linux-kernel - Re: [PATCH v1] mm, sysctl: Add sysctl for controlling VM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sat, 27 Aug 2016 00:32:27 +0300
From:   "Kirill A. Shutemov" <kirill@...temov.name>
To:     robert.foss@...labora.com
Cc:     akpm@...ux-foundation.org, kirill.shutemov@...ux.intel.com,
        vbabka@...e.cz, mhocko@...e.com, mingo@...nel.org,
        dave.hansen@...ux.intel.com, hannes@...xchg.org,
        dan.j.williams@...el.com, iamjoonsoo.kim@....com, acme@...hat.com,
        keescook@...omium.org, mgorman@...hsingularity.net,
        atomlin@...hat.com, hughd@...gle.com, dyoung@...hat.com,
        viro@...iv.linux.org.uk, dcashman@...gle.com, w@....eu,
        idryomov@...il.com, yang.shi@...aro.org, wad@...omium.org,
        vkuznets@...hat.com, vdavydov@...tuozzo.com, vitalywool@...il.com,
        oleg@...hat.com, gang.chen.5i5j@...il.com, koct9i@...il.com,
        aarcange@...hat.com, aryabinin@...tuozzo.com,
        kuleshovmail@...il.com, minchan@...nel.org, mguzik@...hat.com,
        linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        krasin@...gle.com, Roland McGrath <mcgrathr@...omium.org>,
        Mandeep Singh Baines <msb@...omium.org>,
        Ben Zhang <benzh@...omium.org>,
        Filipe Brandenburger <filbranden@...omium.org>
Subject: Re: [PATCH v1] mm, sysctl: Add sysctl for controlling VM_MAYEXEC
 taint

On Fri, Aug 26, 2016 at 12:30:04PM -0400, robert.foss@...labora.com wrote:
> From: Will Drewry <wad@...omium.org>
> 
> This patch proposes a sysctl knob that allows a privileged user to
> disable ~VM_MAYEXEC tainting when mapping in a vma from a MNT_NOEXEC
> mountpoint.  It does not alter the normal behavior resulting from
> attempting to directly mmap(PROT_EXEC) a vma (-EPERM) nor the behavior
> of any other subsystems checking MNT_NOEXEC.

Wouldn't it be equal to remounting all filesystems without noexec from
attacker POV? It's hardly a fence to make additional mprotect(PROT_EXEC)
call, before starting executing code from such filesystems.

If administrator of the system wants this, he can just mount filesystem
without noexec, no new kernel code required. And it's more fine-grained
than this.

So, no, I don't think we should add knob like this. Unless I miss
something.

NAK.

> It is motivated by a common /dev/shm, /tmp usecase. There are few
> facilities for creating a shared memory segment that can be remapped in
> the same process address space with different permissions.

What about using memfd_create(2) for such cases? You'll get a file
descriptor from in-kernel tmpfs (shm_mnt) which is not exposed to
userspace for remount as noexec.

-- 
 Kirill A. Shutemov