使能和测试ARM64内核PAN机制

PAN机制简介

内核PAN机制（Privileged Access Never）阻止内核态程序直接访问用户态的数据，只能通过内核提供的固定接口copy_from_user，copy_to_user与用户空间交换数据。使用这一机制的原因主要是因为在某些攻击场景下，黑客通过控制用户态数据来执行漏洞利用，比如towelroot的提权POC[1]。

从实现技术上看，PAN通过修改ttbr0_el1寄存器的值（因为ttbr0_el1寄存器保存着一级页表的地址），使内核无法完成对用户态地址的寻址，从而无法操作用户态地址[2]。另外，使能PAN的内核选项CONFIG_ARM64_SW_TTBR0_PAN的字面意思也清晰地表达了PAN的实现原理——通过“switch ttbr0”来实现PAN。

ARM64使能PAN机制

在ARM64（armv8）上通过启用内核配置CONFIG_ARM64_SW_TTBR0_PAN可以启用PAN功能。需要注意的是，不同CPU架构甚至同一架构下不同版本的使能方式可能存在差别，具体可参考下表：

 （表格来源：Exploit Methods/Userspace data usage - Linux Kernel Security Subsystem）

如何测试PAN是否生效

PAN机制的测试不同于KASLR，KASLR的测试方法十分简单，通过多次启动系统对比内核符号的地址即可判断KASLR是否生效，但PAN机制没办法通过系统环境直接判断是否生效。我们可以通过编写内核模块的方式测试PAN，具体的测试步骤如下：

第一步：编写内核模块，在内核模块中使用memcpy直接访问用户空间数据。

#define BUFSIZE  100
static int kmem = 20;
module_param(kmem,int,0660);
static struct proc_dir_entry *entry;
 
static ssize_t panwrite(struct file *file, const char __user *ubuf, size_t count, loff_t *ppos) 
{
	int count, len, tmp;
	char buf[BUFSIZE];

	if(*ppos > 0 || count > BUFSIZE)
		return -EFAULT;

    memcpy(buf, ubuf, count);
	count = sscanf(buf,"%d",&tmp);
	if(count != 1)
		return -EFAULT;

	kmem = tmp; 
	len = strlen(buf);
	*ppos = len;
	return len;
}
 
 
static const struct proc_ops panops = 
{
	.proc_read = panread,
	.proc_write = panwrite,
};
 
static int pan_init(void)
{
	entry = proc_create("pandev", 0660, NULL, &panops);
	printk(KERN_ALERT "hello...\n");
	return 0;
}
 
static void pan_cleanup(void)
{
	proc_remove(entry);
	printk(KERN_WARNING "bye ...\n");
}
 
module_init(pan_init);
module_exit(pan_cleanup);

用户态测试程序如下，主要逻辑是通过buf向内核传递参数，修改/proc/pandev的值：

char buf[100];
int fd = open("/proc/pandev", O_RDWR);
read(fd, buf, 100);
puts(buf);
 
lseek(fd, 0 , SEEK_SET);
write(fd, "33", 5);
	
lseek(fd, 0 , SEEK_SET);
read(fd, buf, 100);
puts(buf);

第二步：编译模块，在未启用PAN的系统上安装模块并测试。

adas:/home# insmod lkm_hello.ko 
[   31.181093] hello...
adas:/home# cat /proc/pandev 
kmem = 20
xcu-s32g274a:/home# ./uspace 
kmem = 20

kmem = 33
adas:/home# cat /proc/pandev
kmem = 33

根据测试结果可知，在未开启PAN的系统上，内核通过memcpy的方式可以直接访问用户态的内存数据，下一步我们将用同样的测试case验证使能后的情况。

第三步：在内核配置中使能PAN。

 在内核配置中开启CONFIG_ARM64_SW_TTBR0_PAN之后重新编译内核，烧录并启动系统，确认/proc/config.gz文件中CONFIG_ARM64_SW_TTBR0_PAN是否使能。

 第四步：再次安装运行测试case。

adas:/home# insmod lkm_hello.ko
adas:/home# [   39.387532] hello...
adas:/home# ./uspace 
[   90.541095] Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000005589d52f30
[   90.647970] printk: console [ttyLF0]: printing thread stopped
[   90.649269] Mem abort info:
[   90.656813]   ESR = 0x96000005
[   90.660425]   EC = 0x25: DABT (current EL), IL = 32 bits
[   90.665952]   SET = 0, FnV = 0
[   90.669112]   EA = 0, S1PTW = 0
[   90.672367] Data abort info:
[   90.675341]   ISV = 0, ISS = 0x00000005
[   90.679289]   CM = 0, WnR = 0
[   90.682334] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000082da7000
[   90.689038] [0000005589d52f30] pgd=00000000970de003, p4d=00000000970de003, pud=00000000970de003, pmd=0000000097020003, pte=00e80000974bdf43
[   90.701908] Internal error: Oops: 96000005 [#1] PREEMPT_RT SMP
[   90.707895] Modules linked in: lkm_hello(O) pfeng(O)
[   90.712994] CPU: 3 PID: 1850 Comm: sh Tainted: G           O      5.10.41-rt42+g5c4c385db992 #1
[   90.721912] Hardware name: XXXXXX (DT)
[   90.726731] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO BTYPE=--)
[   90.732887] pc : __memcpy+0x94/0x180
[   90.736564] lr : mywrite+0x64/0xc4 [lkm_hello]
[   90.741125] sp : ffffffc01422bcf0
[   90.744516] x29: ffffffc01422bcf0 x28: ffffff800ad6ea00 
[   90.749962] x27: 0000000000000000 x26: 0000000000000000 
[   90.755406] x25: 0000000000000000 x24: 0000000000000000 
[   90.760851] x23: 0000000000000000 x22: ffffffc01422be30 
[   90.766297] x21: 0000005589d52f30 x20: 0000000000000004 
[   90.771742] x19: ffffffc01422be30 x18: ffffffc010958ec8 
[   90.777187] x17: 0000000000000000 x16: 0000000000000000 
[   90.782630] x15: 0000000000000020 x14: 0000000000000000 
[   90.788074] x13: 0000000000000000 x12: fffffffffffe7687 
[   90.793517] x11: ffffffc010958ee0 x10: ffffffc010960c10 
[   90.798962] x9 : ffffffc01422bcf0 x8 : ffffffc010958ea0 
[   90.804407] x7 : ffffffc01422bb70 x6 : ffffffc01422bd2c 
[   90.809851] x5 : ffffff806fc487b8 x4 : 0000000000000000 
[   90.815297] x3 : 0000000000000027 x2 : 0000000000000004 
[   90.820742] x1 : 0000005589d52f30 x0 : ffffffc01422bd2c 
[   90.826188] Call trace:
[   90.828693]  __memcpy+0x94/0x180
[   90.832005]  proc_reg_write+0xa8/0xec
[   90.835765]  vfs_write+0xf0/0x2b0
[   90.839164]  ksys_write+0x6c/0x100
[   90.842649]  __arm64_sys_write+0x20/0x30
[   90.846667]  el0_svc_common.constprop.0+0x78/0x1a0
[   90.851582]  do_el0_svc+0x24/0x90
[   90.854978]  el0_svc+0x14/0x20
[   90.858112]  el0_sync_handler+0x1a4/0x1b0
[   90.862219]  el0_sync+0x184/0x1c0
[   90.865625] Code: 36180062 f8408423 f80084c3 36100062 (b8404423) 
[   90.871875] ---[ end trace 0000000000000002 ]---

内核模块安装成功，但是运行用户态程序之后出现崩溃，根据日志“Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000005589d52f30”等信息，我们可以确认PAN机制阻止了内核对用户态内存数据的直接访问。

参考文献

[1].towelroot提权POC

https://github.com/geekben/towelroot/blob/master/towelroot.c

[2].ARM64 PAN的实现

 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux ttbr0-pan