linux-kernel - Re: [RFC PATCH v19 1/5] exec: Add a new AT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87ed82283l.fsf@oldenburg.str.redhat.com>
Date: Tue, 09 Jul 2024 12:05:50 +0200
From: Florian Weimer <fweimer@...hat.com>
To: Mickaël Salaün <mic@...ikod.net>
Cc: Jeff Xu <jeffxu@...gle.com>,  Al Viro <viro@...iv.linux.org.uk>,
  Christian Brauner <brauner@...nel.org>,  Kees Cook
 <keescook@...omium.org>,  Linus Torvalds <torvalds@...ux-foundation.org>,
  Paul Moore <paul@...l-moore.com>,  Theodore Ts'o <tytso@....edu>,
  Alejandro Colomar <alx@...nel.org>,  Aleksa Sarai <cyphar@...har.com>,
  Andrew Morton <akpm@...ux-foundation.org>,  Andy Lutomirski
 <luto@...nel.org>,  Arnd Bergmann <arnd@...db.de>,  Casey Schaufler
 <casey@...aufler-ca.com>,  Christian Heimes <christian@...hon.org>,
  Dmitry Vyukov <dvyukov@...gle.com>,  Eric Biggers <ebiggers@...nel.org>,
  Eric Chiang <ericchiang@...gle.com>,  Fan Wu <wufan@...ux.microsoft.com>,
  Geert Uytterhoeven <geert@...ux-m68k.org>,  James Morris
 <jamorris@...ux.microsoft.com>,  Jan Kara <jack@...e.cz>,  Jann Horn
 <jannh@...gle.com>,  Jonathan Corbet <corbet@....net>,  Jordan R Abrahams
 <ajordanr@...gle.com>,  Lakshmi Ramasubramanian
 <nramas@...ux.microsoft.com>,  Luca Boccassi <bluca@...ian.org>,  Luis
 Chamberlain <mcgrof@...nel.org>,  "Madhavan T . Venkataraman"
 <madvenka@...ux.microsoft.com>,  Matt Bobrowski
 <mattbobrowski@...gle.com>,  Matthew Garrett <mjg59@...f.ucam.org>,
  Matthew Wilcox <willy@...radead.org>,  Miklos Szeredi
 <mszeredi@...hat.com>,  Mimi Zohar <zohar@...ux.ibm.com>,  Nicolas
 Bouchinet <nicolas.bouchinet@....gouv.fr>,  Scott Shell
 <scottsh@...rosoft.com>,  Shuah Khan <shuah@...nel.org>,  Stephen Rothwell
 <sfr@...b.auug.org.au>,  Steve Dower <steve.dower@...hon.org>,  Steve
 Grubb <sgrubb@...hat.com>,  Thibaut Sautereau
 <thibaut.sautereau@....gouv.fr>,  Vincent Strubel
 <vincent.strubel@....gouv.fr>,  Xiaoming Ni <nixiaoming@...wei.com>,  Yin
 Fengwei <fengwei.yin@...el.com>,  kernel-hardening@...ts.openwall.com,
  linux-api@...r.kernel.org,  linux-fsdevel@...r.kernel.org,
  linux-integrity@...r.kernel.org,  linux-kernel@...r.kernel.org,
  linux-security-module@...r.kernel.org
Subject: Re: [RFC PATCH v19 1/5] exec: Add a new AT_CHECK flag to execveat(2)

* Mickaël Salaün:

>> > If we want to avoid that, we could have an agreed-upon error code which
>> > the LSM can signal that it'll never fail AT_CHECK checks, so we only
>> > have to perform the extra system call once.
>
> I'm not sure to follow.  Either we check executable code or we don't,
> but it doesn't make sense to only check some parts (except for migration
> of user space code in a system, which is one purpose of the securebits
> added with the next patch).
>
> The idea with AT_CHECK is to unconditionnaly check executable right the
> same way it is checked when a file is executed.  User space can decide
> to check that or not according to its policy (i.e. securebits).

I meant it purely as a performance optimization, to skip future system
calls if we know they won't provide any useful information for this
process.  In the grand scheme of things, the extra system call probably
does not matter because we already have to do costly things like mmap.

Thanks,
Florian