From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id B23CEC05027 for ; Mon, 23 Jan 2023 11:45:59 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 4A3A86B0071; Mon, 23 Jan 2023 06:45:59 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 452CB6B0072; Mon, 23 Jan 2023 06:45:59 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 31ADE6B0073; Mon, 23 Jan 2023 06:45:59 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 20D036B0071 for ; Mon, 23 Jan 2023 06:45:59 -0500 (EST) Received: from smtpin26.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id CFBBC807D2 for ; Mon, 23 Jan 2023 11:45:58 +0000 (UTC) X-FDA: 80385884796.26.10C425C Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by imf28.hostedemail.com (Postfix) with ESMTP id AD16FC0005 for ; Mon, 23 Jan 2023 11:45:55 +0000 (UTC) Authentication-Results: imf28.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=FfbhWoyJ; spf=pass (imf28.hostedemail.com: domain of david@redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=david@redhat.com; dmarc=pass (policy=none) header.from=redhat.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1674474355; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=xKJxlJGIfIsaD5LRoMOc9aRdfkqWYBvoEPdj64DJbCY=; b=ZurmAe9a6Tl8VEzNN8FHXCsuvMwIxX7uJoauYrVnisApaGhDYn8/Co3e72D996+3PXTCpp M6eC2Fj4JFOQqooKj7oCh/0j69hZ2LQ49qIQDljapEu7ZRCKZSNFslEAeQP9F4/570gn9N ygHCfWlEMRmKRPn69jWyi0Eu4yUnoUA= ARC-Authentication-Results: i=1; imf28.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=FfbhWoyJ; spf=pass (imf28.hostedemail.com: domain of david@redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=david@redhat.com; dmarc=pass (policy=none) header.from=redhat.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1674474355; a=rsa-sha256; cv=none; b=uW2/pLyQLAPlwZQ7QDg2zhVs0HmVzzE/Cu25p0wLi06HagqanT68pOW0z/SpKynppVwQxg sY+Nxedpfcn7aqSQcM3IexGhOHC5whz9K0KjJ8cAHKaLpCeh+KfxIf1oSFZcIfHtrEBT1Q E049DxH1kwL5QnU/Fg4eYOJJEz/Phu0= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1674474355; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=xKJxlJGIfIsaD5LRoMOc9aRdfkqWYBvoEPdj64DJbCY=; b=FfbhWoyJhoUBGew/EuR3PX2wci3063JmgVsf7KBpHh6B2sBtno+WcHrfZApvH2vYVlVXAe DIn3ExwHzkpdKKI/zfNkw6yjXVF3VHa6OqL4Pa3L7pX/ZacZHHP1Ms+K+nyJXWXPEA2Tc7 r+1BwndakXKFrCqIIkFKsSmUcb9rHDU= Received: from mail-wm1-f72.google.com (mail-wm1-f72.google.com [209.85.128.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_128_GCM_SHA256) id us-mta-119-YZ3ao2YEP72CkBbBsmDPsA-1; Mon, 23 Jan 2023 06:45:53 -0500 X-MC-Unique: YZ3ao2YEP72CkBbBsmDPsA-1 Received: by mail-wm1-f72.google.com with SMTP id m7-20020a05600c4f4700b003d971a5e770so7381068wmq.3 for ; Mon, 23 Jan 2023 03:45:53 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:in-reply-to:organization:from:references :cc:to:content-language:subject:user-agent:mime-version:date :message-id:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=xKJxlJGIfIsaD5LRoMOc9aRdfkqWYBvoEPdj64DJbCY=; b=OlOFVIKiOIvmEd9lTLI8uGretIiDUn16G4583RLJSjKkIIF0AJ3RC6LvCShExaYARs +l6j6ry66TnV+5DieaSxQzmjjsvCmI3acE3QAEK1fMkHhS8vYvPPaExpzWCFxq+XMzs4 g0z+Kpf9Mfq91BhAkQvmEGIr31KeDkQDMQVJP1AeNvbacfCJwz3LT5j7PTHo/xKDEEot jq1agw/XxkKBcXJ5VttyThDvHvU1F1BD82lc1LVSCTx7FrQ8VOdMefwsk0YhLcwBsuyv PbqcxCgaykr9WZ2GsgEonmRYNOUly47uto328dmebgXeAJqDH15B37+iS9VhUACX8GP4 NLXQ== X-Gm-Message-State: AFqh2koWlYpKpGDlCOi3rHrUifybP29tPfAEmV01bQZag0R3GTtyLrCX ScX244bTZR1p8HjXzMMJRohp3x0XV9xAP3Eiw8jnUcztM6cDEF4f+IRLCPnMdWb3PDnHko6E2UZ NwgrgUPBklSY= X-Received: by 2002:a5d:46c2:0:b0:2bf:9465:64a with SMTP id g2-20020a5d46c2000000b002bf9465064amr9244228wrs.27.1674474352630; Mon, 23 Jan 2023 03:45:52 -0800 (PST) X-Google-Smtp-Source: AMrXdXvTZG6hW9a8LI7tEVvYp5YnPxCUcCD42L3k31ZE04ppuyLjPSI1rlGzrMMMlKglCuEQmxM+9g== X-Received: by 2002:a5d:46c2:0:b0:2bf:9465:64a with SMTP id g2-20020a5d46c2000000b002bf9465064amr9244213wrs.27.1674474352288; Mon, 23 Jan 2023 03:45:52 -0800 (PST) Received: from ?IPV6:2003:cb:c704:1100:65a0:c03a:142a:f914? (p200300cbc704110065a0c03a142af914.dip0.t-ipconnect.de. [2003:cb:c704:1100:65a0:c03a:142a:f914]) by smtp.gmail.com with ESMTPSA id az22-20020adfe196000000b002bddaea7a0bsm26465943wrb.57.2023.01.23.03.45.51 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 23 Jan 2023 03:45:51 -0800 (PST) Message-ID: <4a1faf67-178e-c9ba-0db1-cf90408b0d7d@redhat.com> Date: Mon, 23 Jan 2023 12:45:50 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.6.0 Subject: Re: [PATCH v2 1/2] mm: Implement memory-deny-write-execute as a prctl To: Joey Gouly , Catalin Marinas , Andrew Morton , Lennart Poettering , =?UTF-8?Q?Zbigniew_J=c4=99drzejewski-Szmek?= Cc: Alexander Viro , Kees Cook , Szabolcs Nagy , Mark Brown , Jeremy Linton , Topi Miettinen , linux-mm@kvack.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-abi-devel@lists.sourceforge.net, nd@arm.com, shuah@kernel.org References: <20230119160344.54358-1-joey.gouly@arm.com> <20230119160344.54358-2-joey.gouly@arm.com> From: David Hildenbrand Organization: Red Hat In-Reply-To: <20230119160344.54358-2-joey.gouly@arm.com> X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: AD16FC0005 X-Rspam-User: X-Stat-Signature: aam8n3o6qjmtcwai4dm4zom38ginb3og X-HE-Tag: 1674474355-873393 X-HE-Meta: U2FsdGVkX1+OiPfvT4qFXc9u0GRhOek/TFZ2Y662D1RbEdG/di75AjIwYkvIP5tewVyecjCsyPWHgFtQ9KhMvit/KM4eKgKM5u9+RMm43PlZlb3FYrdWql3T1AQC9bNHdye2SoeSyNwSQAphrSSmdnfQPqunFcfLWbxWXneMaNRqWrO+Mpn/wX9CgLk4whe08cY0lrOALCKLN7BwFvJbHWkjVkNQttEJwSiSC9rsiAHcZ8sXVAhUa62OD5umB4sF0bmP/iWgQLlQrOxkjSb8hn6J7fv0BP13/by3sBrlXGAwYrViRH52hhwaO8wwd7PQnNTlihjJ+WnZprdQY3RfSUTDHc4nKyE2fvZTBAKm0t9DJ/ZuFQvA3M/XNpsUGlXAPnqCqEsZvbXlFemc0ZWXsUh2uV0MscTxJypPmrl8eVKke/o16a6CBwZRIOa6HSjIP6LbeLVlJF9jn8UwpkoajVJp/E2SUCRB/Awujs+fY7trySVyouiDNOSCe+/WbnxYGDNmL4TUAUNXha/vJsrwVBtY4ANpHsladyjaLfcdwLL9/tKGg5+p95y0Qf1VZRquMNRFXuopm2okUrSRM2/7CjHQ34MpF85Lxi8D0FmlvFOWUM82Gc+2qzf6F1AG6iuQ4jK7eFrPiRTqkSsy2YWfXo/QZM1HKIK4uHVGr47i7FaECvekB4fX/86c9lTQ7Hmldsq/+HMSHLbmEb3YP0z+3wO/smm4PH1FHzsmvAptzOZOq5qcr2XcyOS3idXJ/zx41IVT9I1mHg9+2N63/eSD6i6G7DY9mlwogXzvSd2ShJOfaIJ8Vzdn0K7zQAWyYWJXnoDAoTWKbIsZ3oiBn05pp8LFElvO+529LSKaqQUKz0FHpaz7MJB7gchRfwY0Q5KT8u0wBJFSdlJ3tV3vLD7W1m/97mvxG5g01QVYhfVru9HFPFK+/MRzB51jj8DS+LZSrMIp+6NlmKxFRUBtXuP sSu8AJn2 Q1Ci1WRZr9xNzTifKoJiGycFnive5DNqn5lL9FYfJRJnvLQHUg+A2N0Sn/L5mPKfGLFvjxSJLjG+K6qg9HzvxEuLacnYgpm4RhM8OQnNqaJJgjaGkxzKZfZEcRnJlgp6Mj4fQGYys09cWnLwmZrUgsbO9I0WHS2AQwg42kC3gSyPoOut3XYOZpryuvR+vKXS/6inTrhsEBT5N/SG/z1QoZSeC1XpLEOQQxrOeXClpDL6lOqxjvhwkSX5UHVGRikOnBXtzkzyLU9/guTRXy6fdg1am4Rxz6szG+MbDWn19bAksAduSx/zUO5fv8giYaFhcVQSzAJfEQjbiB8GVklZW1RYBzjSfH1kCX/Ax+j6D537tUTasYHjGBQuZuMehKZxuade60k9wkd9FXQeuixo87xTOFgevqq64cPaghVr771t1bDvRusOeCi05osDFuk93nLVyU9MQXih47JMIt92P4Cv1T6Htl3PTPY0M0DbkEhyQQdSV1qC96B8DNqUfmPQuub9eg3565l7mAOI= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 19.01.23 17:03, Joey Gouly wrote: > The aim of such policy is to prevent a user task from creating an > executable mapping that is also writeable. > > An example of mmap() returning -EACCESS if the policy is enabled: > > mmap(0, size, PROT_READ | PROT_WRITE | PROT_EXEC, flags, 0, 0); > > Similarly, mprotect() would return -EACCESS below: > > addr = mmap(0, size, PROT_READ | PROT_EXEC, flags, 0, 0); > mprotect(addr, size, PROT_READ | PROT_WRITE | PROT_EXEC); > > The BPF filter that systemd MDWE uses is stateless, and disallows > mprotect() with PROT_EXEC completely. This new prctl allows PROT_EXEC to > be enabled if it was already PROT_EXEC, which allows the following case: > > addr = mmap(0, size, PROT_READ | PROT_EXEC, flags, 0, 0); > mprotect(addr, size, PROT_READ | PROT_EXEC | PROT_BTI); > > where PROT_BTI enables branch tracking identification on arm64. > > Signed-off-by: Joey Gouly > Co-developed-by: Catalin Marinas > Signed-off-by: Catalin Marinas > Cc: Andrew Morton > --- > include/linux/mman.h | 34 ++++++++++++++++++++++++++++++++++ > include/linux/sched/coredump.h | 6 +++++- > include/uapi/linux/prctl.h | 6 ++++++ > kernel/sys.c | 33 +++++++++++++++++++++++++++++++++ > mm/mmap.c | 10 ++++++++++ > mm/mprotect.c | 5 +++++ > 6 files changed, 93 insertions(+), 1 deletion(-) > > diff --git a/include/linux/mman.h b/include/linux/mman.h > index 58b3abd457a3..cee1e4b566d8 100644 > --- a/include/linux/mman.h > +++ b/include/linux/mman.h > @@ -156,4 +156,38 @@ calc_vm_flag_bits(unsigned long flags) > } > > unsigned long vm_commit_limit(void); > + > +/* > + * Denies creating a writable executable mapping or gaining executable permissions. > + * > + * This denies the following: > + * > + * a) mmap(PROT_WRITE | PROT_EXEC) > + * > + * b) mmap(PROT_WRITE) > + * mprotect(PROT_EXEC) > + * > + * c) mmap(PROT_WRITE) > + * mprotect(PROT_READ) > + * mprotect(PROT_EXEC) > + * > + * But allows the following: > + * > + * d) mmap(PROT_READ | PROT_EXEC) > + * mmap(PROT_READ | PROT_EXEC | PROT_BTI) > + */ Shouldn't we clear VM_MAYEXEC at mmap() time such that we cannot set VM_EXEC anymore? In an ideal world, there would be no further mprotect changes required. -- Thanks, David / dhildenb