[PATCH 20/24] bpf: Restrict kernel image access functions when the kernel is locked down
jlee at suse.com
Wed Apr 12 14:57:36 UTC 2017
First, thanks for your help to send out this series.
On Wed, Apr 05, 2017 at 09:17:25PM +0100, David Howells wrote:
> From: Chun-Yi Lee <jlee at suse.com>
> There are some bpf functions can be used to read kernel memory:
> bpf_probe_read, bpf_probe_write_user and bpf_trace_printk. These allow
> private keys in kernel memory (e.g. the hibernation image signing key) to
> be read by an eBPF program. Prohibit those functions when the kernel is
> locked down.
> Signed-off-by: Chun-Yi Lee <jlee at suse.com>
> Signed-off-by: David Howells <dhowells at redhat.com>
> cc: netdev at vger.kernel.org
This patch is used with hibernation signature verification. I suggest
that we can remove this patch from your series because we just lock
down the hibernation function until hibernation verification get
On the other hand, we are trying to enhance the bpf verifier to
prevent bpf print reads specific memory addresses that have sensitive
Thanks a lot!
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
More information about the Linux-security-module-archive