linux-kernel - Problem running a task in ring 2 on x86

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <471BC3C2.2050602@in.tum.de>
Date:	Sun, 21 Oct 2007 23:25:22 +0200
From:	Michael Weiss <weissm@...tum.de>
To:	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Problem running a task in ring 2 on x86

Hi,

I'm trying to get a process to ring level 2 on IA-32 architecture.
Therefore I have patched the modify_ldt syscall in ldt.c to generate a
new ldt entry with rpl 2 (patch below).

Now my problem is how to get the code segment with rpl2, located in
the ldt at index 0,
loaded by a syscall, so that the application is running in ring 2
after return of that syscall.

Under kernel 2.0.x the following seemed to do this, if ptr is a
pointer to a userstack allocated with malloc:

asmlinkage int sys_set_rpl(long ptr) {

   struct pt_regs *regs = (struct pt_regs *)&ptr;

   regs->cs = 0x6;  /* first entry of ldt with rpl2 */
   regs->ss = 0xE;  /* 2. entry of ldt with rpl2 */
   current->tss.ss2 = 0xE;
   current->tss.esp2 = ptr;

   return(0);

}

Now there is no tss per task and no hw context switch in the newer
kernels this isn't working in 2.6.

So if any of you have an idea to get a solution for that problem I
were very pleased.
I need this for an memory protection implementation in my bachelor thesis.


Thanks,
Michael

Here's the patch for modify_ldt:

diff -ru /usr/src/linux-2.6.22.5/arch/i386/kernel/ldt.c
arch/i386/kernel/ldt.c
--- /usr/src/linux-2.6.22.5/arch/i386/kernel/ldt.c      2007-08-23
01:23:54.000000000 +0200
+++ arch/i386/kernel/ldt.c      2007-10-21 22:29:12.000000000 +0200
@@ -172,7 +172,7 @@
        return err;
 }

-static int write_ldt(void __user * ptr, unsigned long bytecount, int
oldmode)
+static int write_ldt_mod(void __user * ptr, unsigned long bytecount,
int oldmode, int rpl)
 {
        struct mm_struct * mm = current->mm;
        __u32 entry_1, entry_2;
@@ -214,6 +214,11 @@

        entry_1 = LDT_entry_a(&ldt_info);
        entry_2 = LDT_entry_b(&ldt_info);
+
+       /* modify the rpl from 3 to 2 */
+       if (rpl == 2)
+               entry_2 &= ~(1 << 14);
+
        if (oldmode)
                entry_2 &= ~(1 << 20);

@@ -228,6 +233,10 @@
        return error;
 }

+static int write_ldt(void __user * ptr, unsigned long bytecount, int
oldmode) {
+       return write_ldt_mod(ptr, bytecount, oldmode, 3);
+}
+
 asmlinkage int sys_modify_ldt(int func, void __user *ptr, unsigned
long bytecount)
 {
        int ret = -ENOSYS;
@@ -245,6 +254,10 @@
        case 0x11:
                ret = write_ldt(ptr, bytecount, 0);
                break;
+       /* create new ldt entry with rpl 2 */
+       case 4:
+               ret = write_ldt_mod(ptr, bytecount, 0, 2);
+               break;
        }
        return ret;
 }

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/