linux-kernel - Re: [RFC 0/3] Put vdso in ramfs-like filesystem (vdsofs)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 20 Sep 2016 18:07:21 -0700
From:   "H. Peter Anvin" <hpa@...or.com>
To:     Andy Lutomirski <luto@...capital.net>
Cc:     Dmitry Safonov <0x7f454c46@...il.com>,
        Dmitry Safonov <dsafonov@...tuozzo.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Ingo Molnar <mingo@...hat.com>,
        Thomas Gleixner <tglx@...utronix.de>, X86 ML <x86@...nel.org>,
        Oleg Nesterov <oleg@...hat.com>,
        Steven Rostedt <rostedt@...dmis.org>,
        Al Viro <viro@...iv.linux.org.uk>
Subject: Re: [RFC 0/3] Put vdso in ramfs-like filesystem (vdsofs)

On 09/20/16 17:54, Andy Lutomirski wrote:
>  - If vvar is in the same inode, then that inode won't be a valid ELF
> image, because the ELF header won't be in the right place.

So the vvar ought to move into an actual ELF segment, which is probably
The Right Thing anyway.

>  - vvar is highly magical.  IMO letting it get mapped with VM_MAYWRITE
> is asking for trouble, as anything that writes it will COW it, leading
> to strange malfunctions.
> 
>  - vvar can, and has, had IO pages in it.  This means that the actual
> cache types can vary page-to-page in the vvar area, which is not
> something that ordinary files do.

Neither of these are any different than many devices, or various files
in procfs.

> My personal preference is to let them both be real struct file *
> objects (possibly shared between all processes of the same vdso ABI)
> but to prevent user code from ever creating an fd referring to one of
> these files.

Why?  It would help people doing weird things like process snapshotting
or bimodal execution enormously.  We want to share an inode, obviously;
the pointer is another issue.

> Also, if we let the users get an fd pointing to the vdso, then we're
> more or less committing to never having contents in the vdso text that
> vary per-process.  Are we okay with that.

This might be a reason to put these objects in procfs rather than sysfs,
but I have to admit that this seems *extremely* far fetched to me.
Obviously they vary per process in the sense that there are already
several to choose from.  In the case of process-unique vdsos there would
be a large number of them, of course.

	-hpa