From 1ca0ac5207c45d32ad45cb9f6861b2447217738d Mon Sep 17 00:00:00 2001 From: Liav A Date: Sat, 12 Nov 2022 19:50:57 +0200 Subject: Kernel: Disallow jailed processes to read files in /sys/kernel directory By default, disallow reading of values in that directory. Later on, we will enable sparingly read access to specific files. The idea that led to this mechanism was suggested by Jean-Baptiste Boric (also known as boricj in GitHub), to prevent access to sensitive information in the SysFS if someone adds a new file in the /sys/kernel directory. --- Kernel/FileSystem/SysFS/Subsystems/Kernel/GlobalInformation.cpp | 8 +++++++- Kernel/FileSystem/SysFS/Subsystems/Kernel/GlobalInformation.h | 2 ++ 2 files changed, 9 insertions(+), 1 deletion(-) (limited to 'Kernel/FileSystem/SysFS') diff --git a/Kernel/FileSystem/SysFS/Subsystems/Kernel/GlobalInformation.cpp b/Kernel/FileSystem/SysFS/Subsystems/Kernel/GlobalInformation.cpp index 6c87872afd..20800dab8f 100644 --- a/Kernel/FileSystem/SysFS/Subsystems/Kernel/GlobalInformation.cpp +++ b/Kernel/FileSystem/SysFS/Subsystems/Kernel/GlobalInformation.cpp @@ -5,6 +5,7 @@ */ #include +#include namespace Kernel { @@ -51,7 +52,12 @@ ErrorOr SysFSGlobalInformation::refresh_data(OpenFileDescription& descript return ENOMEM; } auto builder = TRY(KBufferBuilder::try_create()); - TRY(const_cast(*this).try_generate(builder)); + TRY(Process::current().jail().with([&](auto& my_jail) -> ErrorOr { + if (my_jail && !is_readable_by_jailed_processes()) + return Error::from_errno(EPERM); + TRY(const_cast(*this).try_generate(builder)); + return {}; + })); auto& typed_cached_data = static_cast(*cached_data); typed_cached_data.buffer = builder.build(); if (!typed_cached_data.buffer) diff --git a/Kernel/FileSystem/SysFS/Subsystems/Kernel/GlobalInformation.h b/Kernel/FileSystem/SysFS/Subsystems/Kernel/GlobalInformation.h index d463573385..bb0f2d2a92 100644 --- a/Kernel/FileSystem/SysFS/Subsystems/Kernel/GlobalInformation.h +++ b/Kernel/FileSystem/SysFS/Subsystems/Kernel/GlobalInformation.h @@ -28,6 +28,8 @@ protected: virtual ErrorOr refresh_data(OpenFileDescription&) const override; virtual ErrorOr try_generate(KBufferBuilder&) = 0; + virtual bool is_readable_by_jailed_processes() const { return false; } + mutable Mutex m_refresh_lock; }; -- cgit v1.2.3