From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 61C8CC77B7F for ; Sat, 6 May 2023 07:05:02 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id AEB476B0072; Sat, 6 May 2023 03:05:01 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id A9BE56B0078; Sat, 6 May 2023 03:05:01 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 9B1ED6B007B; Sat, 6 May 2023 03:05:01 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from p3plsmtpa06-01.prod.phx3.secureserver.net (p3plsmtpa06-01.prod.phx3.secureserver.net [173.201.192.102]) by kanga.kvack.org (Postfix) with ESMTP id 6EAAD6B0072 for ; Sat, 6 May 2023 03:05:01 -0400 (EDT) Received: from mail-ed1-f53.google.com ([209.85.208.53]) by :SMTPAUTH: with ESMTPSA id vByVpqQIHa3jovByWpjUFd; Sat, 06 May 2023 00:05:00 -0700 X-CMAE-Analysis: v=2.4 cv=VvHlQc6n c=1 sm=1 tr=0 ts=6455fc1c a=LTUozxgYEiL4qA9qR4bt1A==:117 a=IkcTkHD0fZMA:10 a=P0xRbXHiH_UA:10 a=xVhDTqbCAAAA:8 a=20KFwNOVAAAA:8 a=rDwt1Zk6MRkbpbuKzqYA:9 a=QEXdDO2ut3YA:10 a=GrmWmAYt4dzCMttCBZOh:22 X-SECURESERVER-ACCT: kaiwan@kaiwantech.com Received: by mail-ed1-f53.google.com with SMTP id 4fb4d7f45d1cf-50bcb229adaso4990240a12.2 for ; Sat, 06 May 2023 00:04:59 -0700 (PDT) X-Gm-Message-State: AC+VfDzyHdDb8Fagle9M/VKKKYrAlX4w9Df4uZk0+Ya+44A392/kL9/j ptCpqLfRzjsufQW1yidGctM/DBzyzKUHCEG1xd8= X-Google-Smtp-Source: ACHHUZ62GVBTMauDj5I48KnvfLs0gNpt0Jrh6TAkoSyEVAeNlL8OxCphSpqv3XTKacR+8uhZXSKmFENDlCZxOsMFjyw= X-Received: by 2002:a17:907:70a:b0:953:9024:1b50 with SMTP id xb10-20020a170907070a00b0095390241b50mr2753174ejb.74.1683356699105; Sat, 06 May 2023 00:04:59 -0700 (PDT) MIME-Version: 1.0 References: <20230504213002.56803-1-michael.mccracken@gmail.com> <87pm7f9q3q.fsf@gentoo.org> In-Reply-To: From: Kaiwan N Billimoria Date: Sat, 6 May 2023 12:34:41 +0530 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [PATCH] sysctl: add config to make randomize_va_space RO To: Paul Moore Cc: David Hildenbrand , Sam James , Michael McCracken , linux-kernel@vger.kernel.org, serge@hallyn.com, tycho@tycho.pizza, Luis Chamberlain , Kees Cook , Iurii Zaikin , Andrew Morton , linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, kernel-hardening@lists.openwall.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-CMAE-Envelope: MS4xfNNxvdhhVXjknhPqi0t21DUwHFblmp9DVGw+rXuJUe5glCIoEcHob8oe9d9rZs1m82ZUpJHHB0UaU4PchvIH134k1KI9oAYDldjTjxYCfQvbS/M8npFD iVQOV/D02585hhg5j+SChpcsV3KVoYEp+2Z6BED58paT7REl21KVQCbCHshuTpBQnK1eaL1Y4WdKhR4muxiym89T398t3do5LjA= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Fri, May 5, 2023 at 8:53=E2=80=AFPM Paul Moore wro= te: > > On Fri, May 5, 2023 at 11:15=E2=80=AFAM David Hildenbrand wrote: > > On 05.05.23 09:46, Sam James wrote: > > > David Hildenbrand writes: > > >> On 04.05.23 23:30, Michael McCracken wrote: > > >>> Add config RO_RANDMAP_SYSCTL to set the mode of the randomize_va_sp= ace > > >>> sysctl to 0444 to disallow all runtime changes. This will prevent > > >>> accidental changing of this value by a root service. > > >>> The config is disabled by default to avoid surprises. > > ... > > > If we really care, not sure what's better: maybe we want to disallow > > disabling it only in a security lockdown kernel? > > If we're bringing up the idea of Lockdown, controlling access to > randomize_va_space is possible with the use of LSMs. One could easily > remove write access to randomize_va_space, even for tasks running as > root. IMO, don't _move_ the sysctl to LSM(s). There are legitimate scenarios (typically debugging) where root needs to disable/enable ASLR. I think the key thing is the file ownership; being root-writable takes care of security concerns... (as David says, if root screws around we can't do much).. If one argues for changing the mode from 0644 to 0444, what prevents all the other dozens of sysctls - owned by root mind you - from not wanting the same treatment? Where does one draw the line? - Kaiwan. > > (On my Rawhide system with SELinux enabled) > % ls -Z /proc/sys/kernel/randomize_va_space > system_u:object_r:proc_security_t:s0 /proc/sys/kernel/randomize_va_space > > -- > paul-moore.com