musl - Re: [PATCH v2] x86: Implement arch_prctl(ARCH_VSYSCALL

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <87o8520wvd.fsf@oldenburg.str.redhat.com>
Date: Mon, 27 Dec 2021 18:40:38 +0100
From: Florian Weimer <fweimer@...hat.com>
To: Andrei Vagin <avagin@...il.com>
Cc: Andy Lutomirski <luto@...nel.org>,  linux-arch@...r.kernel.org,  Linux
 API <linux-api@...r.kernel.org>,  linux-x86_64@...r.kernel.org,
  kernel-hardening@...ts.openwall.com,  linux-mm@...ck.org,  "the arch/x86
 maintainers" <x86@...nel.org>,  musl@...ts.openwall.com,
  libc-alpha@...rceware.org,  LKML <linux-kernel@...r.kernel.org>,  Dave
 Hansen <dave.hansen@...el.com>,  Kees Cook <keescook@...omium.org>
Subject: Re: [PATCH v2] x86: Implement arch_prctl(ARCH_VSYSCALL_CONTROL) to
 disable vsyscall

* Andrei Vagin:

>> diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
>> index fd2ee9408e91..8eb3bcf2cedf 100644
>> --- a/arch/x86/entry/vsyscall/vsyscall_64.c
>> +++ b/arch/x86/entry/vsyscall/vsyscall_64.c
>> @@ -174,6 +174,12 @@ bool emulate_vsyscall(unsigned long error_code,
>>
>>         tsk = current;
>>
>> +       if (tsk->mm->context.vsyscall_disabled) {
>> +               warn_bad_vsyscall(KERN_WARNING, regs,
>> +                                 "vsyscall after lockout (exploit attempt?)");
>
> I don't think that we need this warning message. If we disable
> vsyscall, its address range is not differ from other addresses around
> and has to be handled the same way. For example, gVisor or any other
> sandbox engines may want to emulate vsyscall, but the kernel log will
> be full of such messages.

But with vsyscall=none, such messages are already printed.  That's why I
added the warning for the lockout case as well.

>> diff --git a/tools/testing/selftests/x86/vsyscall_control.c b/tools/testing/selftests/x86/vsyscall_control.c
>> new file mode 100644
>> index 000000000000..ee966f936c89
>> --- /dev/null
>> +++ b/tools/testing/selftests/x86/vsyscall_control.c
>
> I would move the test in a separate patch...

I can do that if it simplifies matters.

Thanks,
Florian

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.