| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 30 Nov 2017 10:09:57 +0000
From: James Hogan <james.hogan@...s.com>
To: Miodrag Dinic <Miodrag.Dinic@...s.com>
CC: David Daney <ddaney@...iumnetworks.com>,
Aleksandar Markovic <aleksandar.markovic@...rk.com>,
"linux-mips@...ux-mips.org" <linux-mips@...ux-mips.org>,
Aleksandar Markovic <Aleksandar.Markovic@...s.com>,
Andrew Morton <akpm@...ux-foundation.org>,
DengCheng Zhu <DengCheng.Zhu@...s.com>,
Ding Tianhong <dingtianhong@...wei.com>,
Douglas Leung <Douglas.Leung@...s.com>,
Frederic Weisbecker <frederic@...nel.org>,
Goran Ferenc <Goran.Ferenc@...s.com>,
Ingo Molnar <mingo@...nel.org>,
James Cowgill <James.Cowgill@...tec.com>,
Jonathan Corbet <corbet@....net>,
"linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
Marc Zyngier <marc.zyngier@....com>,
Matt Redfearn <Matt.Redfearn@...s.com>,
Mimi Zohar <zohar@...ux.vnet.ibm.com>,
Paul Burton <Paul.Burton@...s.com>,
"Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>,
Petar Jovanovic <Petar.Jovanovic@...s.com>,
Raghu Gandham <Raghu.Gandham@...s.com>,
Ralf Baechle <ralf@...ux-mips.org>,
Thomas Gleixner <tglx@...utronix.de>,
Tom Saeger <tom.saeger@...cle.com>
Subject: Re: [PATCH v2] MIPS: Add nonxstack=on|off kernel parameter
On Thu, Nov 30, 2017 at 09:34:15AM +0000, Miodrag Dinic wrote:
> Hi David,
>
> Sorry for a late response, please find answers in-lined:
>
> > > If this parameter is omitted, kernel behavior remains the same as it
> > > was before this patch is applied.
> >
> > Do other architectures have a similar hack?
> >
> > If arm{,64} and x86 don't need this, what would make MIPS so special
> > that we have to carry this around?
>
> Yes, there are similar workarounds. Just a couple lines above
> nonxstack description in the documentation there are :
> noexec [IA-64]
>
> noexec [X86]
> On X86-32 available only on PAE configured kernels.
> noexec=on: enable non-executable mappings (default)
> noexec=off: disable non-executable mappings
> ...
>
> noexec32 [X86-64]
> This affects only 32-bit executables.
> noexec32=on: enable non-executable mappings (default)
> read doesn't imply executable mappings
> noexec32=off: disable non-executable mappings
> read implies executable mappings
>
> > >
> > > This functionality is convenient during debugging and is especially
> > > useful for Android development where non-exec stack is required.
> >
> > Why not just set the PT_GNU_STACK flags correctly in the first place?
>
> We do have PT_GNU_STACK flags set correctly, this feature is required to
> workaround CPU revisions which do not have RIXI support.
RIXI support can be discovered programatically from CP0_Config3.RXI
(cpu_has_rixi in asm/cpu-features.h), so I don't follow why CPUs without
RIXI would require a kernel parameter.
Cheers
James
>
> Kind regards,
> Miodrag
> ________________________________________
> From: David Daney [ddaney@...iumnetworks.com]
> Sent: Tuesday, November 21, 2017 9:53 PM
> To: Aleksandar Markovic; linux-mips@...ux-mips.org
> Cc: Miodrag Dinic; Aleksandar Markovic; Andrew Morton; DengCheng Zhu; Ding Tianhong; Douglas Leung; Frederic Weisbecker; Goran Ferenc; Ingo Molnar; James Cowgill; James Hogan; Jonathan Corbet; linux-doc@...r.kernel.org; linux-kernel@...r.kernel.org; Marc Zyngier; Matt Redfearn; Mimi Zohar; Paul Burton; Paul E. McKenney; Petar Jovanovic; Raghu Gandham; Ralf Baechle; Thomas Gleixner; Tom Saeger
> Subject: Re: [PATCH v2] MIPS: Add nonxstack=on|off kernel parameter
>
> On 11/21/2017 05:56 AM, Aleksandar Markovic wrote:
> > From: Miodrag Dinic <miodrag.dinic@...s.com>
> >
> > Add a new kernel parameter to override the default behavior related
> > to the decision whether to set up stack as non-executable in function
> > mips_elf_read_implies_exec().
> >
> > The new parameter is used to control non executable stack and heap,
> > regardless of PT_GNU_STACK entry. This does apply to both stack and
> > heap, despite the name.
> >
> > Allowed values:
> >
> > nonxstack=on Force non-exec stack & heap
> > nonxstack=off Force executable stack & heap
> >
> > If this parameter is omitted, kernel behavior remains the same as it
> > was before this patch is applied.
>
> Do other architectures have a similar hack?
>
> If arm{,64} and x86 don't need this, what would make MIPS so special
> that we have to carry this around?
>
>
> >
> > This functionality is convenient during debugging and is especially
> > useful for Android development where non-exec stack is required.
>
> Why not just set the PT_GNU_STACK flags correctly in the first place?
>
> >
> > Signed-off-by: Miodrag Dinic <miodrag.dinic@...s.com>
> > Signed-off-by: Aleksandar Markovic <aleksandar.markovic@...s.com>
> > ---
> > Documentation/admin-guide/kernel-parameters.txt | 11 +++++++
> > arch/mips/kernel/elf.c | 39 +++++++++++++++++++++++++
> > 2 files changed, 50 insertions(+)
> >
> > diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
> > index b74e133..99464ee 100644
> > --- a/Documentation/admin-guide/kernel-parameters.txt
> > +++ b/Documentation/admin-guide/kernel-parameters.txt
> > @@ -2614,6 +2614,17 @@
> > noexec32=off: disable non-executable mappings
> > read implies executable mappings
> >
> > + nonxstack [MIPS]
> > + Force setting up stack and heap as non-executable or
> > + executable regardless of PT_GNU_STACK entry. Both
> > + stack and heap are affected, despite the name. Valid
> > + arguments: on, off.
> > + nonxstack=on: Force non-executable stack and heap
> > + nonxstack=off: Force executable stack and heap
> > + If ommited, stack and heap will or will not be set
> > + up as non-executable depending on PT_GNU_STACK
> > + entry and possibly other factors.
> > +
> > nofpu [MIPS,SH] Disable hardware FPU at boot time.
> >
> > nofxsr [BUGS=X86-32] Disables x86 floating point extended
> > diff --git a/arch/mips/kernel/elf.c b/arch/mips/kernel/elf.c
> > index 731325a..28ef7f3 100644
> > --- a/arch/mips/kernel/elf.c
> > +++ b/arch/mips/kernel/elf.c
> > @@ -326,8 +326,47 @@ void mips_set_personality_nan(struct arch_elf_state *state)
> > }
> > }
> >
> > +static int nonxstack = EXSTACK_DEFAULT;
> > +
> > +/*
> > + * kernel parameter: nonxstack=on|off
> > + *
> > + * Force setting up stack and heap as non-executable or
> > + * executable regardless of PT_GNU_STACK entry. Both
> > + * stack and heap are affected, despite the name. Valid
> > + * arguments: on, off.
> > + *
> > + * nonxstack=on: Force non-executable stack and heap
> > + * nonxstack=off: Force executable stack and heap
> > + *
> > + * If ommited, stack and heap will or will not be set
> > + * up as non-executable depending on PT_GNU_STACK
> > + * entry and possibly other factors.
> > + */
> > +static int __init nonxstack_setup(char *str)
> > +{
> > + if (!strcmp(str, "on"))
> > + nonxstack = EXSTACK_DISABLE_X;
> > + else if (!strcmp(str, "off"))
> > + nonxstack = EXSTACK_ENABLE_X;
> > + else
> > + pr_err("Malformed nonxstack format! nonxstack=on|off\n");
> > +
> > + return 1;
> > +}
> > +__setup("nonxstack=", nonxstack_setup);
> > +
> > int mips_elf_read_implies_exec(void *elf_ex, int exstack)
> > {
> > + switch (nonxstack) {
> > + case EXSTACK_DISABLE_X:
> > + return 0;
> > + case EXSTACK_ENABLE_X:
> > + return 1;
> > + default:
> > + break;
> > + }
> > +
> > if (exstack != EXSTACK_DISABLE_X) {
> > /* The binary doesn't request a non-executable stack */
> > return 1;
> >
>
>
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists