A Linux 5.4 kernel patches have been accepted to limit root access to the core.

Linus Torvalds accepted a set of patches for the upcoming Linux 5.4 kernel, "lockdown«, proposed David Howell (works at Red Hat) and Matthew Garrett (Matthew Garrett, works at Google) to limit user root access to the kernel. The related "lockdown" functionality is implemented in an optionally loadable LSM module (Linux Security Module), which establishes a barrier between UID 0 and the kernel, restricting certain low-level functionality.

If an attacker manages to execute code with root privileges, they can run their code at the kernel level, for example, by replacing the kernel using kexec or reading/writing memory via /dev/kmem. The most apparent consequence of such activity could be bypassing UEFI Secure Boot or extracting confidential data stored at the kernel level.

Initially, the root restriction functions were developed in the context of enhancing secure boot protection, and distributions have been using third-party patches for quite some time to block the bypass of UEFI Secure Boot. However, these restrictions were not included in the main kernel due to disagreements in their implementation and concerns about disrupting existing systems. The "lockdown" module incorporates patches already used in distributions, which have been reworked into a separate subsystem, independent of UEFI Secure Boot.

In lockdown mode, access to /dev/mem, /dev/kmem, /dev/port, /proc/kcore, debugfs, kprobes debug mode, mmiotrace, tracefs, BPF, PCMCIA CIS (Card Information Structure), some ACPI interfaces, and CPU MSR registers is restricted, kexec_file and kexec_load calls are blocked, transitioning to sleep mode is prohibited, DMA usage for PCI devices is limited, importing ACPI code from EFI variables is forbidden,
input/output port manipulation is not allowed, including changing the interrupt number and input/output port for the serial port.

By default, the lockdown module is not active; it is built by specifying the SECURITY_LOCKDOWN_LSM option in kconfig and activated via the kernel parameter "lockdown=", controlling the file "/sys/kernel/security/lockdown" or build options LOCK_DOWN_KERNEL_FORCE_*, amelyek az „integritás” és a „titkosság” értékeit vehetik fel. Az első esetben blokkolva vannak a felhasználói térből a működő magba való módosításokra vonatkozó lehetőségek, míg a második esetben ezen kívül le van tiltva az a funkcionalitás, amelyet a titkos információk kinyerésére lehet használni a magból.

Fontos megjegyezni, hogy a lockdown csupán korlátozza a maghoz való hozzáférés beépített képességeit, de nem véd a sebezhetőségek kihasználásával végrehajtott módosításoktól. A működő magba történő módosítások blokkolásához a kihasználások alkalmazásakor az Openwall projekt... Go nyelven fejlődik. külön modul LKRG (Linux Kernel Runtime Guard).

Forrás: opennet.ru