[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <11987f-66993b80-1-116be8e0@64320549>
Date: Thu, 18 Jul 2024 16:58:10 +0100
From: "Adrian Ratiu" <adrian.ratiu@...labora.com>
To: "Linus Torvalds" <torvalds@...ux-foundation.org>
Cc: "Kees Cook" <kees@...nel.org>, linux-fsdevel@...r.kernel.org, linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org, kernel@...labora.com, gbiv@...gle.com, inglorion@...gle.com, ajordanr@...gle.com, "Doug Anderson" <dianders@...omium.org>, "Jeff Xu" <jeffxu@...gle.com>, "Jann Horn" <jannh@...gle.com>, "Christian Brauner" <brauner@...nel.org>
Subject: Re: [PATCH] proc: add config to block
FOLL_FORCE in mem writes
On Thursday, July 18, 2024 03:04 EEST, Linus Torvalds <torvalds@...ux-foundation.org> wrote:
> On Wed, 17 Jul 2024 at 15:24, Kees Cook <kees@...nel.org> wrote:
> >
> > > In particular, this patch would make it easy to make that
> > > SECURITY_PROC_MEM_RESTRICT_FOLL_FORCE config option be a "choice"
> > > where you pick "never, ptrace, always" by just changing the rules in
> > > proc_is_ptracing().
> >
> > So the original patch could be reduced to just the single tristate option
> > instead of 3 tristates? I think that would be a decent middle ground,
> > and IIUC, will still provide the coverage Chrome OS is looking for[1].
>
> So here's what I kind of think might be ok.
>
> ENTIRELY UNTESTED! This is more of a "look, something like this,
> perhaps" patch than a real one.
>
> If somebody tests this, and it is ok for Chrome OS, you can consider
> this signed-off-on, but only with actual testing. I might have gotten
> something hroribly wrong.
Thanks for the patch!
I tested it on ChromeOS and it does what it intends, just with two
minor fixes applied:
--- a/security/Kconfig
+++ b/security/Kconfig
-config CONFIG_PROC_MEM_FORCE_PTRACE
+config PROC_MEM_FORCE_PTRACE
.....
-config CONFIG_PROC_MEM_NO_FORCE
+config PROC_MEM_NO_FORCE
As Kees suggested, I'll add a bootparam with a simple __ro_after_init
variable to select this and then send a v2 for review.
Powered by blists - more mailing lists