Kernel: Disallow jailed processes to read files in /sys/kernel directory

By default, disallow reading of values in that directory. Later on, we
will enable sparingly read access to specific files.

The idea that led to this mechanism was suggested by Jean-Baptiste
Boric (also known as boricj in GitHub), to prevent access to sensitive
information in the SysFS if someone adds a new file in the /sys/kernel
directory.

2 files changed, 9 insertions, 1 deletions

diff --git a/Kernel/FileSystem/SysFS/Subsystems/Kernel/GlobalInformation.cpp b/Kernel/FileSystem/SysFS/Subsystems/Kernel/GlobalInformation.cpp
index 6c87872afd..20800dab8f 100644
--- a/Kernel/FileSystem/SysFS/Subsystems/Kernel/GlobalInformation.cpp
+++ b/Kernel/FileSystem/SysFS/Subsystems/Kernel/GlobalInformation.cpp
@@ -5,6 +5,7 @@
  */
 
 #include <Kernel/FileSystem/SysFS/Subsystems/Kernel/GlobalInformation.h>
+#include <Kernel/Process.h>
 
 namespace Kernel {
 
@@ -51,7 +52,12 @@ ErrorOr<void> SysFSGlobalInformation::refresh_data(OpenFileDescription& descript
             return ENOMEM;
     }
     auto builder = TRY(KBufferBuilder::try_create());
-    TRY(const_cast<SysFSGlobalInformation&>(*this).try_generate(builder));
+    TRY(Process::current().jail().with([&](auto& my_jail) -> ErrorOr<void> {
+        if (my_jail && !is_readable_by_jailed_processes())
+            return Error::from_errno(EPERM);
+        TRY(const_cast<SysFSGlobalInformation&>(*this).try_generate(builder));
+        return {};
+    }));
     auto& typed_cached_data = static_cast<SysFSInodeData&>(*cached_data);
     typed_cached_data.buffer = builder.build();
     if (!typed_cached_data.buffer)
diff --git a/Kernel/FileSystem/SysFS/Subsystems/Kernel/GlobalInformation.h b/Kernel/FileSystem/SysFS/Subsystems/Kernel/GlobalInformation.h
index d463573385..bb0f2d2a92 100644
--- a/Kernel/FileSystem/SysFS/Subsystems/Kernel/GlobalInformation.h
+++ b/Kernel/FileSystem/SysFS/Subsystems/Kernel/GlobalInformation.h
@@ -28,6 +28,8 @@ protected:
     virtual ErrorOr<void> refresh_data(OpenFileDescription&) const override;
     virtual ErrorOr<void> try_generate(KBufferBuilder&) = 0;
 
+    virtual bool is_readable_by_jailed_processes() const { return false; }
+
     mutable Mutex m_refresh_lock;
 };