From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 13CB2C10F15 for ; Thu, 25 Apr 2024 22:42:36 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 73A666B0082; Thu, 25 Apr 2024 18:42:36 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 6EA5A6B0085; Thu, 25 Apr 2024 18:42:36 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 5D99C6B0088; Thu, 25 Apr 2024 18:42:36 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 4175F6B0082 for ; Thu, 25 Apr 2024 18:42:36 -0400 (EDT) Received: from smtpin06.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 0CEB080635 for ; Thu, 25 Apr 2024 22:42:36 +0000 (UTC) X-FDA: 82049529912.06.3F31506 Received: from mail-pj1-f49.google.com (mail-pj1-f49.google.com [209.85.216.49]) by imf26.hostedemail.com (Postfix) with ESMTP id 2912914000F for ; Thu, 25 Apr 2024 22:42:32 +0000 (UTC) Authentication-Results: imf26.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=R+AELJml; spf=pass (imf26.hostedemail.com: domain of keescook@chromium.org designates 209.85.216.49 as permitted sender) smtp.mailfrom=keescook@chromium.org; dmarc=pass (policy=none) header.from=chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1714084953; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=XQMgEUshXi0n6VyMw97AYUenmOeWDaHW3E9fbmg8+bo=; b=8EKciweolYeiWFzJJVvA/sjDpJseABLRqurwNFrff2qbYJHx+S2fBrw0iw8Q9rakZjy+eE L68SASyR2f0qqFVmJM28oIdSO+S7KzWUqWGvzRCYkTxwQl44k331icO3rqVZ54moLWtakX nJhObtiWz0pcGjGA4ibslVT3cFcXNyA= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1714084953; a=rsa-sha256; cv=none; b=zl9tC7mqAibedPD4xgfO7Ex6op4QlwPA/1trF6pdvM619vtnXm6mg7RY9sDAIp7zPyphj7 KvJysE4r4qkfO4aqEgw3hpUceSBvrXeF1d9xh7tYD9L5nAgEhoEVSoExVrNIYr2wSLs2jJ xVBTDVXRNGojHlU2uI5sVT+2ieIkABA= ARC-Authentication-Results: i=1; imf26.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=R+AELJml; spf=pass (imf26.hostedemail.com: domain of keescook@chromium.org designates 209.85.216.49 as permitted sender) smtp.mailfrom=keescook@chromium.org; dmarc=pass (policy=none) header.from=chromium.org Received: by mail-pj1-f49.google.com with SMTP id 98e67ed59e1d1-2a58209b159so1312016a91.3 for ; Thu, 25 Apr 2024 15:42:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1714084952; x=1714689752; darn=kvack.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=XQMgEUshXi0n6VyMw97AYUenmOeWDaHW3E9fbmg8+bo=; b=R+AELJmlhpWh2JUHAS9OJkn3HRZemq00q4m7jdKZFIKHNbwds7/Oel6VHFXMQQTV3k zjlEn1vzz7jyGVKI4mrFwFMwWANS15etVL2ShJeR0eWH2eEyq8MlgURjKy4vGeFXZyJO mUn+Y5mxqLl7gZj+1vFPSfaqr27UsUzL2+NMw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714084952; x=1714689752; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=XQMgEUshXi0n6VyMw97AYUenmOeWDaHW3E9fbmg8+bo=; b=TSaGpB0eeQtvmnAB7mvVKotadUm3cjKjIM9oxJJwbrDl+d6AWTx1bdSzi0CRnOSdt/ JytSSDw2dRKREmPzT2N1xqiaSzDE8z+KTGmUqYYn+Ey8Cqnv9eEXThzQFzPUcdm/V+wn WfrMiVEotBbHbiNZWFDpVcS6xpRFlN7him8Nf8n+zsLm0dCrRYE/ltfTAooHnFov0W/x J4HnFVY2DM/eTTXh0AHUNqIEbPID31I6UF8E5MxCPNAFo+mQTHyKvkk0Pk7e5SvWgne5 6/hoqgFc9oh3ZCaU96OpxRHT2Ib+XhhQC8CMvonvxTNeKA/mkzm3QnoxEEsL+VovkEbe szDQ== X-Forwarded-Encrypted: i=1; AJvYcCUVBXsxQBMl6G0Y9M1VCeFij1UQpYiYneIiyytCMRZONSsN9OcNHIK3W0PNXQHPK55Pmj7ROKgbNLZF3/YPt/8hyEI= X-Gm-Message-State: AOJu0YzFJwDLGuvOXZnAwza2pKhg/aFq3v27PJhzF60wb9oIXRZSinBn rTndu+fTXJ8npQ1GnsMhTJp2rzlyq/gsg/imIZHioAeH60Ak+djHVF5BRUNXlw== X-Google-Smtp-Source: AGHT+IGiOwEiR2ZvU3hCBIL/uaLOVZwKzUQaJqt9cMHM0i4zfElGPrIWI4AiHuO056FHOxcHNtXevQ== X-Received: by 2002:a17:90b:4f8f:b0:2ae:b8df:89e7 with SMTP id qe15-20020a17090b4f8f00b002aeb8df89e7mr1054767pjb.38.1714084951948; Thu, 25 Apr 2024 15:42:31 -0700 (PDT) Received: from www.outflux.net ([198.0.35.241]) by smtp.gmail.com with ESMTPSA id x16-20020a17090a531000b002a537abb536sm15111032pjh.57.2024.04.25.15.42.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Apr 2024 15:42:31 -0700 (PDT) Date: Thu, 25 Apr 2024 15:42:30 -0700 From: Kees Cook To: Kent Overstreet Cc: Matthew Wilcox , Suren Baghdasaryan , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: Re: [PATCH] alloc_tag: Tighten file permissions on /proc/allocinfo Message-ID: <202404251532.F8860056AE@keescook> References: <20240425200844.work.184-kees@kernel.org> <64cngpnwyav4odustofs6hgsh7htpc5nu23tx4lb3vxaltmqf2@sxn63f2gg4gu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <64cngpnwyav4odustofs6hgsh7htpc5nu23tx4lb3vxaltmqf2@sxn63f2gg4gu> X-Rspamd-Server: rspam12 X-Rspamd-Queue-Id: 2912914000F X-Rspam-User: X-Stat-Signature: shpokdq91ab5z4odx7smwihhtky7oe99 X-HE-Tag: 1714084952-436293 X-HE-Meta: U2FsdGVkX1/9BiVP9w6swFd3w5KXFmdMtoqCQQacm2i7VUIMP/ULvROUOUqFGpaUHImpli2TTvvqZlTLj+EfxOihZbhZyZZ5kFvSjH/Hqs3NtJMlt1M2805iDKu2RVvc3Ch3fH72coLE90du/dCzWHeNAFyiteUYn/oB+zeL60vwv33ecUkfGWfngHlJ3T5QucV68x5x/sSKntgK840Zb21ksodyMsz7cqAkcj6D2G+us0bBxqZ7azC000dJpHhbecrEsfEgd1EN/jx9l9hmoIEQ7JoRSJ/68pq30dnX0Bm+NYUQ2rIuZieQhAOpW6LSI6DxMcm2oD+2ke+p20B1Np51s5EsWrUf41u1/cTHjXMWYu/tW+7QJhQATKV77n8Dkus9JErOFxo+InaVTu3WAsGNGe0DHcbOcEyKsoyWz8Mtu1cRcrgJ9q4eiUiWgj/o9aXjDqgX6Fk2lCItmUHiPFW/wiJ1hnrNV/6a1dm/H4FAzYVv0ue/nLgKnlQvcbfHT48wuTU+MCO0Q5ynoJIgxrJmKfw9mKD3LNWoQ8YOVEPZaDmMD/t/e7draIBE2n2aFqVFn1Dbdp88TkhFEE2DxeGtwYAXB30/1lOgEHaXv2SV/riUDV+PYtIbkIDyQ3KT7P2NbZtlopPk7YLxobJUdlTKvvxxdyh1EtwO/Bn1Bu57zK9/a+k2OZtsJmPiW3faOfQi5hddDxsRQf8z8qeiZkuDRhTkRbi+j0Duv/PdFAPxo0KktgE3QMSeQ/4lT/nsEFl+EKVlQFen0Qje7Gk1gV8EKIjjS6317SRh8Y1svmH5EBY2gT11UwF4rdjc1DfLiALNH8Uiu0hXSfetqSQv+05JjwskfaksLQHx/8kKP6z2ZIzJey+KKaHiD3SXpm9kBAGfdM5U5Kg7huto4Mj8E/nobl+zPHOKyAjB8hlY8Rtx/u58FbMquqczTouptVDJT9AdGJ8RBm638N+uJhx m/21ARQg bRE6tH+BdNPw1iQp4AaRhlMQw4XPy+kDY+OkApT3JFsDGcJRLyWroJqmIaVvM9bDktXi+FgEjGIPfIu+NPTUdNhWA7RLa0UUoUp/f5V9toXcfUuvTIlv1sjtDOQ3SiDMWAXYQ4pJdaW2RGxynHTMmt+fxqqqlZyYd4zTzRh0gBMkChTR+Pj4jGnfRBSQq2oSw228BEIfeNtL5BZWhjPrr6xh+6Bf3BDHovxYMa1DfQGw7lqbQWnOb3kPQAEwytNR+dC1KnCFmwwmzNL3MvZMHKduSHk0CeBO38aFRca1iw3F+4uVHrkstTwUO528voba+8TiCk5+0Yt5O6r161OUAv3UwysLNKzuFdjNkXZX2KIY4fSrMiRUCsW+nKM14Ql9kQuMLR0cvL6toioS69ndMjp1AGw== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000001, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Thu, Apr 25, 2024 at 05:04:47PM -0400, Kent Overstreet wrote: > On Thu, Apr 25, 2024 at 09:51:56PM +0100, Matthew Wilcox wrote: > > On Thu, Apr 25, 2024 at 04:45:51PM -0400, Kent Overstreet wrote: > > > On Thu, Apr 25, 2024 at 01:08:50PM -0700, Kees Cook wrote: > > > > The /proc/allocinfo file exposes a tremendous about of information about > > > > kernel build details, memory allocations (obviously), and potentially > > > > even image layout (due to ordering). As this is intended to be consumed > > > > by system owners (like /proc/slabinfo), use the same file permissions as > > > > there: 0400. > > > > > > Err... > > > > > > The side effect of locking down more and more reporting interfaces is > > > that programs that consume those interfaces now have to run as root. > > > > sudo cat /proc/allocinfo | analyse-that-fie > > Even that is still an annoyance, but I'm thinking more about a future > daemon to collect this every n seconds - that really shouldn't need to > be root. Open it once and rewind? But regardless, see the end about changing ownership/perms/etc. > And the "lock everything down" approach really feels like paranoia gone > too far - what's next, /proc/cpuinfo? Do we really want to go the > Windows approach of UAC pop ups for everything? I'd rather be going the > opposite direction, of making it as easy as possible for users to see > what's going on with their machine. Not unless there's something in /proc/cpuinfo that can't be extracted in other methods. :) Anyway, you're offering a slippery-slope argument, I just want to avoid new interfaces from having needlessly permissive default access permissions. I expect this to be enabled by default in distros, etc, so I'd like to make sure it's not giving attackers more information than they had before. Even reporting how much has been allocated at a specific location means an attacker ends up with extremely accurate information when attempting heap grooming, etc. Even the low granularity of slabinfo is sufficient to improve attacks. (Which is why it's 0400 by default too.) > Instead, why not a sysctl, like we already have for perf? perf is a whole other beast, including syscalls, etc. > The concern about leaking image layout could be addressed by sorting the > output before returning to userspace. It's trivial to change permissions from the default 0400 at boot time. It can even have groups and ownership changed, etc. This is why we have per-mount-namespace /proc instances: # chgrp sysmonitor /proc/allocinfo # chmod 0440 /proc/allocinfo Poof, instant role-based access control. :) I'm just trying to make the _default_ safe. -- Kees Cook