Commit b1ae6dc4 authored by Dmitry Torokhov's avatar Dmitry Torokhov Committed by Luis Chamberlain
Browse files

module: add in-kernel support for decompressing 



Current scheme of having userspace decompress kernel modules before
loading them into the kernel runs afoul of LoadPin security policy, as
it loses link between the source of kernel module on the disk and binary
blob that is being loaded into the kernel. To solve this issue let's
implement decompression in kernel, so that we can pass a file descriptor
of compressed module file into finit_module() which will keep LoadPin
happy.

To let userspace know what compression/decompression scheme kernel
supports it will create /sys/module/compression attribute. kmod can read
this attribute and decide if it can pass compressed file to
finit_module(). New MODULE_INIT_COMPRESSED_DATA flag indicates that the
kernel should attempt to decompress the data read from file descriptor
prior to trying load the module.

To simplify things kernel will only implement single decompression
method matching compression method selected when generating modules.
This patch implements gzip and xz; more can be added later,

Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: default avatarLuis Chamberlain <mcgrof@kernel.org>
parent ef307fc2

include/uapi/linux/module.h

+1 −0
Original line number Diff line number Diff line
@@ -5,5 +5,6 @@ 
/* Flags for sys_finit_module: */

#define MODULE_INIT_IGNORE_MODVERSIONS	1

#define MODULE_INIT_IGNORE_VERMAGIC	2

#define MODULE_INIT_COMPRESSED_FILE	4



#endif /* _UAPI_LINUX_MODULE_H */

init/Kconfig

+13 −0
Original line number Diff line number Diff line
@@ -2274,6 +2274,19 @@ config MODULE_COMPRESS_ZSTD 


endchoice



config MODULE_DECOMPRESS

	bool "Support in-kernel module decompression"

	depends on MODULE_COMPRESS_GZIP || MODULE_COMPRESS_XZ

	select ZLIB_INFLATE if MODULE_COMPRESS_GZIP

	select XZ_DEC if MODULE_COMPRESS_XZ

	help



	  Support for decompressing kernel modules by the kernel itself

	  instead of relying on userspace to perform this task. Useful when

	  load pinning security policy is enabled.



	  If unsure, say N.



config MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS

	bool "Allow loading of modules with missing namespace imports"

	help

kernel/Makefile

+1 −0
Original line number Diff line number Diff line
@@ -67,6 +67,7 @@ obj-y += up.o 
endif

obj-$(CONFIG_UID16) += uid16.o

obj-$(CONFIG_MODULES) += module.o

obj-$(CONFIG_MODULE_DECOMPRESS) += module_decompress.o

obj-$(CONFIG_MODULE_SIG) += module_signing.o

obj-$(CONFIG_MODULE_SIG_FORMAT) += module_signature.o

obj-$(CONFIG_KALLSYMS) += kallsyms.o

kernel/module-internal.h

+19 −0
Original line number Diff line number Diff line
@@ -22,6 +22,11 @@ struct load_info { 
	bool sig_ok;

#ifdef CONFIG_KALLSYMS

	unsigned long mod_kallsyms_init_off;

#endif

#ifdef CONFIG_MODULE_DECOMPRESS

	struct page **pages;

	unsigned int max_pages;

	unsigned int used_pages;

#endif

	struct {

		unsigned int sym, str, mod, vers, info, pcpu;
@@ -29,3 +34,17 @@ struct load_info { 
};



extern int mod_verify_sig(const void *mod, struct load_info *info);



#ifdef CONFIG_MODULE_DECOMPRESS

int module_decompress(struct load_info *info, const void *buf, size_t size);

void module_decompress_cleanup(struct load_info *info);

#else

static inline int module_decompress(struct load_info *info,

				    const void *buf, size_t size)

{

	return -EOPNOTSUPP;

}

static inline void module_decompress_cleanup(struct load_info *info)

{

}

#endif

kernel/module.c

+24 −11
Original line number Diff line number Diff line
@@ -3173,8 +3173,11 @@ static int copy_module_from_user(const void __user *umod, unsigned long len, 
	return err;

}



static void free_copy(struct load_info *info)

static void free_copy(struct load_info *info, int flags)

{

	if (flags & MODULE_INIT_COMPRESSED_FILE)

		module_decompress_cleanup(info);

	else

		vfree(info->hdr);

}
@@ -4124,7 +4127,7 @@ static int load_module(struct load_info *info, const char __user *uargs, 
	}



	/* Get rid of temporary copy. */

	free_copy(info);

	free_copy(info, flags);



	/* Done! */

	trace_module_load(mod);
@@ -4173,7 +4176,7 @@ static int load_module(struct load_info *info, const char __user *uargs, 


	module_deallocate(mod, info);

 free_copy:

	free_copy(info);

	free_copy(info, flags);

	return err;

}
@@ -4200,7 +4203,8 @@ SYSCALL_DEFINE3(init_module, void __user *, umod, 
SYSCALL_DEFINE3(finit_module, int, fd, const char __user *, uargs, int, flags)

{

	struct load_info info = { };

	void *hdr = NULL;

	void *buf = NULL;

	int len;

	int err;



	err = may_init_module();
@@ -4210,15 +4214,24 @@ SYSCALL_DEFINE3(finit_module, int, fd, const char __user *, uargs, int, flags) 
	pr_debug("finit_module: fd=%d, uargs=%p, flags=%i\n", fd, uargs, flags);



	if (flags & ~(MODULE_INIT_IGNORE_MODVERSIONS

		      |MODULE_INIT_IGNORE_VERMAGIC))

		      |MODULE_INIT_IGNORE_VERMAGIC

		      |MODULE_INIT_COMPRESSED_FILE))

		return -EINVAL;



	err = kernel_read_file_from_fd(fd, 0, &hdr, INT_MAX, NULL,

	len = kernel_read_file_from_fd(fd, 0, &buf, INT_MAX, NULL,

				       READING_MODULE);

	if (err < 0)

	if (len < 0)

		return len;



	if (flags & MODULE_INIT_COMPRESSED_FILE) {

		err = module_decompress(&info, buf, len);

		vfree(buf); /* compressed data is no longer needed */

		if (err)

			return err;

	info.hdr = hdr;

	info.len = err;

	} else {

		info.hdr = buf;

		info.len = len;

	}



	return load_module(&info, uargs, flags);

}