summaryrefslogtreecommitdiff
path: root/sys/secmodel
diff options
context:
space:
mode:
authorkamil <kamil@NetBSD.org>2018-04-08 14:46:32 +0000
committerkamil <kamil@NetBSD.org>2018-04-08 14:46:32 +0000
commit5fbee18cdc6ef613fe4955cb2d7383b4415d646b (patch)
tree4ecd0c08eb05259c7cf61c33e942481e3b5c9648 /sys/secmodel
parent26a110db9d8cb15e1d5f021817f4367ad1071269 (diff)
Add new sysctl(3) entry: security.models.extensions.user_set_dbregs
Model this new sysctl(3) entry after "user_set_cpu_affinity" in the same level of sysctl(3) switches. Allow to read unconditionally Debug Registers (no change here). This is convenient as even if a user of a debugger does not use hardware assisted watchpoints/breakpoints, a debugger can still prompt these values to store in an internal cache with context of registers. Reading them should have no security concerns. Add a paranoid MI switch that prohibits by default setting these registers by a regular user (non-superuser). Make this switch disabled by default. There are enough reserved bits out there to allow using them unconditionally on hardened hosts. Features shipped with Debug Registers are optional features in debuggers. There is no reduction in elementary functionality. Reviewed by <christos> Sponsored by <The NetBSD Foundation>
Diffstat (limited to 'sys/secmodel')
-rw-r--r--sys/secmodel/extensions/secmodel_extensions.c23
1 files changed, 21 insertions, 2 deletions
diff --git a/sys/secmodel/extensions/secmodel_extensions.c b/sys/secmodel/extensions/secmodel_extensions.c
index 36d00a443cb..22e12c667ad 100644
--- a/sys/secmodel/extensions/secmodel_extensions.c
+++ b/sys/secmodel/extensions/secmodel_extensions.c
@@ -1,4 +1,4 @@
-/* $NetBSD: secmodel_extensions.c,v 1.7 2015/12/12 14:57:52 maxv Exp $ */
+/* $NetBSD: secmodel_extensions.c,v 1.8 2018/04/08 14:46:32 kamil Exp $ */
/*-
* Copyright (c) 2011 Elad Efrat <elad@NetBSD.org>
* All rights reserved.
@@ -27,7 +27,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: secmodel_extensions.c,v 1.7 2015/12/12 14:57:52 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: secmodel_extensions.c,v 1.8 2018/04/08 14:46:32 kamil Exp $");
#include <sys/types.h>
#include <sys/param.h>
@@ -38,6 +38,7 @@ __KERNEL_RCSID(0, "$NetBSD: secmodel_extensions.c,v 1.7 2015/12/12 14:57:52 maxv
#include <sys/socketvar.h>
#include <sys/sysctl.h>
#include <sys/proc.h>
+#include <sys/ptrace.h>
#include <sys/module.h>
#include <secmodel/secmodel.h>
@@ -49,6 +50,10 @@ static int dovfsusermount;
static int curtain;
static int user_set_cpu_affinity;
+#ifdef PT_SETDBREGS
+int user_set_dbregs;
+#endif
+
static kauth_listener_t l_system, l_process, l_network;
static secmodel_t extensions_sm;
@@ -135,6 +140,17 @@ sysctl_security_extensions_setup(struct sysctllog **clog)
&user_set_cpu_affinity, 0,
CTL_CREATE, CTL_EOL);
+#ifdef PT_SETDBREGS
+ sysctl_createv(clog, 0, &rnode, NULL,
+ CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
+ CTLTYPE_INT, "user_set_dbregs",
+ SYSCTL_DESCR("Whether unprivileged users may set "\
+ "CPU Debug Registers."),
+ sysctl_extensions_user_handler, 0,
+ &user_set_dbregs, 0,
+ CTL_CREATE, CTL_EOL);
+#endif
+
/* Compatibility: vfs.generic.usermount */
sysctl_createv(clog, 0, NULL, NULL,
CTLFLAG_PERMANENT,
@@ -250,6 +266,9 @@ secmodel_extensions_init(void)
curtain = 0;
user_set_cpu_affinity = 0;
+#ifdef PT_SETDBREGS
+ user_set_dbregs = 0;
+#endif
}
static void