[PATCH] security: Restrict unprivileged access to /proc/config.gz

[Vic B <linux@vicb.net>]

When using CONFIG_IKCONFIG_PROC, the built-in configuration is
world-readable through /proc/config.gz, which somewhat weakens existing
address hiding defences, as it allows an unprivileged user to simply
read built-in config from the running kernel and build their own copy
with identical System.map.

This patch adds a configuration option to restrict access to
/proc/config.gz to superuser only.

Signed-off-by: Vic B <linux@vicb.net>
---
 kernel/configs.c |  8 +++++++-
 security/Kconfig | 27 +++++++++++++++++++++++++++
 2 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/kernel/configs.c b/kernel/configs.c
index a28c79c5f713..11106164756f 100644
--- a/kernel/configs.c
+++ b/kernel/configs.c
@@ -37,6 +37,12 @@ asm (
 extern char kernel_config_data;
 extern char kernel_config_data_end;
 
+#ifdef CONFIG_SECURITY_IKCONFIG_RESTRICT
+#define IKCONFIG_MODE S_IRUSR
+#else
+#define IKCONFIG_MODE S_IRUGO
+#endif
+
 static ssize_t
 ikconfig_read_current(struct file *file, char __user *buf,
 		      size_t len, loff_t * offset)
@@ -57,7 +63,7 @@ static int __init ikconfig_init(void)
 	struct proc_dir_entry *entry;
 
 	/* create the current config file */
-	entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
+	entry = proc_create("config.gz", S_IFREG | IKCONFIG_MODE , NULL,
 			    &config_gz_proc_ops);
 	if (!entry)
 		return -ENOMEM;
diff --git a/security/Kconfig b/security/Kconfig
index f7bf6cdc6229..0e8b8947150a 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -19,6 +19,33 @@ config SECURITY_DMESG_RESTRICT
 
 	  If you are unsure how to answer this question, answer N.
 
+config SECURITY_IKCONFIG_RESTRICT
+	bool "Restrict unprivileged access to /proc/config.gz"
+	depends on IKCONFIG_PROC
+	default n
+	help
+	  The built-in configuration of the running kernel may be used to build
+	  an identical kernel and expose information about kernel addresses,
+	  which can make exploiting easier.
+
+	  Selecting this option makes the built-in configuration in
+	  /proc/config.gz readable to superuser only.
+
+	  This is mostly useful with custom kernels, as distribution kernels
+	  tend to have their configuration and address maps available online.
+
+	  If you decide to restrict access to built-in config with this option
+	  for the above reasons, you should also make sure that access to the
+	  on-disk kernel image, configuration and System.map is restricted as
+	  well, e.g. by making the /boot directory accessible to superuser
+	  only.
+
+	  When using packaged kernels or image-based updaters, keep in mind
+	  that kernel packages or update images may also be accessible to
+	  unprivileged users via package manager or updater caches, or from
+	  network repositories. In such cases it's a good idea to restrict
+	  access to these as well.
+
 choice
 	prompt "Allow /proc/pid/mem access override"
 	default PROC_MEM_FORCE_PTRACE
-- 
2.47.3