linux-kernel - [RFC PATCH] fs/compat_binfmt_elf: Introduce sysctl to disable compat ELF loader

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 16 Sep 2021 14:18:16 +0100
From:   Will Deacon <will@...nel.org>
To:     linux-kernel@...r.kernel.org
Cc:     linux-fsdevel@...r.kernel.org, Will Deacon <will@...nel.org>,
        Al Viro <viro@...iv.linux.org.uk>,
        Andy Lutomirski <luto@...nel.org>,
        Arnd Bergmann <arnd@...db.de>,
        Catalin Marinas <catalin.marinas@....com>,
        Kees Cook <keescook@...omium.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Peter Zijlstra <peterz@...radead.org>
Subject: [RFC PATCH] fs/compat_binfmt_elf: Introduce sysctl to disable compat ELF loader

Distributions such as Android which support a mixture of 32-bit (compat)
and 64-bit (native) tasks necessarily ship with the compat ELF loader
enabled in their kernels. However, as time goes by, an ever-increasing
proportion of userspace consists of native applications and in some cases
32-bit capabilities are starting to be removed from the CPUs altogether.

Inevitably, this means that the compat code becomes somewhat of a
maintenance burden, receiving less testing coverage and exposing an
additional kernel attack surface to userspace during the lengthy
transitional period where some shipping devices require support for
32-bit binaries.

Introduce a new sysctl 'fs.compat-binfmt-elf-enable' to allow the compat
ELF loader to be disabled dynamically on devices where it is not required.
On arm64, this is sufficient to prevent userspace from executing 32-bit
code at all.

Cc: Al Viro <viro@...iv.linux.org.uk>
Cc: Andy Lutomirski <luto@...nel.org>
Cc: Arnd Bergmann <arnd@...db.de>
Cc: Catalin Marinas <catalin.marinas@....com>
Cc: Kees Cook <keescook@...omium.org>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Peter Zijlstra <peterz@...radead.org>
Signed-off-by: Will Deacon <will@...nel.org>
---
 fs/compat_binfmt_elf.c | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

I started off hacking this into the arch code, but then I realised it was
just as easy doing it in the core for everybody to enjoy. Unfortunately,
after talking to Peter, it sounds like it doesn't really help on x86
where userspace can switch to 32-bit without involving the kernel at all.

Thoughts?

diff --git a/fs/compat_binfmt_elf.c b/fs/compat_binfmt_elf.c
index 95e72d271b95..e8ce6c8fff42 100644
--- a/fs/compat_binfmt_elf.c
+++ b/fs/compat_binfmt_elf.c
@@ -15,6 +15,8 @@
  */

 #include <linux/elfcore-compat.h>
+#include <linux/init.h>
+#include <linux/sysctl.h>
 #include <linux/time.h>

 #define ELF_COMPAT	1
@@ -63,7 +65,8 @@
  */

 #undef	elf_check_arch
-#define	elf_check_arch	compat_elf_check_arch
+#define	elf_check_arch(ex)	\
+	(compat_binfmt_elf_enable && compat_elf_check_arch(ex))

 #ifdef	COMPAT_ELF_PLATFORM
 #undef	ELF_PLATFORM
@@ -136,6 +139,25 @@
 #define init_elf_binfmt		init_compat_elf_binfmt
 #define exit_elf_binfmt		exit_compat_elf_binfmt

+static int compat_binfmt_elf_enable = 1;
+
+static struct ctl_table compat_elf_sysctl_table[] = {
+	{
+		.procname	= "compat-binfmt-elf-enable",
+		.data		= &compat_binfmt_elf_enable,
+		.maxlen		= sizeof(int),
+		.mode		= 0644,
+		.proc_handler	= proc_dointvec,
+	},
+	{ },
+};
+
+static int __init compat_elf_init(void)
+{
+	return register_sysctl("fs", compat_elf_sysctl_table) == NULL;
+}
+fs_initcall(compat_elf_init);
+
 /*
  * We share all the actual code with the native (64-bit) version.
  */
-- 
2.33.0.464.g1972c5931b-goog