linux-hardening - Re: [PATCH] proc: add config to block FOLL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <11987f-66993b80-1-116be8e0@64320549>
Date: Thu, 18 Jul 2024 16:58:10 +0100
From: "Adrian Ratiu" <adrian.ratiu@...labora.com>
To: "Linus Torvalds" <torvalds@...ux-foundation.org>
Cc: "Kees Cook" <kees@...nel.org>, linux-fsdevel@...r.kernel.org, linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org, kernel@...labora.com, gbiv@...gle.com, inglorion@...gle.com, ajordanr@...gle.com, "Doug Anderson" <dianders@...omium.org>, "Jeff Xu" <jeffxu@...gle.com>, "Jann Horn" <jannh@...gle.com>, "Christian Brauner" <brauner@...nel.org>
Subject: Re: [PATCH] proc: add config to block 
 FOLL_FORCE in mem writes

On Thursday, July 18, 2024 03:04 EEST, Linus Torvalds <torvalds@...ux-foundation.org> wrote:

> On Wed, 17 Jul 2024 at 15:24, Kees Cook <kees@...nel.org> wrote:
> >
> > > In particular, this patch would make it easy to make that
> > > SECURITY_PROC_MEM_RESTRICT_FOLL_FORCE config option be a "choice"
> > > where you pick "never, ptrace, always" by just changing the rules in
> > > proc_is_ptracing().
> >
> > So the original patch could be reduced to just the single tristate option
> > instead of 3 tristates? I think that would be a decent middle ground,
> > and IIUC, will still provide the coverage Chrome OS is looking for[1].
> 
> So here's what I kind of think might be ok.
> 
> ENTIRELY UNTESTED! This is more of a "look, something like this,
> perhaps" patch than a real one.
> 
> If somebody tests this, and it is ok for Chrome OS, you can consider
> this signed-off-on, but only with actual testing. I might have gotten
> something hroribly wrong.

Thanks for the patch!

I tested it on ChromeOS and it does what it intends, just with two
minor fixes applied:

--- a/security/Kconfig
+++ b/security/Kconfig
-config CONFIG_PROC_MEM_FORCE_PTRACE
+config PROC_MEM_FORCE_PTRACE
.....
 -config CONFIG_PROC_MEM_NO_FORCE
+config PROC_MEM_NO_FORCE

As Kees suggested, I'll add a bootparam with a simple __ro_after_init
variable to select this and then send a v2 for review.