From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 69220EB64DC for ; Tue, 18 Jul 2023 00:47:31 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id DE2CB8D0001; Mon, 17 Jul 2023 20:47:30 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id D92166B0074; Mon, 17 Jul 2023 20:47:30 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id C5A238D0001; Mon, 17 Jul 2023 20:47:30 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id B47E66B0071 for ; Mon, 17 Jul 2023 20:47:30 -0400 (EDT) Received: from smtpin12.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id 77F64160627 for ; Tue, 18 Jul 2023 00:47:30 +0000 (UTC) X-FDA: 81022894260.12.47B3BC1 Received: from mail-oi1-f174.google.com (mail-oi1-f174.google.com [209.85.167.174]) by imf07.hostedemail.com (Postfix) with ESMTP id 8BFD340018 for ; Tue, 18 Jul 2023 00:47:28 +0000 (UTC) Authentication-Results: imf07.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=ECb0Wdft; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf07.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.167.174 as permitted sender) smtp.mailfrom=jeffxu@chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1689641248; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=7/VGkzHeIng6LZLdOiE8OpcvdoSFO1a2yPPXY5DYMhI=; b=mDnUt4DGv5OU7J564dE/MhXMsZYzZKpPDSPpwFAxbZxLuLC+WPrGUnTcRbzkHK4exu5fm0 x/kwhB6M/k4BZY7YZJPEpUp7kdwJkzk91WEbYexWTMpiBK6KETfrf9WqqiuO14f0EIPxDA LrbgRCIZg+u4XZe2o3pK4CPwTDwuhpw= ARC-Authentication-Results: i=1; imf07.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=ECb0Wdft; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf07.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.167.174 as permitted sender) smtp.mailfrom=jeffxu@chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1689641248; a=rsa-sha256; cv=none; b=p+BnDHXEAy7YfWi7anXTZKfyH6rjSMCOi4zkp/+xeKNlKw12GY6Wpk7/ljBqofHkDiBiYl 5EvVfa1cG05f9yx6ExrthbBCv2sicF8NgOJuo4U6T8LZVwyTsdfak4SGeScvgs2d/KQdKB edt/OOccTWMtqE8AYJOZUfcQBYCiTeI= Received: by mail-oi1-f174.google.com with SMTP id 5614622812f47-3a3efebcc24so3745297b6e.1 for ; Mon, 17 Jul 2023 17:47:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1689641247; x=1692233247; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=7/VGkzHeIng6LZLdOiE8OpcvdoSFO1a2yPPXY5DYMhI=; b=ECb0Wdft3jRCG9h52I3ITA9rl8b2YQZCzZYMMw31VNkSX+I+t5WHZwOOQfPmn8zeBa N+PYlgS5IUX7+Ypav9vAtroMcd1Tnn7ArinCligpgu7iSl/WPZT09n6AMum5BceEjJdA 3z7n5FFsFHBYvtPCDNEVrcA0GSfExQJDHnTsY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1689641247; x=1692233247; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=7/VGkzHeIng6LZLdOiE8OpcvdoSFO1a2yPPXY5DYMhI=; b=Sdvl5rA3c463izULU9y7174uOeHuO9yPXw/gN8I8F5595Pe+aFycnkqkcLMkz6hcmn gsmS1CIfB0oRIVqyiwK4yJN57GrRrpPJn/C352sXzfSpEKOggsfB3W6uA/H6rIGRsjS/ 1zQmEu1hKGijOfdbYvryyS9LAgKBL57hL0xsp/nGlqSJJqM5nnd/IWFEDDxM+OM2Zvfz zSv+k0ga9XENjBFnY5vsIOWc4V7UVzVFnPW8ewJKwXZV1JKKd335SQQspicdEj5PliOw OqVepA+o14IP7H3CmWjtNecBI0WzucC26irhFSgeNcy/bXyzgWBL5SVG5zEVnqoqbgHt R+Vw== X-Gm-Message-State: ABy/qLbnFczK1XYJLZPsTBdArJpOXTQuInwlu84rqbiMFIBkQxQ3+FgP 78krIWnbGoKf5YKcwe7lOFraFIqVIzb2jZKyE2Yuyg== X-Google-Smtp-Source: APBJJlEkHGBdA1cguyGDTJ5pV21jq1ebwIyWijB1g6YkxugTSCb61Iq1bkrcdJbb3GlCtLaqKHcYq2ZixMKY5yCNcw0= X-Received: by 2002:a05:6808:1926:b0:3a4:3b56:68f0 with SMTP id bf38-20020a056808192600b003a43b5668f0mr1352445oib.41.1689641247628; Mon, 17 Jul 2023 17:47:27 -0700 (PDT) MIME-Version: 1.0 References: <20230713143406.14342-1-cyphar@cyphar.com> In-Reply-To: <20230713143406.14342-1-cyphar@cyphar.com> From: Jeff Xu Date: Mon, 17 Jul 2023 17:47:15 -0700 Message-ID: Subject: Re: [RFC PATCH 0/3] memfd: cleanups for vm.memfd_noexec To: Aleksa Sarai Cc: Andrew Morton , Shuah Khan , Jeff Xu , Kees Cook , Daniel Verkamp , Luis Chamberlain , YueHaibing , linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-hardening@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspamd-Queue-Id: 8BFD340018 X-Rspam-User: X-Rspamd-Server: rspam05 X-Stat-Signature: gw85h47wr4jgg1bc1198pfce9um7eegp X-HE-Tag: 1689641248-696706 X-HE-Meta: U2FsdGVkX1/V9dc2WJCIIlzIQ5FZ6j5dmw5JhyoxMSsfj5xf5qfNuu2utybwKh/U5TNDHuORVQgujI4klBw1zxr7nqbj5wRF2gAYZhN44obbjtHfskaD/zP0+rg54CXDTUK3GUFfL1H9tOL9A8PlPS+JZa6TOmFQIzI5kWClYJcnfkyK1caZAinghjeF9aReksgyZ6VnTph6E61pwrwdcLeE9SJK9UZLZTs4Qs3oBHeZnT6rwphN/AO30Hpd9nTZGFuuILM6J6miZMa21ibWX7dNNFF+CKP9QBN/QwDPbhy0urmxu2zgWiofzm76SEi940HJGmz/B1iA5LhvCLQzcIGUlb8bs5FDwcY2VEwSKq4gf6xeua90UtILLpDMALxJdVsKXyGi7UIp6M0q3V+aQTZziutWfSGL+pTbRj/sw862H9ynD1To4zhYEuLCbagYjld6OEyvMNcPj3YSkPeLNaJJo/2xmB3K6OQIimHnkc6Ux4lzpuWf6PajccfqWmlsT7LtnRogcEbs4nDoN3Fz/Xas9VG1zq1HDS3tgU07B9WRWJ3qnFaadt2Ea+wC74TgqTXvAd+PmxDd5NlX/bk8Jqw83fjxynRTHoxwlklqlQPqR6gfpR+TYavCt/jj66RJhbuMZgRmIocwYmLNcrk9UxJ0eQQIdye1YjCZUM067X6qEluRBlhBlp6cySbZPSJmyJ0Gzyy0ODqMNaihgrAKL1C/3QKJA4bCoHsYgtyssMw38ltq7MFjCfMOwDUISw/9dMC6Kl1H2wG2BYAbvx5GYibbDFWdzXEd2VWhHF4U7BNow7zmGOb9hh8INAu8GNLXrJ4/T7+ARSUgGnHmV/dmayO2M0nQMpI6nKAN7TzKht3/pMCzZrkzbdKIbBVlzcjqhyr89/URLIrpyT8hjoMIiYb5rf7LJjC/LU9rzI0s7KnqyYoI1WZj6It10srurapjuFDMWv4MAwCUMzDrfop xkDJyZoC Dw0hFO1pnN+TXu5ExGw1VUoaod7+1777ddwXv/ptasvLtrmiDSp3gz5v/p3fwp6GOOFIQGxvebpL2UreZUoC1gVEgsExhl9xLIb8Ey01Kc2UkhqVAVDndMbKG2/MzJyO0wUfsaaBgfN/x6upU5uUr2+21MtvZnvrt+J+WStzgoEhLr2ypuruy6tiJQmqFeplDXxDxHGW9cqokYHyAnNi0k6K7yeOm8h84aET2NLW8YFRQREOzOgAmeM4EFfASagVE9Ps2amdVA+FS4Oi+RQJat/xKVvCPxMkRiUp3C4t+gNMmoDabrMgvO1k6LCuJtrHrJLaom07ctM9DJLciR25Gp3DbcpwuDqpFpmLcxtNwxk29rmuiiL51xe065SRNIitihyS9xIx05tq2h7VXsr3GXqgmCX7ZGwFWS1/Uma5SwSrpUI6ca925IY/PGe2iJpElWy6MwgsfmFISt7CrGT/5YZw0VDCp/6Mgyt/SDnR2nbZ3FyR20pHozjT73wtPLpVlMtJ65HfOsj7S6Ay1UeremomXiotgvM+otTDY X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Hello Aleksa, Thanks for your email and patches for discussion. On Thu, Jul 13, 2023 at 7:34=E2=80=AFAM Aleksa Sarai wr= ote: > > It seems that the most critical issue with vm.memfd_noexec=3D2 (the fact > that passing MFD_EXEC would bypass it entirely[1]) has been fixed in > Andrew's tree[2], but there are still some outstanding issues that need > to be addressed: > > * The dmesg warnings are pr_warn_once, which on most systems means that > they will be used up by systemd or some other boot process and > userspace developers will never see it. The original patch posted to > the ML used pr_warn_ratelimited but the merged patch had it changed > (with a comment about it being "per review"), but given that the > current warnings are useless, pr_warn_ratelimited makes far more > sense. > Ya, This was discussed in [1] Replacing pr_warn_once with pr_warn_ratelimited won't address Peter Xu's observation that "ratelimited" will fill syslog [2], I'm not sure it is acceptable to ones who is not interested in memfd, I will defer this to maintainers. [1] https://lore.kernel.org/lkml/202212161233.85C9783FB@keescook/ [2] https://lwn.net/ml/linux-kernel/Y5yS8wCnuYGLHMj4@x1n/ > * vm.memfd_noexec=3D2 shouldn't reject old-style memfd_create(2) syscall= s > because it will make it far to difficult to ever migrate. Instead it > should imply MFD_EXEC. > Though the purpose of memfd_noexec=3D2 is not to help with migration - but to disable creation of executable memfd for the current system/pid namespace. During the migration, vm.memfd_noexe =3D 1 helps overwriting for unmigrated user code as a temporary measure. Additional functionality/features should be implemented through security hook and LSM, not sysctl, I think. > * The ratcheting mechanism for vm.memfd_noexec doesn't make sense as a > security mechanism because a CAP_SYS_ADMIN capable user can create > executable binaries in a hidden tmpfs very easily, not to mention the > many other things they can do. > By further limiting CAP_SYS_ADMIN, an attacker can't modify this sysctl even after compromising some system service with high privilege, YAMA has the same approach for ptrace_scope=3D3 In addition, this sysctl is pid_name spaced, this means child pid_namespace will alway have the same or stricter security setting than its parent, this allows admin to maintain a tree like view. If we allow the child pid namespace to elevate its setting, then the system-wide setting is no longer meaningful. The code sample shared in this patch set indicates that the attacker already has the ability of creating tmpfs and executing complex steps, at that point, it doesn't matter if the code execution is from memfd or not. For a safe by default system such as ChromeOS, attackers won't easily run arbitrary code, memfd is one of the open doors for that, so we are disabling executable memfd in ChromeOS. In other words: if an attacker can already execute the arbitrary code as sample given in ChromeOS, without using executable memfd, then memfd is no longer the thing we need to worry about, the arbitrary code execution is already achieved by the attacker. Even though I use ChromeOS as an example, I think the same type of threat model applies to any system that wants to disable executable memfd entirely. > * The memfd selftests would not exit with a non-zero error code when > certain tests that ran in a forked process (specifically the ones > related to MFD_EXEC and MFD_NOEXEC_SEAL) failed. > I will test this code and follow up. Thanks! -Jeff Xu > (This patchset is based on top of Jeff Xu's patches[2] fixing the > MFD_EXEC bug in vm.memfd_noexec=3D2.) > > [1]: https://lore.kernel.org/all/ZJwcsU0vI-nzgOB_@codewreck.org/ > [2]: https://lore.kernel.org/all/20230705063315.3680666-1-jeffxu@google.c= om/ > > Aleksa Sarai (3): > memfd: cleanups for vm.memfd_noexec handling > memfd: remove racheting feature from vm.memfd_noexec > selftests: memfd: error out test process when child test fails > > include/linux/pid_namespace.h | 16 +++------ > kernel/pid_sysctl.h | 7 ---- > mm/memfd.c | 32 +++++++---------- > tools/testing/selftests/memfd/memfd_test.c | 41 ++++++++++++++++++---- > 4 files changed, 51 insertions(+), 45 deletions(-) > > -- > 2.41.0 > >