[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAHC9VhRkawYWQN0UY2R68Qn4pRijpXgu97YOr6XPA7Ls0-zQcA@mail.gmail.com>
Date: Fri, 15 Mar 2024 16:22:39 -0400
From: Paul Moore <paul@...l-moore.com>
To: Christian Göttsche <cgzones@...glemail.com>
Cc: linux-security-module@...r.kernel.org,
Eric Biederman <ebiederm@...ssion.com>, Kees Cook <keescook@...omium.org>,
Alexander Viro <viro@...iv.linux.org.uk>, Christian Brauner <brauner@...nel.org>, Jan Kara <jack@...e.cz>,
James Morris <jmorris@...ei.org>, "Serge E. Hallyn" <serge@...lyn.com>,
Khadija Kamran <kamrankhadijadj@...il.com>, Andrii Nakryiko <andrii@...nel.org>,
Casey Schaufler <casey@...aufler-ca.com>, Alexei Starovoitov <ast@...nel.org>,
Ondrej Mosnacek <omosnace@...hat.com>, Roberto Sassu <roberto.sassu@...wei.com>,
Alfred Piccioni <alpic@...gle.com>, John Johansen <john.johansen@...onical.com>, linux-mm@...ck.org,
linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [RFC PATCH 1/2] lsm: introduce new hook security_vm_execstack
On Fri, Mar 15, 2024 at 2:10 PM Christian Göttsche
<cgzones@...glemail.com> wrote:
>
> Add a new hook guarding instantiations of programs with executable
> stack. They are being warned about since commit 47a2ebb7f505 ("execve:
> warn if process starts with executable stack"). Lets give LSMs the
> ability to control their presence on a per application basis.
>
> Signed-off-by: Christian Göttsche <cgzones@...glemail.com>
> ---
> fs/exec.c | 4 ++++
> include/linux/lsm_hook_defs.h | 1 +
> include/linux/security.h | 6 ++++++
> security/security.c | 13 +++++++++++++
> 4 files changed, 24 insertions(+)
Looking at the commit referenced above, I'm guessing the existing
security_file_mprotect() hook doesn't catch this?
> diff --git a/fs/exec.c b/fs/exec.c
> index 8cdd5b2dd09c..e6f9e980c6b1 100644
> --- a/fs/exec.c
> +++ b/fs/exec.c
> @@ -829,6 +829,10 @@ int setup_arg_pages(struct linux_binprm *bprm,
> BUG_ON(prev != vma);
>
> if (unlikely(vm_flags & VM_EXEC)) {
> + ret = security_vm_execstack();
> + if (ret)
> + goto out_unlock;
> +
> pr_warn_once("process '%pD4' started with executable stack\n",
> bprm->file);
> }
Instead of creating a new LSM hook, have you considered calling the
existing security_file_mprotect() hook? The existing LSM controls
there may not be a great fit in this case, but I'd like to hear if
you've tried that, and if you have, what made you decide a new hook
was the better option?
--
paul-moore.com
Powered by blists - more mailing lists