From: Alexey Dobriyan <adobriyan@gmail.com> To: Salvatore Mesoraca <s.mesoraca16@gmail.com> Cc: Kernel Hardening <kernel-hardening@lists.openwall.com>, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, Andrew Morton <akpm@linux-foundation.org>, Akinobu Mita <akinobu.mita@gmail.com>, Dmitry Vyukov <dvyukov@google.com>, Arnd Bergmann <arnd@arndb.de>, Davidlohr Bueso <dave@stgolabs.net>, Kees Cook <keescook@chromium.org> Subject: Re: [PATCH] proc: prevent a task from writing on its own /proc/*/mem Date: Sat, 26 May 2018 20:58:58 +0300 [thread overview] Message-ID: <20180526175858.GA19115@avx2> (raw) In-Reply-To: <CAJHCu1LgSUJdiZEfParCH7aLERWM1bgwC7e8wQKgmkNE01_4KA@mail.gmail.com> On Sat, May 26, 2018 at 07:30:47PM +0200, Salvatore Mesoraca wrote: > 2018-05-26 17:48 GMT+02:00 Alexey Dobriyan <adobriyan@gmail.com>: > > On Sat, May 26, 2018 at 04:50:46PM +0200, Salvatore Mesoraca wrote: > >> Prevent a task from opening, in "write" mode, any /proc/*/mem > >> file that operates on the task's mm. > >> /proc/*/mem is mainly a debugging means and, as such, it shouldn't > >> be used by the inspected process itself. > >> Current implementation always allow a task to access its own > >> /proc/*/mem file. > >> A process can use it to overwrite read-only memory, making > >> pointless the use of security_file_mprotect() or other ways to > >> enforce RO memory. > > > > You can do it in security_ptrace_access_check() > > No, because that hook is skipped when mm == current->mm: > https://elixir.bootlin.com/linux/v4.17-rc6/source/kernel/fork.c#L1111 OK > > or security_file_open() > > This is true, but it looks a bit overkill to me, especially since many of > the macros/functions used to handle proc's files won't be in scope > for an external LSM. > Is there any particular reason why you prefer it done via LSM? Well, it exists to implement all kinds of non-standard restrictions. You're probably blacklisting mprotect() and worry that compromised program might use /proc/self/mem instead. But you need to blacklist much more that mprotect(). I think forking a dummy "worker" process to open your /proc/*/mem and pass a descriptor back should still work with your patch.
WARNING: multiple messages have this Message-ID (diff)
From: adobriyan@gmail.com (Alexey Dobriyan) To: linux-security-module@vger.kernel.org Subject: [PATCH] proc: prevent a task from writing on its own /proc/*/mem Date: Sat, 26 May 2018 20:58:58 +0300 [thread overview] Message-ID: <20180526175858.GA19115@avx2> (raw) In-Reply-To: <CAJHCu1LgSUJdiZEfParCH7aLERWM1bgwC7e8wQKgmkNE01_4KA@mail.gmail.com> On Sat, May 26, 2018 at 07:30:47PM +0200, Salvatore Mesoraca wrote: > 2018-05-26 17:48 GMT+02:00 Alexey Dobriyan <adobriyan@gmail.com>: > > On Sat, May 26, 2018 at 04:50:46PM +0200, Salvatore Mesoraca wrote: > >> Prevent a task from opening, in "write" mode, any /proc/*/mem > >> file that operates on the task's mm. > >> /proc/*/mem is mainly a debugging means and, as such, it shouldn't > >> be used by the inspected process itself. > >> Current implementation always allow a task to access its own > >> /proc/*/mem file. > >> A process can use it to overwrite read-only memory, making > >> pointless the use of security_file_mprotect() or other ways to > >> enforce RO memory. > > > > You can do it in security_ptrace_access_check() > > No, because that hook is skipped when mm == current->mm: > https://elixir.bootlin.com/linux/v4.17-rc6/source/kernel/fork.c#L1111 OK > > or security_file_open() > > This is true, but it looks a bit overkill to me, especially since many of > the macros/functions used to handle proc's files won't be in scope > for an external LSM. > Is there any particular reason why you prefer it done via LSM? Well, it exists to implement all kinds of non-standard restrictions. You're probably blacklisting mprotect() and worry that compromised program might use /proc/self/mem instead. But you need to blacklist much more that mprotect(). I think forking a dummy "worker" process to open your /proc/*/mem and pass a descriptor back should still work with your patch. -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2018-05-26 17:59 UTC|newest] Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-05-26 14:50 [PATCH] proc: prevent a task from writing on its own /proc/*/mem Salvatore Mesoraca 2018-05-26 14:50 ` Salvatore Mesoraca 2018-05-26 15:48 ` Alexey Dobriyan 2018-05-26 15:48 ` Alexey Dobriyan 2018-05-26 17:30 ` Salvatore Mesoraca 2018-05-26 17:30 ` Salvatore Mesoraca 2018-05-26 17:53 ` Casey Schaufler 2018-05-26 17:53 ` Casey Schaufler 2018-05-26 17:58 ` Alexey Dobriyan [this message] 2018-05-26 17:58 ` Alexey Dobriyan 2018-05-27 0:31 ` Kees Cook 2018-05-27 0:31 ` Kees Cook 2018-05-27 1:33 ` Linus Torvalds 2018-05-27 1:33 ` Linus Torvalds 2018-05-27 14:41 ` Kees Cook 2018-05-27 14:41 ` Kees Cook 2018-05-28 9:32 ` Salvatore Mesoraca 2018-05-28 9:32 ` Salvatore Mesoraca 2018-06-04 16:57 ` Steve Kemp 2018-06-04 16:57 ` Steve Kemp 2018-06-04 16:57 ` Steve Kemp 2018-06-04 18:03 ` Casey Schaufler 2018-06-04 18:03 ` Casey Schaufler 2018-06-10 7:40 ` Salvatore Mesoraca 2018-06-10 7:40 ` Salvatore Mesoraca 2018-05-28 9:06 ` Jann Horn 2018-05-28 9:06 ` Jann Horn 2018-05-28 9:33 ` Salvatore Mesoraca 2018-05-28 9:33 ` Salvatore Mesoraca
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20180526175858.GA19115@avx2 \ --to=adobriyan@gmail.com \ --cc=akinobu.mita@gmail.com \ --cc=akpm@linux-foundation.org \ --cc=arnd@arndb.de \ --cc=dave@stgolabs.net \ --cc=dvyukov@google.com \ --cc=keescook@chromium.org \ --cc=kernel-hardening@lists.openwall.com \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=linux-security-module@vger.kernel.org \ --cc=s.mesoraca16@gmail.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.