Patches to restrict root access to the internals of the kernel have been accepted into the Linux kernel 5.4

Linus Torvalds accepted The upcoming release of the Linux kernel 5.4 includes a set of patches fromoption to restrict root access to core internals while operating in session copy mode in RAM. New applications pSynclient and SolveSpace are included. A modified version of the NetworkManager applet has been utilized. Improvements have been made to the BootManager, SFSget, EasyContainerManager, and EasyVersionControl applications.«, Samsung and utilized in the firmware of Android smartphones from this company was accepted into the mainline kernel. This move was painfully David Howells (who works at Red Hat) and Matthew Garrett (Matthew Garrett, who works at Google) to restrict root user access to the kernel. The related "lockdown" functionality is implemented in an optionally loadable LSM module (Linux Security Module) that establishes a barrier between UID 0 and the kernel, limiting certain low-level functionality.

If an attacker manages to execute code with root privileges, they could run their code at the kernel level, for example, by replacing the kernel via kexec or reading/writing memory through /dev/kmem. The most obvious consequence of such activity could be bypassing UEFI Secure Boot or extracting sensitive data stored at the kernel level.

Initially, root restriction functions evolved in the context of enhancing verified boot security, and distributions have long used third-party patches to block UEFI Secure Boot bypass. However, such restrictions were not included in the main kernel due to disagreements over their implementation and concerns about disrupting existing systems. The "lockdown" module combines already used patches in distributions, which have been reworked into a separate subsystem not tied to UEFI Secure Boot.

In lockdown mode, access to /dev/mem, /dev/kmem, /dev/port, /proc/kcore, debugfs, kprobes debug mode, mmiotrace, tracefs, BPF, PCMCIA CIS (Card Information Structure), some ACPI interfaces, and CPU MSR registers is restricted; calls to kexec_file and kexec_load are blocked; sleep mode is prohibited; DMA usage for PCI devices is limited; importing ACPI code from EFI variables is forbidden;
manipulations with input/output ports are disallowed, including changing interrupt numbers and input/output ports for the serial port.

By default, the lockdown module is not active; it is compiled when the SECURITY_LOCKDOWN_LSM option is specified in kconfig and can be activated through the kernel parameter "lockdown=", the control file "sys/kernel/security/lockdown", or the build options LOCK_DOWN_KERNEL_FORCE_*, which can take values of “integrity” and “confidentiality.” In the first case, it blocks the capabilities that allow modifications to the running kernel from user space, and in the second case, in addition, it disables functionality that can be used to extract confidential information from the kernel.

It is important to note that lockdown only restricts the default access capabilities to the kernel, but does not protect against modifications resulting from the exploitation of vulnerabilities. To block changes to the running kernel in the case of exploits, the Openwall project is being developed a separate module LKRG (Linux Kernel Runtime Guard).

Source: opennet.ru