Re: [PATCH] sysctl: add config to make randomize_va_space RO

From: Kaiwan N Billimoria <kaiwan@kaiwantech.com>
To: Paul Moore <paul@paul-moore.com>
Cc: David Hildenbrand <david@redhat.com>, Sam James <sam@gentoo.org>,
	 Michael McCracken <michael.mccracken@gmail.com>,
	linux-kernel@vger.kernel.org,  serge@hallyn.com,
	tycho@tycho.pizza, Luis Chamberlain <mcgrof@kernel.org>,
	 Kees Cook <keescook@chromium.org>,
	Iurii Zaikin <yzaikin@google.com>,
	 Andrew Morton <akpm@linux-foundation.org>,
	linux-fsdevel@vger.kernel.org,  linux-mm@kvack.org,
	kernel-hardening@lists.openwall.com
Subject: Re: [PATCH] sysctl: add config to make randomize_va_space RO
Date: Sat, 6 May 2023 12:34:41 +0530	[thread overview]
Message-ID: <CAPDLWs-=C_UTKPTqwRbx70h=DaodF8LVV3-8n=J3u=L+kJ_1sg@mail.gmail.com> (raw)
In-Reply-To: <CAHC9VhTX3ohxL0i3vT8sObQ+v+-TOK95+EH1DtJZdyMmrm3A2A@mail.gmail.com>

On Fri, May 5, 2023 at 8:53 PM Paul Moore <paul@paul-moore.com> wrote:
>
> On Fri, May 5, 2023 at 11:15 AM David Hildenbrand <david@redhat.com> wrote:
> > On 05.05.23 09:46, Sam James wrote:
> > > David Hildenbrand <david@redhat.com> writes:
> > >> On 04.05.23 23:30, Michael McCracken wrote:
> > >>> Add config RO_RANDMAP_SYSCTL to set the mode of the randomize_va_space
> > >>> sysctl to 0444 to disallow all runtime changes. This will prevent
> > >>> accidental changing of this value by a root service.
> > >>> The config is disabled by default to avoid surprises.
>
> ...
>
> > If we really care, not sure what's better: maybe we want to disallow
> > disabling it only in a security lockdown kernel?
>
> If we're bringing up the idea of Lockdown, controlling access to
> randomize_va_space is possible with the use of LSMs.  One could easily
> remove write access to randomize_va_space, even for tasks running as
> root.
IMO, don't _move_ the sysctl to LSM(s). There are legitimate scenarios
(typically debugging) where root needs to disable/enable ASLR.
I think the key thing is the file ownership; being root-writable takes
care of security concerns... (as David says, if root screws around we
can't do much)..
If one argues for changing the mode from 0644 to 0444, what prevents
all the other dozens of sysctls - owned by root mind you - from not
wanting the same treatment?
Where does one draw the line?
- Kaiwan.
>
> (On my Rawhide system with SELinux enabled)
> % ls -Z /proc/sys/kernel/randomize_va_space
> system_u:object_r:proc_security_t:s0 /proc/sys/kernel/randomize_va_space
>
> --
> paul-moore.com