linux-kernel - [patch V2 0/2] x86/ldt: Prevent LDT inheritance on exec()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20171208223241.367344665@linutronix.de>
Date:   Fri, 08 Dec 2017 23:32:41 +0100
From:   Thomas Gleixner <tglx@...utronix.de>
To:     LKML <linux-kernel@...r.kernel.org>
Cc:     Linus Torvalds <torvalds@...uxfoundation.org>, x86@...nel.org,
        Peter Zijlstra <peterz@...radead.org>,
        Andy Lutomirski <luto@...nel.org>,
        Borislav Petkov <bp@...en8.de>,
        Brian Gerst <brgerst@...il.com>,
        David Laight <David.Laight@...lab.com>,
        Kees Cook <keescook@...omium.org>
Subject: [patch V2 0/2] x86/ldt: Prevent LDT inheritance on exec()

LDT should not be inherited on exec(), only on fork().

To sanitize that, the LDT initialization for a new process must be split
into parts and the actual duplication moved to arch_dup_mmap() which is
only called on fork(). This requires that arch_dup_mmap() gains a return
value.

Changes vs. V1:
  Moved the duplication to arch_dup_mmap() as suggested by Linus.

Thanks,

	tglx
---
 arch/powerpc/include/asm/mmu_context.h     |    5 +++--
 arch/x86/kernel/ldt.c                      |   17 +++++------------
 b/arch/um/include/asm/mmu_context.h        |    3 ++-
 b/arch/unicore32/include/asm/mmu_context.h |    5 +++--
 b/arch/x86/include/asm/mmu_context.h       |   24 ++++++++++++++++--------
 include/asm-generic/mm_hooks.h             |    5 +++--
 kernel/fork.c                              |    3 +--
 tools/testing/selftests/x86/ldt_gdt.c      |    9 +++------
 8 files changed, 36 insertions(+), 35 deletions(-)