From patchwork Fri Nov 23 00:53:55 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Anton Vorontsov X-Patchwork-Id: 13103 Return-Path: X-Original-To: patchwork@peony.canonical.com Delivered-To: patchwork@peony.canonical.com Received: from fiordland.canonical.com (fiordland.canonical.com [91.189.94.145]) by peony.canonical.com (Postfix) with ESMTP id 8EB8723E08 for ; Fri, 23 Nov 2012 00:57:38 +0000 (UTC) Received: from mail-ie0-f180.google.com (mail-ie0-f180.google.com [209.85.223.180]) by fiordland.canonical.com (Postfix) with ESMTP id 46AAFA18BD8 for ; Fri, 23 Nov 2012 00:57:38 +0000 (UTC) Received: by mail-ie0-f180.google.com with SMTP id c10so1228520ieb.11 for ; Thu, 22 Nov 2012 16:57:38 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=x-forwarded-to:x-forwarded-for:delivered-to:received-spf:from:to:cc :subject:date:message-id:x-mailer:in-reply-to:references :x-gm-message-state; bh=aIokRvD6q9xOidtfIbmWXGmCre8X3Or8e68FhdLdBWI=; b=nreNIKu33qTYaiB/8MPnLbe+vk+wi2ryoT8z79hqs+x2OEY9LPdWjZx+q4aMWMgDId LumrXrJkqtLn7UnVpoU8+FCBnFQiueXyWoShsjiU3umBNJY8cmaL8BySB9/Ps+/2PVTh QXn4HMoMc5nljQO/HH7i+Rh/CqLgrB1CM5/iQFWqUU6MzfXGFgoQLi/2D2a6Xjsyhw16 qJpq2Z4tdbetsHR51tSwJi8d+gWzk8jQ8YqyefXq/m7wUpAmIxnWmyFXYm4LM84FPAF9 2Lj+xbRQG6W5Uow7LescD2yFpbG+Nvb7Ng3bJYSHlZ0gL97+5qni+YZZ206ZywhqQeM2 ZjBA== Received: by 10.50.213.69 with SMTP id nq5mr4642319igc.70.1353632258025; Thu, 22 Nov 2012 16:57:38 -0800 (PST) X-Forwarded-To: linaro-patchwork@canonical.com X-Forwarded-For: patch@linaro.org linaro-patchwork@canonical.com Delivered-To: patches@linaro.org Received: by 10.50.67.148 with SMTP id n20csp282697igt; Thu, 22 Nov 2012 16:57:37 -0800 (PST) Received: by 10.182.134.66 with SMTP id pi2mr1686302obb.42.1353632257246; Thu, 22 Nov 2012 16:57:37 -0800 (PST) Received: from mail-oa0-f48.google.com (mail-oa0-f48.google.com [209.85.219.48]) by mx.google.com with ESMTPS id kf4si4296792obc.55.2012.11.22.16.57.37 (version=TLSv1/SSLv3 cipher=OTHER); Thu, 22 Nov 2012 16:57:37 -0800 (PST) Received-SPF: neutral (google.com: 209.85.219.48 is neither permitted nor denied by best guess record for domain of anton.vorontsov@linaro.org) client-ip=209.85.219.48; Authentication-Results: mx.google.com; spf=neutral (google.com: 209.85.219.48 is neither permitted nor denied by best guess record for domain of anton.vorontsov@linaro.org) smtp.mail=anton.vorontsov@linaro.org Received: by mail-oa0-f48.google.com with SMTP id h2so11206511oag.21 for ; Thu, 22 Nov 2012 16:57:37 -0800 (PST) Received: by 10.182.18.139 with SMTP id w11mr1676147obd.8.1353632256993; Thu, 22 Nov 2012 16:57:36 -0800 (PST) Received: from localhost (ip-64-134-239-153.public.wayport.net. [64.134.239.153]) by mx.google.com with ESMTPS id m3sm4467184obm.21.2012.11.22.16.57.35 (version=TLSv1/SSLv3 cipher=OTHER); Thu, 22 Nov 2012 16:57:36 -0800 (PST) From: Anton Vorontsov To: Andrew Morton Cc: Jason Wessel , John Stultz , linux-kernel@vger.kernel.org, linaro-kernel@lists.linaro.org, patches@linaro.org, kernel-team@android.com, kgdb-bugreport@lists.sourceforge.net Subject: [PATCH 6/7] kdb: Mark safe commands as KDB_SAFE and KDB_SAFE_NO_ARGS Date: Thu, 22 Nov 2012 16:53:55 -0800 Message-Id: <1353632036-5354-6-git-send-email-anton.vorontsov@linaro.org> X-Mailer: git-send-email 1.8.0 In-Reply-To: <20121123005315.GA12690@lizard.mcd25758.sjc.wayport.net> References: <20121123005315.GA12690@lizard.mcd25758.sjc.wayport.net> X-Gm-Message-State: ALoCoQmgZkFLtbjy5b/w68EIQEJwseLr6rH6bTWDu62BugQQ2NoAcT14soroGJXZEr6FLYmZYuoS This patch introduces two new flags: KDB_SAFE, denotes a safe command, and KDB_SAFE_NO_ARGS, denotes a safe command when used without arguments. The word "safe" here used in the sense that the commands cannot be used to leak sensitive data from the memory, and cannot be used to change program flow in a predefined manner. These flags will be used by the "kiosk" mode, i.e. when it is possible for the ordinary user to enter the KDB (or user can get the access to KDB after the crash), but we do not allow user to read dump the memory [and thus read some sensitive data]. The following commands were marked as "safe": Display exception frame Stack traceback Display stack for process Display stack all processes Backtrace current process on each cpu Execute cmd for each element in linked list Show environment variables Set environment variables Display Help Message Switch to new cpu Display active task list Switch to another task Reboot the machine immediately List loaded kernel modules Magic SysRq key Display syslog buffer Define a set of commands, down to endefcmd Summarize the system Disable NMI entry to KDB The following commands were marked as safe when issued with no arguments: Continue Execution And the following commands are unsafe: Clear Breakpoint Enable Breakpoint Disable Breakpoint Single step Single step to branch/call Continue Execution (with address argument) Display Memory Contents Display Raw Memory Display Physical Memory Display Memory Symbolically Modify Memory Contents Display Registers Modify Registers Backtrace process given its struct task address Send a signal to a process Enter kgdb mode Display per_cpu variables Note that we mark "display registers" command unsafe, this is because single stepping + constantly dumping registers in string or memory functions can be used as a way to read sensitive data (it's actually trivial to exploit). Later we can do a bit better, i.e. not displaying general-purpose registers, but printing control registers. Signed-off-by: Anton Vorontsov --- include/linux/kdb.h | 2 ++ kernel/debug/kdb/kdb_main.c | 44 ++++++++++++++++++++++---------------------- kernel/trace/trace_kdb.c | 2 +- 3 files changed, 25 insertions(+), 23 deletions(-) diff --git a/include/linux/kdb.h b/include/linux/kdb.h index 792779c..abe927c 100644 --- a/include/linux/kdb.h +++ b/include/linux/kdb.h @@ -16,6 +16,8 @@ typedef enum { KDB_REPEAT_NO_ARGS = 0x1, /* Repeat the command w/o arguments */ KDB_REPEAT_WITH_ARGS = 0x2, /* Repeat the command w/ its arguments */ + KDB_SAFE = 0x4, /* Security-wise safe command */ + KDB_SAFE_NO_ARGS = 0x8, /* Only safe if run w/o arguments */ } kdb_cmdflags_t; typedef int (*kdb_func_t)(int, const char **); diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c index 172b726..83c3f60 100644 --- a/kernel/debug/kdb/kdb_main.c +++ b/kernel/debug/kdb/kdb_main.c @@ -2821,70 +2821,70 @@ static void __init kdb_inittab(void) kdb_register_flags("mm", kdb_mm, " ", "Modify Memory Contents", 0, KDB_REPEAT_NO_ARGS); kdb_register_flags("go", kdb_go, "[]", - "Continue Execution", 1, 0); + "Continue Execution", 1, KDB_SAFE_NO_ARGS); kdb_register_flags("rd", kdb_rd, "", "Display Registers", 0, 0); kdb_register_flags("rm", kdb_rm, " ", "Modify Registers", 0, 0); kdb_register_flags("ef", kdb_ef, "", - "Display exception frame", 0, 0); + "Display exception frame", 0, KDB_SAFE); kdb_register_flags("bt", kdb_bt, "[]", - "Stack traceback", 1, 0); + "Stack traceback", 1, KDB_SAFE); kdb_register_flags("btp", kdb_bt, "", - "Display stack for process ", 0, 0); + "Display stack for process ", 0, KDB_SAFE); kdb_register_flags("bta", kdb_bt, "[DRSTCZEUIMA]", - "Display stack all processes", 0, 0); + "Display stack all processes", 0, KDB_SAFE); kdb_register_flags("btc", kdb_bt, "", - "Backtrace current process on each cpu", 0, 0); + "Backtrace current process on each cpu", 0, KDB_SAFE); kdb_register_flags("btt", kdb_bt, "", "Backtrace process given its struct task address", 0, 0); kdb_register_flags("ll", kdb_ll, " ", - "Execute cmd for each element in linked list", 0, 0); + "Execute cmd for each element in linked list", 0, KDB_SAFE); kdb_register_flags("env", kdb_env, "", - "Show environment variables", 0, 0); + "Show environment variables", 0, KDB_SAFE); kdb_register_flags("set", kdb_set, "", - "Set environment variables", 0, 0); + "Set environment variables", 0, KDB_SAFE); kdb_register_flags("help", kdb_help, "", - "Display Help Message", 1, 0); + "Display Help Message", 1, KDB_SAFE); kdb_register_flags("?", kdb_help, "", - "Display Help Message", 0, 0); + "Display Help Message", 0, KDB_SAFE); kdb_register_flags("cpu", kdb_cpu, "", - "Switch to new cpu", 0, 0); + "Switch to new cpu", 0, KDB_SAFE); kdb_register_flags("kgdb", kdb_kgdb, "", "Enter kgdb mode", 0, 0); kdb_register_flags("ps", kdb_ps, "[|A]", - "Display active task list", 0, 0); + "Display active task list", 0, KDB_SAFE); kdb_register_flags("pid", kdb_pid, "", - "Switch to another task", 0, 0); + "Switch to another task", 0, KDB_SAFE); kdb_register_flags("reboot", kdb_reboot, "", - "Reboot the machine immediately", 0, 0); + "Reboot the machine immediately", 0, KDB_SAFE); #if defined(CONFIG_MODULES) kdb_register_flags("lsmod", kdb_lsmod, "", - "List loaded kernel modules", 0, 0); + "List loaded kernel modules", 0, KDB_SAFE); #endif #if defined(CONFIG_MAGIC_SYSRQ) kdb_register_flags("sr", kdb_sr, "", - "Magic SysRq key", 0, 0); + "Magic SysRq key", 0, KDB_SAFE); #endif #if defined(CONFIG_PRINTK) kdb_register_flags("dmesg", kdb_dmesg, "[lines]", - "Display syslog buffer", 0, 0); + "Display syslog buffer", 0, KDB_SAFE); #endif if (arch_kgdb_ops.enable_nmi) { kdb_register_flags("disable_nmi", kdb_disable_nmi, "", - "Disable NMI entry to KDB", 0, 0); + "Disable NMI entry to KDB", 0, KDB_SAFE); } kdb_register_flags("defcmd", kdb_defcmd, "name \"usage\" \"help\"", - "Define a set of commands, down to endefcmd", 0, 0); + "Define a set of commands, down to endefcmd", 0, KDB_SAFE); kdb_register_flags("kill", kdb_kill, "<-signal> ", "Send a signal to a process", 0, 0); kdb_register_flags("summary", kdb_summary, "", - "Summarize the system", 4, 0); + "Summarize the system", 4, KDB_SAFE); kdb_register_flags("per_cpu", kdb_per_cpu, " [] []", "Display per_cpu variables", 3, 0); kdb_register_flags("grephelp", kdb_grep_help, "", - "Display help on | grep", 0, 0); + "Display help on | grep", 0, KDB_SAFE); } /* Execute any commands defined in kdb_cmds. */ diff --git a/kernel/trace/trace_kdb.c b/kernel/trace/trace_kdb.c index 1b68177..8353852 100644 --- a/kernel/trace/trace_kdb.c +++ b/kernel/trace/trace_kdb.c @@ -128,7 +128,7 @@ static int kdb_ftdump(int argc, const char **argv) static __init int kdb_ftrace_register(void) { kdb_register_flags("ftdump", kdb_ftdump, "[skip_#lines] [cpu]", - "Dump ftrace log", 0, 0); + "Dump ftrace log", 0, KDB_SAFE); return 0; }