linux-kernel - Re: [GIT PULL] execve updates for v6.13-rc1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Zz91LyHzxxOLEma_@kawka3.in.waw.pl>
Date: Thu, 21 Nov 2024 18:00:15 +0000
From: Zbigniew Jędrzejewski-Szmek <zbyszek@...waw.pl>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: "Eric W. Biederman" <ebiederm@...ssion.com>,
	Kees Cook <kees@...nel.org>, linux-kernel@...r.kernel.org,
	Alexander Viro <viro@...iv.linux.org.uk>,
	Christophe JAILLET <christophe.jaillet@...adoo.fr>,
	Dan Carpenter <dan.carpenter@...aro.org>,
	Nir Lichtman <nir@...htman.org>,
	syzbot+03e1af5c332f7e0eb84b@...kaller.appspotmail.com,
	Tycho Andersen <tandersen@...flix.com>,
	Vegard Nossum <vegard.nossum@...cle.com>
Subject: Re: [GIT PULL] execve updates for v6.13-rc1

On Thu, Nov 21, 2024 at 09:28:09AM -0800, Linus Torvalds wrote:
> On Thu, 21 Nov 2024 at 09:22, Zbigniew Jędrzejewski-Szmek
> <zbyszek@...waw.pl> wrote:
> >
> > It'll "break userspace" in the sense the the resulting program name
> > visible in /proc/self/{comm,stat,status} would be different than the
> > expected value. Currently userspace is not using fexecve because this
> > string is "just garbage". We'd very much like to start using fexecve,
> > but we cannot do this (in the general case) if that'll result in a
> > changed program name. If we change the value from the current
> > (garbage) value to something that doesn't provide identical behaviour
> > between execve and fexecve, fexecve will unused.
> 
> Well, then you had better not use fexecve(), because that "identical
> behavior" is fundamentally impossible.

Identical — as far as the callee is concerned.
Basically, we'd like to switch the execve() that we use in systemd
to start everything with fexecve(), but this should be invisible to
both the programs that are started and users who call ps/pgrep/….

> The thing is, "argv[0]" can - and will be - complete garbage. Yes,
> it's *often* the same as the filename, but there is actually zero
> guarantee of that. It can be any random thing - it's literally just a
> user space argument.

Eh, no. I think you're trying to say that argv[0] is user-controlled.
Sure, this is a feature. Systemd even exposes this as
  ExecStart=@...gram argv0 argv1 argv2…
It can be overridden, but it's not "garbage".

> And the dentry name *will* be the name of the underlying executable.
> Again, it is *often* the same as the filename, but symlinks have
> already been brought up as an example when it isn't.
Exactly. This is the crux of the problem. We think that fd-based
syscalls are great, and would like to use fexecve as a drop-in
replacement, but currently can't. I would love to tell the rest
of the userspace to stop ever looking at COMM, but, as you very
well know, once an API is made public and widely used, it's very
hard to redefine it.

> See? There is no single solution, but at least the dentry name is a
> *reliable* thing, not a random garbage thing passed in by user space.

Reliable – yes. Useful – no.

Zbyszek