[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <d2f51a90-c5d6-99bd-35b8-f4fded073f95@gmail.com>
Date: Wed, 4 Nov 2020 11:55:57 +0200
From: Topi Miettinen <toiwoton@...il.com>
To: Florian Weimer <fweimer@...hat.com>, Will Deacon <will@...nel.org>
Cc: Mark Brown <broonie@...nel.org>, Szabolcs Nagy <szabolcs.nagy@....com>,
libc-alpha@...rceware.org, Jeremy Linton <jeremy.linton@....com>,
Catalin Marinas <catalin.marinas@....com>,
Mark Rutland <mark.rutland@....com>, Kees Cook <keescook@...omium.org>,
Salvatore Mesoraca <s.mesoraca16@...il.com>,
Lennart Poettering <mzxreary@...inter.de>, linux-kernel@...r.kernel.org,
linux-arm-kernel@...ts.infradead.org, kernel-hardening@...ts.openwall.com,
linux-hardening@...r.kernel.org
Subject: Re: [PATCH 0/4] aarch64: avoid mprotect(PROT_BTI|PROT_EXEC) [BZ
#26831]
On 4.11.2020 11.29, Florian Weimer wrote:
> * Will Deacon:
>
>> Is there real value in this seccomp filter if it only looks at mprotect(),
>> or was it just implemented because it's easy to do and sounds like a good
>> idea?
>
> It seems bogus to me. Everyone will just create alias mappings instead,
> just like they did for the similar SELinux feature. See “Example code
> to avoid execmem violations” in:
>
> <https://www.akkadia.org/drepper/selinux-mem.html>
Also note "But this is very dangerous: programs should never use memory
regions which are writable and executable at the same time. Assuming
that it is really necessary to generate executable code while the
program runs the method employed should be reconsidered."
> As you can see, this reference implementation creates a PROT_WRITE
> mapping aliased to a PROT_EXEC mapping, so it actually reduces security
> compared to something that generates the code in an anonymous mapping
> and calls mprotect to make it executable.
Drepper's methods to avoid SELinux protections are indeed the two ways
(which I'm aware) to also avoid the seccomp filter: by using
memfd_create() and using a file system which writable and executable to
the process to create a new executable file. Both methods can be
eliminated for many system services, memfd_create() with seccomp and
filesystem W&X with mount namespaces.
If a service legitimately needs executable and writable mappings (due to
JIT, trampolines etc), it's easy to disable the filter whenever really
needed with "MemoryDenyWriteExecute=no" (which is the default) in case
of systemd or a TE rule like "allow type_t self:process { execmem };"
for SELinux. But this shouldn't be the default case, since there are
many services which don't need W&X.
I'd also question what is the value of BTI if it can be easily
circumvented by removing PROT_BTI with mprotect()?
-Topi
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
