From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id B2164C25B74 for ; Fri, 24 May 2024 03:43:11 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 429D26B009E; Thu, 23 May 2024 23:43:11 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 3D9BB6B00A5; Thu, 23 May 2024 23:43:11 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 2C7F66B00A6; Thu, 23 May 2024 23:43:11 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 0E9D06B00A5 for ; Thu, 23 May 2024 23:43:11 -0400 (EDT) Received: from smtpin19.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id AADD61207ED for ; Fri, 24 May 2024 03:43:10 +0000 (UTC) X-FDA: 82151893740.19.11A431C Received: from mail-ed1-f41.google.com (mail-ed1-f41.google.com [209.85.208.41]) by imf28.hostedemail.com (Postfix) with ESMTP id B51A0C000E for ; Fri, 24 May 2024 03:43:08 +0000 (UTC) Authentication-Results: imf28.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=zshpXScg; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf28.hostedemail.com: domain of jeffxu@google.com designates 209.85.208.41 as permitted sender) smtp.mailfrom=jeffxu@google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1716522188; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=36fhNvXOea7b3Tf4Od7riH5C3b7gBf7G4V+Hf3bEH/U=; b=3qHGDSzU66ua8AR/XOqZ0ChWKwzyw34iWZ03WkaUFkKWKLQtj6ZrDZz4EjZ499O8WaWdxj Oi2iiGfeTgWeiSYF2rrrMxG7mJ90RAAr2GbkATL5Ba6H5eR6f+tK8OCeLDWCpPbIzbL9RH o4zCGT0wRG+GzLR7SK1ygW8q0w5ECs0= ARC-Authentication-Results: i=1; imf28.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=zshpXScg; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf28.hostedemail.com: domain of jeffxu@google.com designates 209.85.208.41 as permitted sender) smtp.mailfrom=jeffxu@google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1716522188; a=rsa-sha256; cv=none; b=3vyPL3vDFnrQyCRc9LWKe/rQJ/10YVqlaN0ZhBguVBYcrwS7GhL0HwcvqovdDRdT46qsd7 0X+/YPYR8ROV2aGqJejiYsT02u8Z1S1fob9j7QhTsDh97Ew0muGb9GAU9TA4SnW7G0xnV2 wvJ+RVHEOi9G4NHPXvj665WMRvnF34c= Received: by mail-ed1-f41.google.com with SMTP id 4fb4d7f45d1cf-5724736770cso3852a12.1 for ; Thu, 23 May 2024 20:43:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1716522187; x=1717126987; darn=kvack.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=36fhNvXOea7b3Tf4Od7riH5C3b7gBf7G4V+Hf3bEH/U=; b=zshpXScgWFsAZ8z4inzm+BPh7z2whSpGMthM8L6znmXoA5fcekJaj7vqQI/riksZnh zwdVIKBNNphTSWRyveA34DIA0dm1plD5L0v26bgxekif0HnKZcpv1utR7ifYCXUEv4oV UdvomLablguQZ8JTyjFd+ovSjGb9Xjtq/YpxBAngVup/wKUcefNVu07fVXbRH2VyEgdN 3muwV87a0VgWhOGPHCpInbCDasqWpMb+mgDInVCWN7bOpUHA0ejCvFL1FEQr17FZb/95 LUd2Ry4cBaJ3BXUrCFu1uscyK+NWqTQ72KxMlL6KzGQCGZzWRAGBBWe2nC1jH5g/LPOy QePQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1716522187; x=1717126987; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=36fhNvXOea7b3Tf4Od7riH5C3b7gBf7G4V+Hf3bEH/U=; b=Xt30mi0/YhGr0lKMR/EobgvsX/c8EvxUwDOe7jVt+mQyO/aJOcdJuW7aDn1NbNvdP7 afhFOLp8ET7NKOHBvS3YGh6UoTZcVJNqIy9SUxg2imNaEqgo6xukcOaH2uNJ+AG7gbA4 bC+/8xNg+QV/gPLz9SJM8/+k8/8UBOpWuLrnvVt1QyfTjqfEmTBmizO0sJYw1ubnkfMp xKzOz1ZvRmLlSPfL/bJJnP+w5eLjeXFMM07wvXs1kgGZH7YtIHYSmubJKlwLucGCee3q Zuutfmo+91fJ9T6JWPklZGbkRdBFI0MioRwVdbRb1s/oyHXAoOKWrGv9wn8cIn5EtGTD 92IA== X-Forwarded-Encrypted: i=1; AJvYcCX4IMKqXTlZbqGR3/Jtwo0gtRlOPXbmc7h9WqS5fTTZAEMe+Hltzpsx+lgMbIBrkZTtx0dPFwJH+BS06TExqK+/m+o= X-Gm-Message-State: AOJu0YxTRiFP6H3nxsBYI6fF2LNNNC6ucd8go66szpHv9hJ7ZrY3wopw OxYnscM6CCzakBxQ9kNqQGgCam31/1qJ9J2ARM6hTrbfVLKiMNZwunz6/pPlmAPItLDGZuZUbrC rpVeDBADMcZ86BuSExt66GLPdTIqn9kDh+wrL X-Google-Smtp-Source: AGHT+IEjJM7nXR383Y7RuODv6qPfDIg6HoQrAoxEtox77JWxz+8VbOtWYdPEiSvkEhf2h7OpL2GpIhnsI+AShbXul7g= X-Received: by 2002:aa7:d547:0:b0:574:ea5c:fa24 with SMTP id 4fb4d7f45d1cf-578551d9a15mr51779a12.3.1716522186873; Thu, 23 May 2024 20:43:06 -0700 (PDT) MIME-Version: 1.0 References: <20240524033933.135049-1-jeffxu@google.com> <20240524033933.135049-3-jeffxu@google.com> In-Reply-To: <20240524033933.135049-3-jeffxu@google.com> From: Jeff Xu Date: Thu, 23 May 2024 20:42:27 -0700 Message-ID: Subject: Re: [PATCH v2 2/2] memfd:add MEMFD_NOEXEC_SEAL documentation To: jeffxu@chromium.org Cc: akpm@linux-foundation.org, cyphar@cyphar.com, dmitry.torokhov@gmail.com, dverkamp@chromium.org, hughd@google.com, jorgelo@chromium.org, keescook@chromium.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org, pobrn@protonmail.com, skhan@linuxfoundation.org, stable@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspam-User: X-Rspamd-Server: rspam02 X-Rspamd-Queue-Id: B51A0C000E X-Stat-Signature: a6qd3wduj4cpsfxqgs3dejabho8r5dcw X-HE-Tag: 1716522188-515053 X-HE-Meta: U2FsdGVkX18qn5E/qhcRtN7/4hBCldkGwxXtJazhKmkMfFbRwPs2MrqAUbdDbkD/gy/jzUJqFwBGx59+SovMv7veGwxHJ4TugBYftFlyST32qeAP99G9i0z5GtNQYVPFPmfeTLsvtkaohH7tWa1h9DIvxtQXZnMiISsLbLp1qri34yOooXEtXrYlRXGCDw5YDxOINgdhqP3xzeVQ9rghoo5RrPfiowRFlpzUPYsIqNHAwwi0Iv5oeM1KC93yYZywEK1Lx9BETKKzrvv3LQ7AidOiD+fkScUk/mZN6VUn4BGEFcAOokMNxMu3SmJwhTRWFdMWJO5g2zkWa8wpmFAwZUohHJ2dqhtr/UzAoT8JQt2rJJWXL0YYyF2pNLGz40wPUGlLmolx/lDu912BCHd+2u3ERNdR1XmPJJtGpoN1w1QHAVa6ToxquvBDktshpY2q1Oxr9KuiZOgrNPic5H6Bkiqpe0d0eRzHSfX8Q3esxm6+5Lk8kEHuxvsS4FgGWdJtJqYOVUodjbi4t8hdTDyU9dU761SwFOT59z3DddumML79ALiLuHoaQbZ1sYBaomu+dFLUub3U1pMOAJ1ntJbhdo54kwnol5L6QzQpVPeVikNj2/Flc++tgShRPjahnqcpMKndqwaRMcUc6RwnyJ/vyojfHlJQldvR6+6xVuR9Qeh4h7XfWNFYVGNQ8tFKIo6clfcNaCwfI6mFoO70uL0GYILE/tDjZgQYAuJZ3vHK7Prjxym/DWq6gvKFisjc1H7PHUi26Ds83fLBrKu27V/tFH6fqIQt2ftb4MOqKUstVw6UR3YcWtoWwGZRymkOdQm7reDEd/JxCzkPyy5aEkhBAUv0pL7sFMnLt2opECCD90Cs9oOKz3VKtHufFiRzTVQOB5o8rtBASr3LvCz62z4Qf0r/yO+cY6duAexaELNOryk5ZOBLOXP7TtGih+nG7laxCwkZyo/JELojNktQQox 8oJwmcgO 2JH0PflYywTiRX+JP8G44exwXW9GPSDMc8rHbXjqiMHxe4ALKSCkfsnyVQnlXHW6RVFQ3xLxKQtEGXs4LNMGi+6qm0dSirCPk+YNsDuEGSGpXfQbrXpK+de/GB37aEH30O8zifNXQCmzP0TbfLEKCueqkEwc/e7Kr9cW/7ZKCRiZl8e6VdQSg9ZoJwKeJ3TCYfKnAtgvZnHypngGsCskvwoKFWklL05VwuZNPHBuDClHIf+N38s1+cPJTapdakKMtXBpuWQlZRE98ztMX/0sTtykt/csxwS2ztqnfgelxs0XdDYlBkxxTIfeu428Q9SOAS4ZhRGKKEyyhr1fh+6bpZRAD4Fj1NUNbe7v1giqB0g8NhIjQl1Rxdxy0H+2OrqozsSuBe1Ehfr/YAN+x3oTf/TdhD4Vw/HWAR53T5eOGSEi+fmlyBfUWgxYb00WYKz4WMN8qI4S92zvYqqmpK1ldJxylD8PfES64zTYs3vV8lCE83Qxjhl+wQgbobUkppeu/3i5sbbp6bkdBjdLr4PvNrt+Ig5dSsaJeWbpeOyx5wRs/fVx8tb77L1JQJmx0ezAPf+TSFE1Ex7Ry91c8/4AnC0fyaQ0h3/yytNIV324uAqtNF6yVGclgaSugNTXpHL4sRoy03FdRpbbDbPHSLmOSuNUi1gkChzFB085vxxFxqLUXE0nnK7QAmp9xkjGx+ZdIHpY6mPOG2sSdnZmbk9IbwwYzDAnbH/SFUelEU2kLx00h2KNZHiu2uqMcYqhHasW/IQem8Xhk9M17IdmfX/hJrrsRPA== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000014, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Hi Aleksa On Thu, May 23, 2024 at 8:39=E2=80=AFPM wrote: > > From: Jeff Xu > > Add documentation for MFD_NOEXEC_SEAL and MFD_EXEC > > Cc: stable@vger.kernel.org > Signed-off-by: Jeff Xu > --- > Documentation/userspace-api/index.rst | 1 + > Documentation/userspace-api/mfd_noexec.rst | 90 ++++++++++++++++++++++ > 2 files changed, 91 insertions(+) > create mode 100644 Documentation/userspace-api/mfd_noexec.rst > > diff --git a/Documentation/userspace-api/index.rst b/Documentation/usersp= ace-api/index.rst > index 5926115ec0ed..8a251d71fa6e 100644 > --- a/Documentation/userspace-api/index.rst > +++ b/Documentation/userspace-api/index.rst > @@ -32,6 +32,7 @@ Security-related interfaces > seccomp_filter > landlock > lsm > + mfd_noexec > spec_ctrl > tee > > diff --git a/Documentation/userspace-api/mfd_noexec.rst b/Documentation/u= serspace-api/mfd_noexec.rst > new file mode 100644 > index 000000000000..6f11ad86b076 > --- /dev/null > +++ b/Documentation/userspace-api/mfd_noexec.rst > @@ -0,0 +1,90 @@ > +.. SPDX-License-Identifier: GPL-2.0 > + > +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > +Introduction of non executable mfd > +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > +:Author: > + Daniel Verkamp > + Jeff Xu > + > +:Contributor: > + Aleksa Sarai > + Barnab=C3=A1s P=C5=91cze > + David Rheinsberg > + > +Since Linux introduced the memfd feature, memfd have always had their > +execute bit set, and the memfd_create() syscall doesn't allow setting > +it differently. > + > +However, in a secure by default system, such as ChromeOS, (where all > +executables should come from the rootfs, which is protected by Verified > +boot), this executable nature of memfd opens a door for NoExec bypass > +and enables =E2=80=9Cconfused deputy attack=E2=80=9D. E.g, in VRP bug [= 1]: cros_vm > +process created a memfd to share the content with an external process, > +however the memfd is overwritten and used for executing arbitrary code > +and root escalation. [2] lists more VRP in this kind. > + > +On the other hand, executable memfd has its legit use, runc uses memfd= =E2=80=99s > +seal and executable feature to copy the contents of the binary then > +execute them, for such system, we need a solution to differentiate runc'= s > +use of executable memfds and an attacker's [3]. > + > +To address those above. > + - Let memfd_create() set X bit at creation time. > + - Let memfd be sealed for modifying X bit when NX is set. > + - A new pid namespace sysctl: vm.memfd_noexec to help applications to > + migrating and enforcing non-executable MFD. > + > +User API > +=3D=3D=3D=3D=3D=3D=3D=3D > +``int memfd_create(const char *name, unsigned int flags)`` > + > +``MFD_NOEXEC_SEAL`` > + When MFD_NOEXEC_SEAL bit is set in the ``flags``, memfd is create= d > + with NX. F_SEAL_EXEC is set and the memfd can't be modified to > + add X later. > + This is the most common case for the application to use memfd. > + > +``MFD_EXEC`` > + When MFD_EXEC bit is set in the ``flags``, memfd is created with = X. > + > +Note: > + ``MFD_NOEXEC_SEAL`` and ``MFD_EXEC`` doesn't change the sealable > + characteristic of memfd, which is controlled by ``MFD_ALLOW_SEALI= NG``. > + > + > +Sysctl: > +=3D=3D=3D=3D=3D=3D=3D=3D > +``pid namespaced sysctl vm.memfd_noexec`` > + > +The new pid namespaced sysctl vm.memfd_noexec has 3 values: > + > + - 0: MEMFD_NOEXEC_SCOPE_EXEC > + memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL acts like > + MFD_EXEC was set. > + > + - 1: MEMFD_NOEXEC_SCOPE_NOEXEC_SEAL > + memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL acts like > + MFD_NOEXEC_SEAL was set. > + > + - 2: MEMFD_NOEXEC_SCOPE_NOEXEC_ENFORCED > + memfd_create() without MFD_NOEXEC_SEAL will be rejected. > + > +The sysctl allows finer control of memfd_create for old-software that > +doesn't set the executable bit, for example, a container with > +vm.memfd_noexec=3D1 means the old-software will create non-executable me= mfd > +by default while new-software can create executable memfd by setting > +MFD_EXEC. > + > +The value of memfd_noexec is passed to child namespace at creation time, > +in addition, the setting is hierarchical, i.e. during memfd_create, > +we will search from current ns to root ns and use the most restrictive > +setting. > + Can you please help to review the sysctl part to check if I captured your change correctly ? Thanks -Jeff > +Reference: > +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > +[1] https://crbug.com/1305267 > + > +[2] https://bugs.chromium.org/p/chromium/issues/list?q=3Dtype%3Dbug-secu= rity%20memfd%20escalation&can=3D1 > + > +[3] https://lwn.net/Articles/781013/ > -- > 2.45.1.288.g0e0cd299f1-goog >