linux-kernel - Re: [RFC] fixing the UML failure root cause

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 14 Oct 2011 13:31:14 -0700
From:	Andrew Lutomirski <luto@....edu>
To:	richard -rw- weinberger <richard.weinberger@...il.com>
Cc:	Ingo Molnar <mingo@...e.hu>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Adrian Bunk <bunk@...sta.de>,
	"H. Peter Anvin" <hpa@...ux.intel.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>, x86@...nel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [RFC] fixing the UML failure root cause

On Fri, Oct 14, 2011 at 1:23 PM, richard -rw- weinberger
<richard.weinberger@...il.com> wrote:
> On Fri, Oct 14, 2011 at 10:17 PM, Andrew Lutomirski <luto@....edu> wrote:
>> On Fri, Oct 14, 2011 at 12:53 PM, richard -rw- weinberger
>> <richard.weinberger@...il.com> wrote:
>>> On Tue, Oct 11, 2011 at 7:24 PM, Andrew Lutomirski <luto@....edu> wrote:
>>>> What do you think of this approach?  If it seems good, I'll finish the
>>>> patch and submit it.
>>>>
>>>> With this patch applied, UML appears to work, but it fills the log with
>>>> exploit attempt warnings.  Any ideas on what to do about that?
>>>>
>>>
>>> I can confirm that this patch works.
>>> And I really like vsyscall=emulate because with that UML can trap vsyscalls. :-)
>>
>> Are you sure you don't mean vsyscall=native?  I suspect that UML can't
>> actually trap vsyscalls in emulate mode right now, although that ought
>> to be fixable.
>>
>
> Doesn't vsyscall_emu_64.S transform any vsyscall into a real syscall?
> So UML can trap it.

Only if that code actually executes.  In vsyscall=emulate mode, the
page is not executable and a trap is taken instead.  It's not entirely
clear what the right thing to do is wrt ptrace users.

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/