Daniel Thompson a8f4d63142 lockdown: also lock down previous kgdb use ... commit eadb2f47a3 upstream. KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port (for example, via a hypervisor console, which some cloud vendors provide over the network) could trigger the debugger so it is important that the debugger respect the lockdown mode when/if it is triggered. Fix this by integrating lockdown into kdb's existing permissions mechanism. Unfortunately kgdb does not have any permissions mechanism (although it certainly could be added later) so, for now, kgdb is simply and brutally disabled by immediately exiting the gdb stub without taking any action. For lockdowns established early in the boot (e.g. the normal case) then this should be fine but on systems where kgdb has set breakpoints before the lockdown is enacted than "bad things" will happen. CVE: CVE-2022-21499 Co-developed-by: Stephen Brennan <stephen.s.brennan@oracle.com> Signed-off-by: Stephen Brennan <stephen.s.brennan@oracle.com> Reviewed-by: Douglas Anderson <dianders@chromium.org> Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-05-30 09:33:22 +02:00
..
apparmor	apparmor: fix error check	2021-11-18 14:04:22 +01:00
bpf	bpf: Implement bpf_local_storage for inodes	2020-08-25 15:00:04 -07:00
integrity	EVM: fix the evm= __setup handler return value	2022-04-08 14:40:00 +02:00
keys	KEYS: fix length validation in keyctl_pkey_params_get_2()	2022-04-08 14:39:50 +02:00
loadpin	LSM: Add "contents" flag to kernel_read_file hook	2020-10-05 13:37:03 +02:00
lockdown	Merge branch 'next-general' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2020-06-02 17:36:24 -07:00
safesetid	LSM: SafeSetID: Fix warnings reported by test bot	2020-10-13 09:17:36 -07:00
selinux	include/uapi/linux/xfrm.h: Fix XFRM_MSG_MAPPING ABI breakage	2022-05-25 09:18:02 +02:00
smack	Fix incorrect type in assignment of ipv6 port for audit	2022-04-08 14:40:31 +02:00
tomoyo	TOMOYO: fix __setup handlers return values	2022-04-08 14:40:18 +02:00
yama	task_work: cleanup notification modes	2020-10-17 15:05:30 -06:00
commoncap.c	security: commoncap: fix -Wstringop-overread warning	2021-05-11 14:47:36 +02:00
device_cgroup.c	device_cgroup: Fix RCU list debugging warning	2020-08-20 11:25:03 -07:00
inode.c
Kconfig	fortify: Explicitly disable Clang support	2021-11-21 13:46:35 +01:00
Kconfig.hardening	security: allow using Clang's zero initialization for stack variables	2020-06-16 02:06:23 -07:00
lsm_audit.c	dump_common_audit_data(): fix racy accesses to ->d_name	2021-01-19 18:27:29 +01:00
Makefile
min_addr.c
security.c	lockdown: also lock down previous kgdb use	2022-05-30 09:33:22 +02:00