Re: [PATCH v1] mm, sysctl: Add sysctl for controlling VM_MAYEXEC taint

[Will Drewry <wad@chromium.org>]

[-- Attachment #1: Type: text/plain, Size: 2485 bytes --]

On Fri, Aug 26, 2016 at 4:32 PM, Kirill A. Shutemov <kirill@shutemov.name>
wrote:

> On Fri, Aug 26, 2016 at 12:30:04PM -0400, robert.foss@collabora.com wrote:
> > From: Will Drewry <wad@chromium.org>
> >
> > This patch proposes a sysctl knob that allows a privileged user to
> > disable ~VM_MAYEXEC tainting when mapping in a vma from a MNT_NOEXEC
> > mountpoint.  It does not alter the normal behavior resulting from
> > attempting to directly mmap(PROT_EXEC) a vma (-EPERM) nor the behavior
> > of any other subsystems checking MNT_NOEXEC.
>
> Wouldn't it be equal to remounting all filesystems without noexec from
> attacker POV? It's hardly a fence to make additional mprotect(PROT_EXEC)
> call, before starting executing code from such filesystems.
>
> If administrator of the system wants this, he can just mount filesystem
> without noexec, no new kernel code required. And it's more fine-grained
> than this.
>
> So, no, I don't think we should add knob like this. Unless I miss
> something.
>

I don't believe this patch is necessary anymore (though, thank you Robert
for testing and re-sending!).

The primary offenders wrt to needing to mmap/mprotect a file in /dev/shm
was the older nvidia
driver (binary only iirc) and the Chrome Native Client code.

The reason why half-exec is an "ok" (half) mitigation is because it blocks
simple gadgets and other paths for using loadable libraries or binaries
(via glibc) as it disallows mmap(PROT_EXEC) even though it allows
mprotect(PROT_EXEC).  This stops ld in its tracks since it does the obvious
thing and uses mmap(PROT_EXEC).

I think time has marched on and this patch is now something I can toss in
the dustbin of history. Both Chrome's Native Client and an older nvidia
driver relied on creating-then-unlinking a file in tmpfs, but there is now
a better facility!


> NAK.
>

Agreed - this is old and software that predicated it should be gone.. I
hope. :)


>
> > It is motivated by a common /dev/shm, /tmp usecase. There are few
> > facilities for creating a shared memory segment that can be remapped in
> > the same process address space with different permissions.
>
> What about using memfd_create(2) for such cases? You'll get a file
> descriptor from in-kernel tmpfs (shm_mnt) which is not exposed to
> userspace for remount as noexec.
>

This is a relatively old patch ( https://lwn.net/Articles/455256/ ) which
predated memfd_create().  memfd_create() is the right solution to this
problem!


Thanks again!
will

[-- Attachment #2: Type: text/html, Size: 3739 bytes --]