linux-kernel - Re: [PATCH 0/9] mm: Hardened usercopy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 10 Jul 2016 01:16:36 +0200
From:	"PaX Team" <pageexec@...email.hu>
To:	Kees Cook <keescook@...omium.org>,
	Andy Lutomirski <luto@...capital.net>
CC:	Christoph Lameter <cl@...ux.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Brad Spengler <spender@...ecurity.net>,
	Pekka Enberg <penberg@...nel.org>,
	Ard Biesheuvel <ard.biesheuvel@...aro.org>,
	Casey Schaufler <casey@...aufler-ca.com>,
	Will Deacon <will.deacon@....com>,
	Rik van Riel <riel@...hat.com>,
	Benjamin Herrenschmidt <benh@...nel.crashing.org>,
	Dmitry Vyukov <dvyukov@...gle.com>,
	"linux-ia64@...r.kernel.org" <linux-ia64@...r.kernel.org>,
	"linux-arm-kernel@...ts.infradead.org" 
	<linux-arm-kernel@...ts.infradead.org>, X86 ML <x86@...nel.org>,
	Catalin Marinas <catalin.marinas@....com>,
	linux-arch <linux-arch@...r.kernel.org>,
	David Rientjes <rientjes@...gle.com>,
	Mathias Krause <minipli@...glemail.com>,
	"kernel-hardening@...ts.openwall.com" 
	<kernel-hardening@...ts.openwall.com>,
	"David S. Miller" <davem@...emloft.net>,
	Laura Abbott <labbott@...oraproject.org>,
	"linux-mm@...ck.org" <linux-mm@...ck.org>, Jan Kara <jack@...e.cz>,
	Russell King <linux@...linux.org.uk>,
	Michael Ellerman <mpe@...erman.id.au>,
	Andrea Arcangeli <aarcange@...hat.com>,
	Fenghua Yu <fenghua.yu@...el.com>,
	linuxppc-dev@...ts.ozlabs.org, Vitaly Wool <vitalywool@...il.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Borislav Petkov <bp@...e.de>, Tony Luck <tony.luck@...el.com>,
	Joonsoo Kim <iamjoonsoo.kim@....com>,
	sparclinux@...r.kernel.org
Subject: Re: [PATCH 0/9] mm: Hardened usercopy

On 9 Jul 2016 at 14:27, Andy Lutomirski wrote:

> On Jul 6, 2016 6:25 PM, "Kees Cook" <keescook@...omium.org> wrote:
> >
> > Hi,
> >
> > This is a start of the mainline port of PAX_USERCOPY[1]. After I started
> > writing tests (now in lkdtm in -next) for Casey's earlier port[2], I
> > kept tweaking things further and further until I ended up with a whole
> > new patch series. To that end, I took Rik's feedback and made a number
> > of other changes and clean-ups as well.
> >
> 
> I like the series, but I have one minor nit to pick.  The effect of
> this series is to harden usercopy, but most of the code is really
> about infrastructure to validate that a pointed-to object is valid.

actually USERCOPY has never been about validating pointers. its sole purpose
is to validate the *size* argument of copy*user calls, a very specific form
of runtime bounds checking. it's only really relevant for slab objects and the
pointer checks (that one might mistake for being a part of the defense mechanism)
are only there to determine whether the kernel pointer refers to a slab object
or not (the stack part is a small bonus and was never the main goal either).

> Might it make sense to call the infrastructure part something else?

yes, more bikeshedding will surely help, like the renaming of .data..read_only
to .data..ro_after_init which also had nothing to do with init but everything
to do with objects being conceptually read-only...

> After all, this could be extended in the future for memcpy or even for
> some GCC plugin to check pointers passed to ordinary (non-allocator)
> functions.

what kind of checks are you thinking of here? and more fundamentally, against
what kind of threats? as for memcpy, it's the standard mandated memory copying
function, what security related properties can it check on its pointer arguments?