linux-kernel - Re: [RFC PATCH v3 6/8] x86/pti: don't mark the user PGD with _PAGE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20180111062358.GA14920@1wt.eu>
Date:   Thu, 11 Jan 2018 07:23:59 +0100
From:   Willy Tarreau <w@....eu>
To:     "Woodhouse, David" <dwmw@...zon.co.uk>
Cc:     "torvalds@...ux-foundation.org" <torvalds@...ux-foundation.org>,
        "luto@...nel.org" <luto@...nel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "mingo@...nel.org" <mingo@...nel.org>,
        "peterz@...radead.org" <peterz@...radead.org>,
        "keescook@...omium.org" <keescook@...omium.org>,
        "tglx@...utronix.de" <tglx@...utronix.de>,
        "dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>,
        "jpoimboe@...hat.com" <jpoimboe@...hat.com>,
        "x86@...nel.org" <x86@...nel.org>, "hpa@...or.com" <hpa@...or.com>,
        "brgerst@...il.com" <brgerst@...il.com>,
        "bp@...en8.de" <bp@...en8.de>
Subject: Re: [RFC PATCH v3 6/8] x86/pti: don't mark the user PGD with
 _PAGE_NX.

Hi David,

On Wed, Jan 10, 2018 at 08:28:27PM +0000, Woodhouse, David wrote:
> So... we'd really like to *not* lose the property that KPTI implies
> SMEP-like NX of user space for the kernel.

Don't worry, I find it nice as well and am not trying to kill it. As
mentionned in the "Note" section in the commit message, the current
#ifdef is temporary to make the whole thing work and I'm seeking good
ideas to do it only on unprotected processes. Andy proposed to continue
to do it inconditionally and to catch the page fault upon the first
return to user space and disable it. I like this approach but for now
I don't know how to do it. Another possibility would be that we disable
it when removing the protection on the mm.

Given that most of the discussion till now has been focused on how to
enable/disable the protection I'm leaving this part as-is for now. I'll
change the temporary commit message to make it clearer that it's broken
for now.

Cheers,
Willy