linux-kernel - Re: [PATCH] arm64: Preventing READ_IMPLIES

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20170425165320.GT24484@arm.com>
Date:   Tue, 25 Apr 2017 17:53:21 +0100
From:   Will Deacon <will.deacon@....com>
To:     "dongbo (E)" <dongbo4@...wei.com>
Cc:     catalin.marinas@....com,
        arm-mail-list <linux-arm-kernel@...ts.infradead.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Linuxarm <linuxarm@...wei.com>
Subject: Re: [PATCH] arm64: Preventing READ_IMPLIES_EXEC propagation

On Tue, Apr 25, 2017 at 02:11:29PM +0800, dongbo (E) wrote:
> From: Dong Bo <dongbo4@...wei.com>
> 
> Once the READ_IMPLIES_EXEC flag is set on arm64, the flag is
> propagated to its child processes, even the ELF files are
> marked as not requiring executable stack.
> 
> Signed-off-by: Dong Bo <dongbo4@...wei.com>
> ---
>  arch/arm64/include/asm/elf.h | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
> index 5d17004..5941e7f 100644
> --- a/arch/arm64/include/asm/elf.h
> +++ b/arch/arm64/include/asm/elf.h
> @@ -142,6 +142,7 @@
>  ({									\
>  	clear_bit(TIF_32BIT, &current->mm->context.flags);		\
>  	clear_thread_flag(TIF_32BIT);					\
> +	current->personality &= ~READ_IMPLIES_EXEC;			\
>  })
>   /* update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT entries changes */

This looks good to me:

Acked-by: Will Deacon <will.deacon@....com>

We might also want a comment in the compat code to say that we inherit
the flag to follow the arch/arm/ behaviour.

Anyway, I'd like to see this sit in -next for a bit, so would rather hold
this off until 4.12.

Will