Allow BPF tracing under lockdown

Bug #1868626 reported by Thadeu Lima de Souza Cascardo
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Fix Committed
Undecided
Seth Forshee
Eoan
Fix Released
Critical
Thadeu Lima de Souza Cascardo

Bug Description

[Impact]
BPF tracing is allowed on Bionic and on Focal under integrity lockdown, which is going to be the default before release. Right now, Eoan does not allow kprobes and BPF reads under lockdown, preventing BPF tracing and kprobe tracing.

[Test case]
sudo bpftrace -e 'kprobe:do_nanosleep { printf("PID %d sleeping...\n", pid); }'
sudo bpftrace -e 'tracepoint:syscalls:sys_enter_openat { printf("filename: [%s]; flags: [%d]\n", str(args->filename), args->flags); }'

The last one should show the filename and flags.

[Regression potential]
This would allow privileged users to possibly read some kernel data that was not possible before. However, this is already possible on systems that are not under lockdown, which are all non-secure boot systems by default. This also matches the behavior of signed kernels of Bionic and Focal.

Changed in linux (Ubuntu Eoan):
assignee: nobody → Thadeu Lima de Souza Cascardo (cascardo)
status: New → In Progress
importance: Undecided → Critical
Changed in linux (Ubuntu):
status: New → Fix Committed
assignee: nobody → Seth Forshee (sforshee)
Changed in linux (Ubuntu Eoan):
status: In Progress → Fix Committed
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-eoan' to 'verification-done-eoan'. If the problem still exists, change the tag 'verification-needed-eoan' to 'verification-failed-eoan'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-eoan
Revision history for this message
Sean Feole (sfeole) wrote :

This really should be turned into a test case. @cascardo, to your knowledge, does this test case exist in the current bpf test suite?

Revision history for this message
Thadeu Lima de Souza Cascardo (cascardo) wrote :

ubuntu@eoan:~$ uname -r
5.3.0-46-generic
ubuntu@eoan:~$ grep -i lockdown /proc/cmdline
BOOT_IMAGE=/boot/vmlinuz-5.3.0-46-generic root=PARTUUID=486ca49b-7073-4f42-84a9-c3724b219786 ro console=tty1 console=ttyS0 lockdown
ubuntu@eoan:~$ dmesg | grep -i lockdown
[ 0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-5.3.0-46-generic root=PARTUUID=486ca49b-7073-4f42-84a9-c3724b219786 ro console=tty1 console=ttyS0 lockdown
[ 0.000000] Kernel is locked down from command line; see man kernel_lockdown.7
[ 0.019403] Kernel command line: BOOT_IMAGE=/boot/vmlinuz-5.3.0-46-generic root=PARTUUID=486ca49b-7073-4f42-84a9-c3724b219786 ro console=tty1 console=ttyS0 lockdown
[ 1.389113] Lockdown: swapper/0: Hibernation is restricted; see man kernel_lockdown.7
ubuntu@eoan:~$ sudo bpftrace -e 'tracepoint:syscalls:sys_enter_openat { printf("filename: [%s]; flags: [%d]\n", str(args->filename), args->flags); }'
Attaching 1 probe...
filename: [/proc/interrupts]; flags: [0]
filename: [/proc/stat]; flags: [0]
^C

ubuntu@eoan:~$ sudo bpftrace -e 'kprobe:do_nanosleep { printf("PID %d sleeping\n", pid); }'
Attaching 1 probe...
PID 509 sleeping
PID 509 sleeping
^C

ubuntu@eoan:~$

tags: added: verification-done-eoan
removed: verification-needed-eoan
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (49.1 KiB)

This bug was fixed in the package linux - 5.3.0-46.38

---------------
linux (5.3.0-46.38) eoan; urgency=medium

  * eoan/linux: 5.3.0-43.36 -proposed tracker (LP: #1867301)

  * Fix AMD Stoney Ridge screen flickering under 4K resolution (LP: #1864005)
    - iommu/amd: Disable IOMMU on Stoney Ridge systems

  * Allow BPF tracing under lockdown (LP: #1868626)
    - Revert "UBUNTU: SAUCE: (efi-lockdown) Lock down kprobes"
    - Revert "bpf: Restrict bpf when kernel lockdown is in confidentiality mode"

  * Missing wireless network interface after kernel 5.3.0-43 upgrade with eoan
    (LP: #1868442)
    - iwlwifi: mvm: Do not require PHY_SKU NVM section for 3168 devices

  * Packaging resync (LP: #1786013)
    - [Packaging] resync getabis
    - [Packaging] update helper scripts

  * iSCSI-target: Deleting a LUN hangs in the kernel (LP: #1862682)
    - scsi: Revert "target/core: Inline transport_lun_remove_cmd()"

  * Stop using get_scalar_status command in Dell AIO uart backlight driver
    (LP: #1865402)
    - SAUCE: platform/x86: dell-uart-backlight: add get_display_mode command

  * Eoan update: upstream stable patchset 2020-03-11 (LP: #1867051)
    - Revert "drm/sun4i: dsi: Change the start delay calculation"
    - ovl: fix lseek overflow on 32bit
    - kernel/module: Fix memleak in module_add_modinfo_attrs()
    - media: iguanair: fix endpoint sanity check
    - ocfs2: fix oops when writing cloned file
    - x86/cpu: Update cached HLE state on write to TSX_CTRL_CPUID_CLEAR
    - udf: Allow writing to 'Rewritable' partitions
    - printk: fix exclusive_console replaying
    - iwlwifi: mvm: fix NVM check for 3168 devices
    - sparc32: fix struct ipc64_perm type definition
    - cls_rsvp: fix rsvp_policy
    - gtp: use __GFP_NOWARN to avoid memalloc warning
    - l2tp: Allow duplicate session creation with UDP
    - net: hsr: fix possible NULL deref in hsr_handle_frame()
    - net_sched: fix an OOB access in cls_tcindex
    - net: stmmac: Delete txtimer in suspend()
    - bnxt_en: Fix TC queue mapping.
    - tcp: clear tp->total_retrans in tcp_disconnect()
    - tcp: clear tp->delivered in tcp_disconnect()
    - tcp: clear tp->data_segs{in|out} in tcp_disconnect()
    - tcp: clear tp->segs_{in|out} in tcp_disconnect()
    - rxrpc: Fix use-after-free in rxrpc_put_local()
    - rxrpc: Fix insufficient receive notification generation
    - rxrpc: Fix missing active use pinning of rxrpc_local object
    - rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect
    - media: uvcvideo: Avoid cyclic entity chains due to malformed USB descriptors
    - mfd: dln2: More sanity checking for endpoints
    - ipc/msg.c: consolidate all xxxctl_down() functions
    - tracing: Fix sched switch start/stop refcount racy updates
    - rcu: Avoid data-race in rcu_gp_fqs_check_wake()
    - brcmfmac: Fix memory leak in brcmf_usbdev_qinit
    - usb: typec: tcpci: mask event interrupts when remove driver
    - usb: gadget: legacy: set max_speed to super-speed
    - usb: gadget: f_ncm: Use atomic_t to track in-flight request
    - usb: gadget: f_ecm: Use atomic_t to track in-flight request
    - ALSA: usb-audio: Fix endianess in descriptor validatio...

Changed in linux (Ubuntu Eoan):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers