Re: [PATCH] Kconfig: Make config Filter access to /dev/mem default y

[Xiaotian Feng]

On Thu, Apr 15, 2010 at 2:17 PM, wzt wzt <wzt.wzt@xxxxxxxxx> wrote:
> On Thu, Apr 15, 2010 at 2:12 PM, Xiaotian Feng <xtfeng@xxxxxxxxx> wrote:
>> On Tue, Apr 13, 2010 at 10:52 AM, Â<wzt.wzt@xxxxxxxxx> wrote:
>>> Recently, most company start use >=2.6.31 kernels to replace redhat kernels.
>>> But the config "Filter access to /dev/mem" is "default n", that allows kernel
>>> rootkit using /dev/mem again. it could access all kernel memory default. Most
>>> administrator don't known the "Filter access to /dev/mem" is "defult N", when
>>> he compiles the kernel, it's easily to be attacked by rootkit.
>>
>> Have you ever successfully attack by this way?

I'm curious about the result if you open this option to yes.

>
> [root@localhost zealot]# ./zealot
> [+] Found HISTSIZE. Â Â Â Â Â Â Â Â Â Â Â Â Â Â [SAFE]
> [+] Check md5 values. Â Â Â Â Â Â Â Â Â Â Â Â Â [SAFE]
> [+] eth0 was not set promsic. Â Â Â Â Â Â Â Â Â [SAFE]
> [+] Not found raw socket. Â Â Â Â Â Â Â Â Â Â Â [SAFE]
> system_call addr changed to 0xc04028a0,sys_call_table addr changed to
> 0xc0675130,Found dr rootkit!,system call sys_execve addr changed to
> 0xc0401582,system call sys_olduname addr changed to 0xc0405989,system
> call sys_fork addr changed to 0xc0407bbb
>
> It's a host ids i wrote, Âit could search all kernel memory using /dev/mem. ok?
>
> some of the code here:
> static void *kmap(unsigned long off, unsigned long count)
> {
> Â Â Â Âint fd;
> Â Â Â Âvoid *p;
>
> Â Â Â Âfd = open(DEV_MEM, O_RDWR);
> Â Â Â Âif (fd < 3) {
> Â Â Â Â Â Â Â ÂDbgPrint("open %s failed.\n", DEV_MEM);
> Â Â Â Â Â Â Â Âdup2(fd, 3);
> Â Â Â Â Â Â Â Âclose(fd);
> Â Â Â Â Â Â Â Âfd = 3;
> Â Â Â Â}
>
> Â Â Â Âp = mmap(NULL, ALIGNUP(count + 4097), PROT_READ | PROT_WRITE,
> Â Â Â Â Â Â Â ÂMAP_SHARED, fd, ALIGNDOWN(off) & 0x0fffffff);

mmap_mem in drivers/char/mem.c

        if (!range_is_allowed(vma->vm_pgoff, size))
                return -EPERM;

        if (!phys_mem_access_prot_allowed(file, vma->vm_pgoff, size,
                                                &vma->vm_page_prot))
                return -EINVAL;

If kernel is not set CONFIG_STRICT_DEVMEM, range_is_allowed will
return 1 always, and phys_mem_access_prot_allowed is defined as weak.

In arch/x86/mm/pat.c, phys_mem_access_prot_allowed is defined, and
range_is_allowed is declared to check the mem access w/o
CONFIG_STRICT_DEVMEM, so it looks like the same as kernel w/
CONFIG_STRICT_DEVMEM.

What's the result for kernel w/ CONFIG_STRICT_DEVMEM ? does it prevent
your rootkit?

> Â Â Â Âif (p == MAP_FAILED)
> Â Â Â Â{
> Â Â Â Â Â Â Â Âmem_support_flag = 1;
> Â Â Â Â Â Â Â Âfprintf(stdout, "[-] /dev/mem cannot be read or write.\n");
>
> Â Â Â Â Â Â Â ÂDbgPrint("mmap failture, errno %d\n", errno);
> Â Â Â Â Â Â Â Âclose(fd);
> Â Â Â Â Â Â Â Âreturn NULL;
> Â Â Â Â}
>
> Â Â Â Âclose(fd);
> Â Â Â Âreturn p;
> }
>
>>If CONFIG_STRICT_DEVMEM
>> is not set, the /dev/mem access is filtered in pat code.
> please point it, thanks.
>
>>>
>>> Signed-off-by: Zhitong Wang <zhitong.wangzt@xxxxxxxxxxxxxxx>
>>>
>>> ---
>>> Âarch/x86/Kconfig.debug      Â|  Â3 ++-
>>> Âarch/x86/configs/i386_defconfig  |  Â2 +-
>>> Âarch/x86/configs/x86_64_defconfig | Â Â2 +-
>>> Â3 files changed, 4 insertions(+), 3 deletions(-)
>>>
>>> diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
>>> index bc01e3e..733aea6 100644
>>> --- a/arch/x86/Kconfig.debug
>>> +++ b/arch/x86/Kconfig.debug
>>> @@ -7,6 +7,7 @@ source "lib/Kconfig.debug"
>>>
>>> Âconfig STRICT_DEVMEM
>>> Â Â Â Âbool "Filter access to /dev/mem"
>>> + Â Â Â default y
>>> Â Â Â Â---help---
>>> Â Â Â Â ÂIf this option is disabled, you allow userspace (root) access to all
>>> Â Â Â Â Âof memory, including kernel and userspace memory. Accidental
>>> @@ -20,7 +21,7 @@ config STRICT_DEVMEM
>>> Â Â Â Â ÂThis is sufficient for dosemu and X and all common users of
>>> Â Â Â Â Â/dev/mem.
>>>
>>> - Â Â Â Â If in doubt, say Y.
>>> + Â Â Â Â If in doubt, say N.
>>>
>>> Âconfig X86_VERBOSE_BOOTUP
>>> Â Â Â Âbool "Enable verbose x86 bootup info messages"
>>> diff --git a/arch/x86/configs/i386_defconfig b/arch/x86/configs/i386_defconfig
>>> index d28fad1..95c85a8 100644
>>> --- a/arch/x86/configs/i386_defconfig
>>> +++ b/arch/x86/configs/i386_defconfig
>>> @@ -2386,7 +2386,7 @@ CONFIG_PROVIDE_OHCI1394_DMA_INIT=y
>>> Â# CONFIG_SAMPLES is not set
>>> ÂCONFIG_HAVE_ARCH_KGDB=y
>>> Â# CONFIG_KGDB is not set
>>> -# CONFIG_STRICT_DEVMEM is not set
>>> +CONFIG_STRICT_DEVMEM=y
>>> ÂCONFIG_X86_VERBOSE_BOOTUP=y
>>> ÂCONFIG_EARLY_PRINTK=y
>>> ÂCONFIG_EARLY_PRINTK_DBGP=y
>>> diff --git a/arch/x86/configs/x86_64_defconfig b/arch/x86/configs/x86_64_defconfig
>>> index 6c86acd..659bfe7 100644
>>> --- a/arch/x86/configs/x86_64_defconfig
>>> +++ b/arch/x86/configs/x86_64_defconfig
>>> @@ -2360,7 +2360,7 @@ CONFIG_PROVIDE_OHCI1394_DMA_INIT=y
>>> Â# CONFIG_SAMPLES is not set
>>> ÂCONFIG_HAVE_ARCH_KGDB=y
>>> Â# CONFIG_KGDB is not set
>>> -# CONFIG_STRICT_DEVMEM is not set
>>> +CONFIG_STRICT_DEVMEM=y
>>> ÂCONFIG_X86_VERBOSE_BOOTUP=y
>>> ÂCONFIG_EARLY_PRINTK=y
>>> ÂCONFIG_EARLY_PRINTK_DBGP=y
>>> --
>>> 1.6.5.3
>>>
>>> --
>>> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
>>> the body of a message to majordomo@xxxxxxxxxxxxxxx
>>> More majordomo info at Âhttp://vger.kernel.org/majordomo-info.html
>>> Please read the FAQ at Âhttp://www.tux.org/lkml/
>>>
>>
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/