linux-kernel - Re: [PATCH] sysctl: Delete the code of sys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <21a9d711-af31-f7bd-1143-af2ca5b77ba9@huawei.com>
Date:   Wed, 10 Jun 2020 22:17:49 +0800
From:   Xiaoming Ni <nixiaoming@...wei.com>
To:     Kees Cook <keescook@...omium.org>
CC:     <ebiederm@...ssion.com>, <ak@...ux.intel.com>,
        <alex.huangjianhui@...wei.com>, <linzichang@...wei.com>,
        <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] sysctl: Delete the code of sys_sysctl

On 2020/6/9 23:40, Kees Cook wrote:
> On Tue, Jun 09, 2020 at 02:20:05PM +0800, Xiaoming Ni wrote:
>> Since the commit 61a47c1ad3a4dc ("sysctl: Remove the sysctl system call"),
>> sys_sysctl has lost its actual role: any input can only return an error.
>>
>> Delete the code and return -ENOSYS directly at the function entry
>>
>> Signed-off-by: Xiaoming Ni <nixiaoming@...wei.com>
> 
> Looks right to me.
> 
> Reviewed-by: Kees Cook <keescook@...omium.org>
> 
> Should this be taken a step further and just remove the syscall entirely
> and update the per-arch tables with the ENOSYS hole?
> 
> -Kees
> 
Searching for git log, I found a commit record that deleted syscall:
commit f5b94099739722 ("All Arch: remove linkage for sys_nfsservctl 
system call"). Could I use sys_ni_syscall to implement the hole as in 
the example here?
E.g:
diff --git a/arch/arm/tools/syscall.tbl b/arch/arm/tools/syscall.tbl
index 7b3832d..f36fda6 100644
--- a/arch/arm/tools/syscall.tbl
+++ b/arch/arm/tools/syscall.tbl
@@ -162,7 +162,7 @@
  146    common  writev                  sys_writev
  147    common  getsid                  sys_getsid
  148    common  fdatasync               sys_fdatasync
-149        common  _sysctl                 sys_sysctl
+149  common  _sysctl                 sys_ni_syscall
  150    common  mlock                   sys_mlock
  151    common  munlock                 sys_munlock
  152    common  mlockall                sys_mlockall
diff --git a/arch/arm64/include/asm/unistd32.h 
b/arch/arm64/include/asm/unistd32.h
index f8dafe9..ca41bb7 100644
--- a/arch/arm64/include/asm/unistd32.h
+++ b/arch/arm64/include/asm/unistd32.h
@@ -308,8 +308,8 @@
  __SYSCALL(__NR_getsid, sys_getsid)
  #define __NR_fdatasync 148
  __SYSCALL(__NR_fdatasync, sys_fdatasync)
-#define __NR__sysctl 149
-__SYSCALL(__NR__sysctl, compat_sys_sysctl)
+                 /* 149 was sys_sysctl */
+__SYSCALL(149, sys_ni_syscall)
  #define __NR_mlock 150
  __SYSCALL(__NR_mlock, sys_mlock)
  #define __NR_munlock 151


In this case, I need to modify a lot of code in v2. Can I add 
"Reviewed-by: Kees Cook <keescook@...omium.org>" to the v2 patch?

Thanks
Xiaoming Ni