Re: [PATCH RFC 0/4] mm, arm64: In-kernel support for memory-deny-write-execute (MDWE)
From: Catalin Marinas <catalin.marinas@arm.com>
Date: 2022-04-21 17:29:14
Also in:
linux-hardening, linux-mm, lkml
On Thu, Apr 21, 2022 at 07:48:27PM +0300, Topi Miettinen wrote:
On 21.4.2022 18.35, Catalin Marinas wrote:quoted
Do we want the "was PROT_WRITE" or we just reject mprotect(PROT_EXEC) if the vma is not already PROT_EXEC? The latter is closer to the current systemd approach. The former allows an mprotect(PROT_EXEC) if the mapping was PROT_READ only for example. I'd drop the "was PROT_WRITE" for now if the aim is a drop-in replacement for BPF MDWE.I think we'd want existing installations with MemoryDenyWriteExecute=yes not start failing when the implementation is changed to in-kernel version. The implementation could be very simple and not even check existing PROT_ flags (except for BTI case) to be maximally compatible to BPF version.
It would have to check the existing flags otherwise this could have been implemented in the BPF filter. The dynamic loader (or kernel loader) first mmap(PROT_READ|PROT_EXEC) and, if the BTI note is found, it switches it to mprotect(PROT_READ|PROT_EXEC|PROT_BTI). If we allowed this to pass simply because of PROT_BTI, one could create such executable mapping even if it is (or was) writeable. So we can either allow mprotect(PROT_EXEC) if the mapping was never writeable or we allow mprotect(PROT_EXEC) if the mapping is already PROT_EXEC (and the check for W^X was previously done by mmap()).
So I'd leave "was PROT_WRITE" and other checks to more advanced versions, enabled with a different PR_MDWX_FLAG_.
This works for me as well. See my reply to Kees for the use-cases. Thanks. -- Catalin _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel