linux-kernel - Re: [PATCH v2] mm/mprotect.c: don't imply PROT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Sun, 28 Feb 2016 22:58:08 +0100
From:	Piotr Kwapulinski <kwapulinski.piotr@...il.com>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	mgorman@...e.de, kirill.shutemov@...ux.intel.com,
	aneesh.kumar@...ux.vnet.ibm.com, gorcunov@...nvz.org,
	aarcange@...hat.com, koct9i@...il.com, benh@...nel.crashing.org,
	linux-mm@...ck.org, linux-kernel@...r.kernel.org,
	Dave Hansen <dave.hansen@...ux.intel.com>
Subject: Re: [PATCH v2] mm/mprotect.c: don't imply PROT_EXEC on non-exec fs

On Fri, Feb 26, 2016 at 12:20:32PM -0800, Andrew Morton wrote:
> On Wed, 27 Jan 2016 17:29:37 +0100 Piotr Kwapulinski <kwapulinski.piotr@...il.com> wrote:
> 
> > The mprotect(PROT_READ) fails when called by the READ_IMPLIES_EXEC binary
> > on a memory mapped file located on non-exec fs. The mprotect does not
> > check whether fs is _executable_ or not. The PROT_EXEC flag is set
> > automatically even if a memory mapped file is located on non-exec fs.
> > Fix it by checking whether a memory mapped file is located on a non-exec
> > fs. If so the PROT_EXEC is not implied by the PROT_READ.
> > The implementation uses the VM_MAYEXEC flag set properly in mmap.
> > Now it is consistent with mmap.
> > 
> > I did the isolated tests (PT_GNU_STACK X/NX, multiple VMAs, X/NX fs).
> > I also patched the official 3.19.0-47-generic Ubuntu 14.04 kernel
> > and it seems to work.
> 
> sys_mprotect() just took a mangling in linux-next due to 
> 
> commit 62b5f7d013fc455b8db26cf01e421f4c0d264b92
> Author:     Dave Hansen <dave.hansen@...ux.intel.com>
> AuthorDate: Fri Feb 12 13:02:40 2016 -0800
> Commit:     Ingo Molnar <mingo@...nel.org>
> CommitDate: Thu Feb 18 19:46:33 2016 +0100
> 
>     mm/core, x86/mm/pkeys: Add execute-only protection keys support
> 
> 
> Here is my rework of your "mm/mprotect.c: don't imply PROT_EXEC on
> non-exec fs" to handle this.  Please check very carefully.
> 
> 
> From: Piotr Kwapulinski <kwapulinski.piotr@...il.com>
> Subject: mm/mprotect.c: don't imply PROT_EXEC on non-exec fs
> 
> The mprotect(PROT_READ) fails when called by the READ_IMPLIES_EXEC binary
> on a memory mapped file located on non-exec fs.  The mprotect does not
> check whether fs is _executable_ or not.  The PROT_EXEC flag is set
> automatically even if a memory mapped file is located on non-exec fs.  Fix
> it by checking whether a memory mapped file is located on a non-exec fs. 
> If so the PROT_EXEC is not implied by the PROT_READ.  The implementation
> uses the VM_MAYEXEC flag set properly in mmap.  Now it is consistent with
> mmap.
> 
> I did the isolated tests (PT_GNU_STACK X/NX, multiple VMAs, X/NX fs).  I
> also patched the official 3.19.0-47-generic Ubuntu 14.04 kernel and it
> seems to work.
> 
> Signed-off-by: Piotr Kwapulinski <kwapulinski.piotr@...il.com>
> Cc: Mel Gorman <mgorman@...e.de>
> Cc: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>
> Cc: Aneesh Kumar K.V <aneesh.kumar@...ux.vnet.ibm.com>
> Cc: Benjamin Herrenschmidt <benh@...nel.crashing.org>
> Cc: Konstantin Khlebnikov <koct9i@...il.com>
> Cc: Dan Williams <dan.j.williams@...el.com>
> Cc: Dave Hansen <dave.hansen@...ux.intel.com>
> Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
> ---
> 
>  mm/mprotect.c |   13 ++++++++-----
>  1 file changed, 8 insertions(+), 5 deletions(-)
> 
> diff -puN mm/mprotect.c~mm-mprotectc-dont-imply-prot_exec-on-non-exec-fs mm/mprotect.c
> --- a/mm/mprotect.c~mm-mprotectc-dont-imply-prot_exec-on-non-exec-fs
> +++ a/mm/mprotect.c
> @@ -359,6 +359,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
>  	struct vm_area_struct *vma, *prev;
>  	int error = -EINVAL;
>  	const int grows = prot & (PROT_GROWSDOWN|PROT_GROWSUP);
> +	const bool rier = (current->personality & READ_IMPLIES_EXEC) &&
> +				(prot & PROT_READ);
> +
>  	prot &= ~(PROT_GROWSDOWN|PROT_GROWSUP);
>  	if (grows == (PROT_GROWSDOWN|PROT_GROWSUP)) /* can't be both */
>  		return -EINVAL;
> @@ -375,11 +378,6 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
>  		return -EINVAL;
>  
>  	reqprot = prot;
> -	/*
> -	 * Does the application expect PROT_READ to imply PROT_EXEC:
> -	 */
> -	if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
> -		prot |= PROT_EXEC;
>  
>  	down_write(&current->mm->mmap_sem);
>  
> @@ -414,6 +412,10 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
>  
>  		/* Here we know that vma->vm_start <= nstart < vma->vm_end. */
>  
> +		/* Does the application expect PROT_READ to imply PROT_EXEC */
> +		if (rier && (vma->vm_flags & VM_MAYEXEC))
> +			prot |= PROT_EXEC;
> +
>  		newflags = calc_vm_prot_bits(prot, pkey);
>  		newflags |= (vma->vm_flags & ~(VM_READ | VM_WRITE | VM_EXEC));
>  
> @@ -445,6 +447,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
>  			error = -ENOMEM;
>  			goto out;
>  		}
> +		prot = reqprot;
>  	}
>  out:
>  	up_write(&current->mm->mmap_sem);
> _
> 
It looks good. I also did some tests (non-MPK CPU) - passed.
Thank you.