On 2016-08-29 11:25 AM, Will Drewry wrote:

On Fri, Aug 26, 2016 at 4:32 PM, Kirill A. Shutemov
<kirill@shutemov.name <mailto:kirill@shutemov.name>> wrote:

    On Fri, Aug 26, 2016 at 12:30:04PM -0400, robert.foss@collabora.com
    <mailto:robert.foss@collabora.com> wrote:
    > From: Will Drewry <wad@chromium.org <mailto:wad@chromium.org>>
    >
    > This patch proposes a sysctl knob that allows a privileged user to
    > disable ~VM_MAYEXEC tainting when mapping in a vma from a MNT_NOEXEC
    > mountpoint.  It does not alter the normal behavior resulting from
    > attempting to directly mmap(PROT_EXEC) a vma (-EPERM) nor the behavior
    > of any other subsystems checking MNT_NOEXEC.

    Wouldn't it be equal to remounting all filesystems without noexec from
    attacker POV? It's hardly a fence to make additional mprotect(PROT_EXEC)
    call, before starting executing code from such filesystems.

    If administrator of the system wants this, he can just mount filesystem
    without noexec, no new kernel code required. And it's more fine-grained
    than this.

    So, no, I don't think we should add knob like this. Unless I miss
    something.


I don't believe this patch is necessary anymore (though, thank you
Robert for testing and re-sending!).

The primary offenders wrt to needing to mmap/mprotect a file in /dev/shm
was the older nvidia
driver (binary only iirc) and the Chrome Native Client code.

The reason why half-exec is an "ok" (half) mitigation is because it
blocks simple gadgets and other paths for using loadable libraries or
binaries (via glibc) as it disallows mmap(PROT_EXEC) even though it
allows mprotect(PROT_EXEC).  This stops ld in its tracks since it does
the obvious thing and uses mmap(PROT_EXEC).

I think time has marched on and this patch is now something I can toss
in the dustbin of history. Both Chrome's Native Client and an older
nvidia driver relied on creating-then-unlinking a file in tmpfs, but
there is now a better facility!


    NAK.


Agreed - this is old and software that predicated it should be gone.. I
hope. :)

Splendid, patch dropped!
Thanks Will and Kirill!


Rob.

    > It is motivated by a common /dev/shm, /tmp usecase. There are few
    > facilities for creating a shared memory segment that can be remapped in
    > the same process address space with different permissions.

    What about using memfd_create(2) for such cases? You'll get a file
    descriptor from in-kernel tmpfs (shm_mnt) which is not exposed to
    userspace for remount as noexec.


This is a relatively old patch ( https://lwn.net/Articles/455256/
<https://lwn.net/Articles/455256/> ) which predated memfd_create().
 memfd_create() is the right solution to this problem!


Thanks again!
will

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>