linux-kernel - Re: [PATCH v7 1/6] seccomp: add a return code to trap to userspace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Wed, 17 Oct 2018 15:21:02 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Tycho Andersen <tycho@...ho.ws>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Linux Containers <containers@...ts.linux-foundation.org>,
        Linux API <linux-api@...r.kernel.org>,
        Andy Lutomirski <luto@...capital.net>,
        Oleg Nesterov <oleg@...hat.com>,
        "Eric W . Biederman" <ebiederm@...ssion.com>,
        "Serge E . Hallyn" <serge@...lyn.com>,
        Christian Brauner <christian.brauner@...ntu.com>,
        Tyler Hicks <tyhicks@...onical.com>,
        Akihiro Suda <suda.akihiro@....ntt.co.jp>,
        Jann Horn <jannh@...gle.com>,
        "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>
Subject: Re: [PATCH v7 1/6] seccomp: add a return code to trap to userspace

On Wed, Oct 17, 2018 at 1:29 PM, Tycho Andersen <tycho@...ho.ws> wrote:
> On Thu, Sep 27, 2018 at 02:31:24PM -0700, Kees Cook wrote:
>> On Thu, Sep 27, 2018 at 8:11 AM, Tycho Andersen <tycho@...ho.ws> wrote:
>> > @@ -60,4 +62,29 @@ struct seccomp_data {
>> >         __u64 args[6];
>> >  };
>> >
>> > +struct seccomp_notif {
>> > +       __u16 len;
>> > +       __u64 id;
>> > +       __u32 pid;
>> > +       __u8 signaled;
>> > +       struct seccomp_data data;
>> > +};
>> > +
>> > +struct seccomp_notif_resp {
>> > +       __u16 len;
>> > +       __u64 id;
>> > +       __s32 error;
>> > +       __s64 val;
>> > +};
>>
>> So, len has to come first, for versioning. However, since it's ahead
>> of a u64, this leaves a struct padding hole. pahole output:
>>
>> struct seccomp_notif {
>>         __u16                      len;                  /*     0     2 */
>>
>>         /* XXX 6 bytes hole, try to pack */
>>
>>         __u64                      id;                   /*     8     8 */
>>         __u32                      pid;                  /*    16     4 */
>>         __u8                       signaled;             /*    20     1 */
>>
>>         /* XXX 3 bytes hole, try to pack */
>>
>>         struct seccomp_data        data;                 /*    24    64 */
>>         /* --- cacheline 1 boundary (64 bytes) was 24 bytes ago --- */
>>
>>         /* size: 88, cachelines: 2, members: 5 */
>>         /* sum members: 79, holes: 2, sum holes: 9 */
>>         /* last cacheline: 24 bytes */
>> };
>> struct seccomp_notif_resp {
>>         __u16                      len;                  /*     0     2 */
>>
>>         /* XXX 6 bytes hole, try to pack */
>>
>>         __u64                      id;                   /*     8     8 */
>>         __s32                      error;                /*    16     4 */
>>
>>         /* XXX 4 bytes hole, try to pack */
>>
>>         __s64                      val;                  /*    24     8 */
>>
>>         /* size: 32, cachelines: 1, members: 4 */
>>         /* sum members: 22, holes: 2, sum holes: 10 */
>>         /* last cacheline: 32 bytes */
>> };
>>
>> How about making len u32, and moving pid and error above "id"? This
>> leaves a hole after signaled, so changing "len" won't be sufficient
>> for versioning here. Perhaps move it after data?
>
> Just to confirm my understanding; I've got these as:
>
> struct seccomp_notif {
>         __u32                      len;                  /*     0     4 */
>         __u32                      pid;                  /*     4     4 */
>         __u64                      id;                   /*     8     8 */
>         __u8                       signaled;             /*    16     1 */
>
>         /* XXX 7 bytes hole, try to pack */
>
>         struct seccomp_data        data;                 /*    24    64 */
>         /* --- cacheline 1 boundary (64 bytes) was 24 bytes ago --- */
>
>         /* size: 88, cachelines: 2, members: 5 */
>         /* sum members: 81, holes: 1, sum holes: 7 */
>         /* last cacheline: 24 bytes */
> };
> struct seccomp_notif_resp {
>         __u32                      len;                  /*     0     4 */
>         __s32                      error;                /*     4     4 */
>         __u64                      id;                   /*     8     8 */
>         __s64                      val;                  /*    16     8 */
>
>         /* size: 24, cachelines: 1, members: 4 */
>         /* last cacheline: 24 bytes */
> };
>
> in the next version. Since the structure has no padding at the end of
> it, I think the Right Thing will happen. Note that this is slightly
> different than what Kees suggested, if I add signaled after data, then
> I end up with:
>
> struct seccomp_notif {
>         __u32                      len;                  /*     0     4 */
>         __u32                      pid;                  /*     4     4 */
>         __u64                      id;                   /*     8     8 */
>         struct seccomp_data        data;                 /*    16    64 */
>         /* --- cacheline 1 boundary (64 bytes) was 16 bytes ago --- */
>         __u8                       signaled;             /*    80     1 */
>
>         /* size: 88, cachelines: 2, members: 5 */
>         /* padding: 7 */
>         /* last cacheline: 24 bytes */
> };
>
> which I think will have the versioning problem if the next member
> introduces is < 7 bytes.

It'll be a problem in either place. What I was thinking was that
specific versioning is required instead of just length.

-Kees

-- 
Kees Cook
Pixel Security