linux-hardening - [RFC PATCH v1 0/1] seal system mappings

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241004163155.3493183-1-jeffxu@google.com>
Date: Fri,  4 Oct 2024 16:31:54 +0000
From: jeffxu@...omium.org
To: akpm@...ux-foundation.org,
	keescook@...omium.org,
	jannh@...gle.com,
	torvalds@...ux-foundation.org,
	adhemerval.zanella@...aro.org,
	oleg@...hat.com
Cc: linux-kernel@...r.kernel.org,
	linux-hardening@...r.kernel.org,
	linux-mm@...ck.org,
	jorgelo@...omium.org,
	sroettger@...gle.com,
	ojeda@...nel.org,
	adobriyan@...il.com,
	anna-maria@...utronix.de,
	mark.rutland@....com,
	linus.walleij@...aro.org,
	mike.kravetz@...cle.com,
	Jason@...c4.com,
	deller@....de,
	rdunlap@...radead.org,
	davem@...emloft.net,
	hch@....de,
	peterx@...hat.com,
	hca@...ux.ibm.com,
	f.fainelli@...il.com,
	gerg@...nel.org,
	dave.hansen@...ux.intel.com,
	mingo@...nel.org,
	ardb@...nel.org,
	nathan_lynch@...tor.com,
	dsafonov@...tuozzo.com,
	Liam.Howlett@...cle.com,
	mhocko@...e.com,
	42.hyeyoo@...il.com,
	peterz@...radead.org,
	ardb@...gle.com,
	enh@...gle.com,
	rientjes@...gle.com,
	groeck@...omium.org,
	lorenzo.stoakes@...cle.com,
	Jeff Xu <jeffxu@...gle.com>
Subject: [RFC PATCH v1 0/1] seal system mappings

From: Jeff Xu <jeffxu@...gle.com>

Seal vdso, vvar, sigpage, uprobes and vsyscall.

Those mappings are readonly or executable only, sealing can protect
them from ever changing during the life time of the process.

System mappings such as vdso, vvar, and sigpage (for arm) are
generated by the kernel during program initialization. These mappings
are designated as non-writable, and sealing them will prevent them
from ever becoming writeable.

Unlike the aforementioned mappings, the uprobe mapping is not
established during program startup. However, its lifetime is the same
as the process's lifetime [1], thus sealable.

The vdso, vvar, sigpage, and uprobe mappings all invoke the
_install_special_mapping() function. As no other mappings utilize this
function, it is logical to incorporate sealing logic within
_install_special_mapping(). This approach avoids the necessity of
modifying code across various architecture-specific implementations.

The vsyscall mapping, which has its own initialization function, is
sealed in the XONLY case, it seems to be the most common and secure
case of using vsyscall.

It is important to note that the CHECKPOINT_RESTORE feature (CRIU) may
alter the mapping of vdso, vvar, and sigpage during restore
operations. Consequently, this feature cannot be universally enabled
across all systems. To address this, a kernel configuration option has
been introduced to enable or disable this functionality. I tested
CONFIG_SEAL_SYSTEM_MAPPINGS_ALWAYS with ChromeOS, which doesn’t use
CHECKPOINT_RESTORE, to verify the sealing works.

[1] https://lore.kernel.org/all/CABi2SkU9BRUnqf70-nksuMCQ+yyiWjo3fM4XkRkL-NrCZxYAyg@mail.gmail.com/

Jeff Xu (1):
  exec: seal system mappings

 .../admin-guide/kernel-parameters.txt         |  9 ++++
 arch/x86/entry/vsyscall/vsyscall_64.c         |  9 +++-
 fs/exec.c                                     | 53 +++++++++++++++++++
 include/linux/fs.h                            |  1 +
 mm/mmap.c                                     |  1 +
 security/Kconfig                              | 26 +++++++++
 6 files changed, 97 insertions(+), 2 deletions(-)

-- 
2.47.0.rc0.187.ge670bccf7e-goog