linux-kernel - Re: [PATCH v1] mm, sysctl: Add sysctl for controlling VM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <160c3fc3-6d75-18d3-8575-98bb41e0543a@collabora.com>
Date:   Mon, 29 Aug 2016 11:31:50 -0400
From:   Robert Foss <robert.foss@...labora.com>
To:     Will Drewry <wad@...omium.org>,
        "Kirill A. Shutemov" <kirill@...temov.name>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        kirill.shutemov@...ux.intel.com, vbabka@...e.cz, mhocko@...e.com,
        mingo@...nel.org, dave.hansen@...ux.intel.com, hannes@...xchg.org,
        dan.j.williams@...el.com, iamjoonsoo.kim@....com, acme@...hat.com,
        Kees Cook <keescook@...omium.org>, mgorman@...hsingularity.net,
        atomlin@...hat.com, Hugh Dickins <hughd@...gle.com>,
        dyoung@...hat.com, Al Viro <viro@...iv.linux.org.uk>,
        Daniel Cashman <dcashman@...gle.com>, w@....eu,
        idryomov@...il.com, yang.shi@...aro.org, vkuznets@...hat.com,
        vdavydov@...tuozzo.com, vitalywool@...il.com, oleg@...hat.com,
        gang.chen.5i5j@...il.com, koct9i@...il.com, aarcange@...hat.com,
        aryabinin@...tuozzo.com, kuleshovmail@...il.com,
        minchan@...nel.org, mguzik@...hat.com, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org, Ivan Krasin <krasin@...gle.com>,
        Roland McGrath <mcgrathr@...omium.org>,
        Mandeep Singh Baines <msb@...omium.org>,
        Ben Zhang <benzh@...omium.org>,
        Filipe Brandenburger <filbranden@...omium.org>
Subject: Re: [PATCH v1] mm, sysctl: Add sysctl for controlling VM_MAYEXEC
 taint



On 2016-08-29 11:25 AM, Will Drewry wrote:
>
>
> On Fri, Aug 26, 2016 at 4:32 PM, Kirill A. Shutemov
> <kirill@...temov.name <mailto:kirill@...temov.name>> wrote:
>
>     On Fri, Aug 26, 2016 at 12:30:04PM -0400, robert.foss@...labora.com
>     <mailto:robert.foss@...labora.com> wrote:
>     > From: Will Drewry <wad@...omium.org <mailto:wad@...omium.org>>
>     >
>     > This patch proposes a sysctl knob that allows a privileged user to
>     > disable ~VM_MAYEXEC tainting when mapping in a vma from a MNT_NOEXEC
>     > mountpoint.  It does not alter the normal behavior resulting from
>     > attempting to directly mmap(PROT_EXEC) a vma (-EPERM) nor the behavior
>     > of any other subsystems checking MNT_NOEXEC.
>
>     Wouldn't it be equal to remounting all filesystems without noexec from
>     attacker POV? It's hardly a fence to make additional mprotect(PROT_EXEC)
>     call, before starting executing code from such filesystems.
>
>     If administrator of the system wants this, he can just mount filesystem
>     without noexec, no new kernel code required. And it's more fine-grained
>     than this.
>
>     So, no, I don't think we should add knob like this. Unless I miss
>     something.
>
>
> I don't believe this patch is necessary anymore (though, thank you
> Robert for testing and re-sending!).
>
> The primary offenders wrt to needing to mmap/mprotect a file in /dev/shm
> was the older nvidia
> driver (binary only iirc) and the Chrome Native Client code.
>
> The reason why half-exec is an "ok" (half) mitigation is because it
> blocks simple gadgets and other paths for using loadable libraries or
> binaries (via glibc) as it disallows mmap(PROT_EXEC) even though it
> allows mprotect(PROT_EXEC).  This stops ld in its tracks since it does
> the obvious thing and uses mmap(PROT_EXEC).
>
> I think time has marched on and this patch is now something I can toss
> in the dustbin of history. Both Chrome's Native Client and an older
> nvidia driver relied on creating-then-unlinking a file in tmpfs, but
> there is now a better facility!
>
>
>     NAK.
>
>
> Agreed - this is old and software that predicated it should be gone.. I
> hope. :)

Splendid, patch dropped!
Thanks Will and Kirill!


Rob.

>
>
>
>     > It is motivated by a common /dev/shm, /tmp usecase. There are few
>     > facilities for creating a shared memory segment that can be remapped in
>     > the same process address space with different permissions.
>
>     What about using memfd_create(2) for such cases? You'll get a file
>     descriptor from in-kernel tmpfs (shm_mnt) which is not exposed to
>     userspace for remount as noexec.
>
>
> This is a relatively old patch ( https://lwn.net/Articles/455256/
> <https://lwn.net/Articles/455256/> ) which predated memfd_create().
>  memfd_create() is the right solution to this problem!
>
>
> Thanks again!
> will