Re: [GIT PULL] Kernel lockdown for secure boot

[Alexei Starovoitov]

On Sun, Apr 08, 2018 at 04:07:42PM +0800, joeyli wrote:
> 
> > If the only thing that folks are paranoid about is reading
> > arbitrary kernel memory with bpf_probe_read() helper
> > then preferred patch would be to disable it during verification
> > when in lockdown mode
> 
> Sorry for I didn't fully understand your idea...
> Do you mean that using bpf verifier to filter out bpf program that
> uses bpf_probe_read()?

Take a look bpf_get_trace_printk_proto().
Similarly we can add bpf_get_probe_read_proto() that
will return NULL if lockdown is on.
Then programs with bpf_probe_read() will be rejected by the verifier.