[PATCH] loadpin: Implement custom proc_handler for enforce

[PATCH] loadpin: Implement custom proc_handler for enforce

[Joel Granados]

The new proc_handler_loadpin returns -EINVAL when is_loadpin_writable is
false and the kernel var (enforce) is being written. Move
loadpin_sysctl_table to .rodata (by const qualifying it) as there is no
need to change the value of the extra1 entry.

Signed-off-by: Joel Granados <joel.granados@kernel.org>
---
Const qualifying ctl tables is part of the hardening effort in the linux
kernel.
---
 security/loadpin/loadpin.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/security/loadpin/loadpin.c b/security/loadpin/loadpin.c
index 273ffbd6defe1324d6688dec5f9fe6c9401283ed..f049c81b82a78265b6ae358bb2a814265cec9f16 100644
--- a/security/loadpin/loadpin.c
+++ b/security/loadpin/loadpin.c
@@ -53,18 +53,29 @@ static bool deny_reading_verity_digests;
 #endif
 
 #ifdef CONFIG_SYSCTL
-static struct ctl_table loadpin_sysctl_table[] = {
+static bool is_loadpin_writable;
+
+static int proc_handler_loadpin(const struct ctl_table *table, int dir,
+				void *buffer, size_t *lenp, loff_t *ppos)
+{
+	if (!is_loadpin_writable && SYSCTL_USER_TO_KERN(dir))
+		return -EINVAL;
+	return proc_dointvec_minmax(table, dir, buffer, lenp, ppos);
+}
+
+static const struct ctl_table loadpin_sysctl_table[] = {
 	{
 		.procname       = "enforce",
 		.data           = &enforce,
 		.maxlen         = sizeof(int),
 		.mode           = 0644,
-		.proc_handler   = proc_dointvec_minmax,
-		.extra1         = SYSCTL_ONE,
+		.proc_handler   = proc_handler_loadpin,
+		.extra1         = SYSCTL_ZERO,
 		.extra2         = SYSCTL_ONE,
 	},
 };
 
+
 static void set_sysctl(bool is_writable)
 {
 	/*
@@ -72,9 +83,9 @@ static void set_sysctl(bool is_writable)
 	 * device, allow sysctl to change modes for testing.
 	 */
 	if (is_writable)
-		loadpin_sysctl_table[0].extra1 = SYSCTL_ZERO;
+		is_loadpin_writable = true;
 	else
-		loadpin_sysctl_table[0].extra1 = SYSCTL_ONE;
+		is_loadpin_writable = false;
 }
 #else
 static inline void set_sysctl(bool is_writable) { }

---
base-commit: 8f0b4cce4481fb22653697cced8d0d04027cb1e8
change-id: 20251215-jag-const_loadpin-761f052f76c4

Best regards,
-- 
Joel Granados <joel.granados@kernel.org>

Re: [PATCH] loadpin: Implement custom proc_handler for enforce

[Kees Cook]

On Mon, Dec 15, 2025 at 04:43:48PM +0100, Joel Granados wrote:
> The new proc_handler_loadpin returns -EINVAL when is_loadpin_writable is
> false and the kernel var (enforce) is being written. Move
> loadpin_sysctl_table to .rodata (by const qualifying it) as there is no
> need to change the value of the extra1 entry.
> 
> Signed-off-by: Joel Granados <joel.granados@kernel.org>
> ---
> Const qualifying ctl tables is part of the hardening effort in the linux
> kernel.

Ah yes, thanks for getting through these "weird" cases! :)

> ---
>  security/loadpin/loadpin.c | 21 ++++++++++++++++-----
>  1 file changed, 16 insertions(+), 5 deletions(-)
> 
> diff --git a/security/loadpin/loadpin.c b/security/loadpin/loadpin.c
> index 273ffbd6defe1324d6688dec5f9fe6c9401283ed..f049c81b82a78265b6ae358bb2a814265cec9f16 100644
> --- a/security/loadpin/loadpin.c
> +++ b/security/loadpin/loadpin.c
> @@ -53,18 +53,29 @@ static bool deny_reading_verity_digests;
>  #endif
>  
>  #ifdef CONFIG_SYSCTL
> -static struct ctl_table loadpin_sysctl_table[] = {
> +static bool is_loadpin_writable;

I would rather that load_root_writable were declared external to
loadpin_check(), and then we could remove set_sysctl() entirely, instead
using load_root_writable as the thing to check in proc_handler_loadpin().

And also rename load_root_writable to "loadpin_root_writable", just to
make it a bit more clear.

-Kees

-- 
Kees Cook

Re: [PATCH] loadpin: Implement custom proc_handler for enforce

[Joel Granados]

[-- Attachment #1: Type: text/plain, Size: 4086 bytes --]

On Tue, Dec 16, 2025 at 12:37:29AM -0800, Kees Cook wrote:
> On Mon, Dec 15, 2025 at 04:43:48PM +0100, Joel Granados wrote:
> > The new proc_handler_loadpin returns -EINVAL when is_loadpin_writable is
> > false and the kernel var (enforce) is being written. Move
> > loadpin_sysctl_table to .rodata (by const qualifying it) as there is no
> > need to change the value of the extra1 entry.
> > 
> > Signed-off-by: Joel Granados <joel.granados@kernel.org>
> > ---
> > Const qualifying ctl tables is part of the hardening effort in the linux
> > kernel.
> 
> Ah yes, thanks for getting through these "weird" cases! :)
> 
> > ---
> >  security/loadpin/loadpin.c | 21 ++++++++++++++++-----
> >  1 file changed, 16 insertions(+), 5 deletions(-)
> > 
> > diff --git a/security/loadpin/loadpin.c b/security/loadpin/loadpin.c
> > index 273ffbd6defe1324d6688dec5f9fe6c9401283ed..f049c81b82a78265b6ae358bb2a814265cec9f16 100644
> > --- a/security/loadpin/loadpin.c
> > +++ b/security/loadpin/loadpin.c
> > @@ -53,18 +53,29 @@ static bool deny_reading_verity_digests;
> >  #endif
> >  
> >  #ifdef CONFIG_SYSCTL
> > -static struct ctl_table loadpin_sysctl_table[] = {
> > +static bool is_loadpin_writable;
> 
> I would rather that load_root_writable were declared external to
> loadpin_check(), and then we could remove set_sysctl() entirely, instead
> using load_root_writable as the thing to check in proc_handler_loadpin().
This seems like a better approach :).

> 
> And also rename load_root_writable to "loadpin_root_writable", just to
> make it a bit more clear.
And the default value of loadpin_root_writable would be false. right?
Something like this:


diff --git c/security/loadpin/loadpin.c w/security/loadpin/loadpin.c
index 273ffbd6defe..650073829db4 100644
--- c/security/loadpin/loadpin.c
+++ w/security/loadpin/loadpin.c
@@ -53,44 +53,40 @@ static bool deny_reading_verity_digests;
 #endif
 
 #ifdef CONFIG_SYSCTL
-static struct ctl_table loadpin_sysctl_table[] = {
+static bool loadpin_root_writable;
+
+static int proc_handler_loadpin(const struct ctl_table *table, int dir,
+				void *buffer, size_t *lenp, loff_t *ppos)
+{
+	if (!loadpin_root_writable && SYSCTL_USER_TO_KERN(dir))
+		return -EINVAL;
+	return proc_dointvec_minmax(table, dir, buffer, lenp, ppos);
+}
+
+static const struct ctl_table loadpin_sysctl_table[] = {
 	{
 		.procname       = "enforce",
 		.data           = &enforce,
 		.maxlen         = sizeof(int),
 		.mode           = 0644,
-		.proc_handler   = proc_dointvec_minmax,
-		.extra1         = SYSCTL_ONE,
+		.proc_handler   = proc_handler_loadpin,
+		.extra1         = SYSCTL_ZERO,
 		.extra2         = SYSCTL_ONE,
 	},
 };
-
-static void set_sysctl(bool is_writable)
-{
-	/*
-	 * If load pinning is not enforced via a read-only block
-	 * device, allow sysctl to change modes for testing.
-	 */
-	if (is_writable)
-		loadpin_sysctl_table[0].extra1 = SYSCTL_ZERO;
-	else
-		loadpin_sysctl_table[0].extra1 = SYSCTL_ONE;
-}
-#else
-static inline void set_sysctl(bool is_writable) { }
 #endif
 
-static void report_writable(struct super_block *mnt_sb, bool writable)
+static void report_writable(struct super_block *mnt_sb)
 {
 	if (mnt_sb->s_bdev) {
 		pr_info("%pg (%u:%u): %s\n", mnt_sb->s_bdev,
 			MAJOR(mnt_sb->s_bdev->bd_dev),
 			MINOR(mnt_sb->s_bdev->bd_dev),
-			writable ? "writable" : "read-only");
+			loadpin_root_writable ? "writable" : "read-only");
 	} else
 		pr_info("mnt_sb lacks block device, treating as: writable\n");
 
-	if (!writable)
+	if (!loadpin_root_writable)
 		pr_info("load pinning engaged.\n");
 }
 
@@ -168,8 +164,8 @@ static int loadpin_check(struct file *file, enum kernel_read_file_id id)
 	spin_unlock(&pinned_root_spinlock);
 
 	if (first_root_pin) {
-		report_writable(pinned_root, load_root_writable);
-		set_sysctl(load_root_writable);
+		loadpin_root_writable = sb_is_writable(pinned_root);
+		report_writable(pinned_root);
 		report_load(origin, file, "pinned");
 	}
 

-- 

Joel Granados

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]

Re: [PATCH] loadpin: Implement custom proc_handler for enforce

[Joel Granados]

[-- Attachment #1: Type: text/plain, Size: 1632 bytes --]

Sent out a V2

On Tue, Dec 16, 2025 at 12:37:29AM -0800, Kees Cook wrote:
> On Mon, Dec 15, 2025 at 04:43:48PM +0100, Joel Granados wrote:
> > The new proc_handler_loadpin returns -EINVAL when is_loadpin_writable is
> > false and the kernel var (enforce) is being written. Move
> > loadpin_sysctl_table to .rodata (by const qualifying it) as there is no
> > need to change the value of the extra1 entry.
> > 
> > Signed-off-by: Joel Granados <joel.granados@kernel.org>
> > ---
> > Const qualifying ctl tables is part of the hardening effort in the linux
> > kernel.
> 
> Ah yes, thanks for getting through these "weird" cases! :)
> 
> > ---
> >  security/loadpin/loadpin.c | 21 ++++++++++++++++-----
> >  1 file changed, 16 insertions(+), 5 deletions(-)
> > 
> > diff --git a/security/loadpin/loadpin.c b/security/loadpin/loadpin.c
> > index 273ffbd6defe1324d6688dec5f9fe6c9401283ed..f049c81b82a78265b6ae358bb2a814265cec9f16 100644
> > --- a/security/loadpin/loadpin.c
> > +++ b/security/loadpin/loadpin.c
> > @@ -53,18 +53,29 @@ static bool deny_reading_verity_digests;
> >  #endif
> >  
> >  #ifdef CONFIG_SYSCTL
> > -static struct ctl_table loadpin_sysctl_table[] = {
> > +static bool is_loadpin_writable;
> 
> I would rather that load_root_writable were declared external to
> loadpin_check(), and then we could remove set_sysctl() entirely, instead
> using load_root_writable as the thing to check in proc_handler_loadpin().
> 
> And also rename load_root_writable to "loadpin_root_writable", just to
> make it a bit more clear.
> 
> -Kees
> 
> -- 
> Kees Cook

-- 

Joel Granados

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]