linux-kernel - Re: [RFC] fixing the UML failure root cause

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 14 Oct 2011 22:39:40 +0200
From:	richard -rw- weinberger <richard.weinberger@...il.com>
To:	Andrew Lutomirski <luto@....edu>
Cc:	Ingo Molnar <mingo@...e.hu>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Adrian Bunk <bunk@...sta.de>,
	"H. Peter Anvin" <hpa@...ux.intel.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>, x86@...nel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [RFC] fixing the UML failure root cause

On Fri, Oct 14, 2011 at 10:31 PM, Andrew Lutomirski <luto@....edu> wrote:
> On Fri, Oct 14, 2011 at 1:23 PM, richard -rw- weinberger
> <richard.weinberger@...il.com> wrote:
>> On Fri, Oct 14, 2011 at 10:17 PM, Andrew Lutomirski <luto@....edu> wrote:
>>> On Fri, Oct 14, 2011 at 12:53 PM, richard -rw- weinberger
>>> <richard.weinberger@...il.com> wrote:
>>>> On Tue, Oct 11, 2011 at 7:24 PM, Andrew Lutomirski <luto@....edu> wrote:
>>>>> What do you think of this approach?  If it seems good, I'll finish the
>>>>> patch and submit it.
>>>>>
>>>>> With this patch applied, UML appears to work, but it fills the log with
>>>>> exploit attempt warnings.  Any ideas on what to do about that?
>>>>>
>>>>
>>>> I can confirm that this patch works.
>>>> And I really like vsyscall=emulate because with that UML can trap vsyscalls. :-)
>>>
>>> Are you sure you don't mean vsyscall=native?  I suspect that UML can't
>>> actually trap vsyscalls in emulate mode right now, although that ought
>>> to be fixable.
>>>
>>
>> Doesn't vsyscall_emu_64.S transform any vsyscall into a real syscall?
>> So UML can trap it.
>
> Only if that code actually executes.  In vsyscall=emulate mode, the
> page is not executable and a trap is taken instead.  It's not entirely
> clear what the right thing to do is wrt ptrace users.

Okay.
I did some tests, in vsyscall=emulate mode a statically linked program
reports always the correct time.
On < 3.1 kernel this was not the case, here the same program reports
always the hosts time...

-- 
Thanks,
//richard
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/