
-- 
18c8249
2.4.3
18c8249