From: Igor Stoppa <igor.stoppa@gmail.com> To: Matthew Wilcox <willy@infradead.org>, lazytyped <lazytyped@gmail.com>, dave.hansen@linux.intel.com Cc: keescook@chromium.org, paul@paul-moore.com, sds@tycho.nsa.gov, mhocko@kernel.org, corbet@lwn.net, labbott@redhat.com, david@fromorbit.com, rppt@linux.vnet.ibm.com, linux-security-module@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, Igor Stoppa <igor.stoppa@huawei.com>, Carlos Chinea Perez <carlos.chinea.perez@huawei.com>, Remi Denis Courmont <remi.denis.courmont@huawei.com> Subject: Re: [PATCH 7/9] Pmalloc Rare Write: modify selected pools Date: Thu, 26 Apr 2018 00:58:39 +0400 [thread overview] Message-ID: <6a28fa46-a6b4-2803-0f15-8c278811ec2f@gmail.com> (raw) In-Reply-To: <20180424144404.GF26636@bombadil.infradead.org> On 24/04/18 18:44, Matthew Wilcox wrote: > On Tue, Apr 24, 2018 at 02:32:36PM +0200, lazytyped wrote: >> On 4/24/18 1:50 PM, Matthew Wilcox wrote: >>> struct modifiable_data { >>> struct immutable_data *d; >>> ... >>> }; >>> >>> Then allocate a new pool, change d and destroy the old pool. >> >> With the above, you have just shifted the target of the arbitrary write >> from the immutable data itself to the pointer to the immutable data, so >> got no security benefit. > > There's always a pointer to the immutable data. How do you currently > get to the selinux context? file->f_security. You can't make 'file' > immutable, so file->f_security is the target of the arbitrary write. > All you can do is make life harder, and reduce the size of the target. In the patch that shows how to secure the selinux initialized state, there is a static _ro_after_init handle (the 'file' in your example), which is immutable, after init has completed. It is as immutable as any const data that is not optimized away. That is what the code uses to refer to the pmalloc data. Since the reference is static, I expect the code will use it through some offset, which will be in the code segment, which is also read-only, as much as the rest. Where is the writable pointer in this scenario? >> The goal of the patch is to reduce the window when stuff is writeable, >> so that an arbitrary write is likely to hit the time when data is read-only. > > Yes, reducing the size of the target in time as well as bytes. This patch > gives attackers a great roadmap (maybe even gadget) to unprotecting > a pool. Gadgets can be removed by inlining the function calls. Dave Hansen suggested I could do COW and replace the old page with the new one. I could implement that, if it is preferable, although I think it would be less efficient, for small writes, but it would not leave the current page mapped as writable, so there is certainly value in it. --- igor
WARNING: multiple messages have this Message-ID (diff)
From: igor.stoppa@gmail.com (Igor Stoppa) To: linux-security-module@vger.kernel.org Subject: [PATCH 7/9] Pmalloc Rare Write: modify selected pools Date: Thu, 26 Apr 2018 00:58:39 +0400 [thread overview] Message-ID: <6a28fa46-a6b4-2803-0f15-8c278811ec2f@gmail.com> (raw) In-Reply-To: <20180424144404.GF26636@bombadil.infradead.org> On 24/04/18 18:44, Matthew Wilcox wrote: > On Tue, Apr 24, 2018 at 02:32:36PM +0200, lazytyped wrote: >> On 4/24/18 1:50 PM, Matthew Wilcox wrote: >>> struct modifiable_data { >>> struct immutable_data *d; >>> ... >>> }; >>> >>> Then allocate a new pool, change d and destroy the old pool. >> >> With the above, you have just shifted the target of the arbitrary write >> from the immutable data itself to the pointer to the immutable data, so >> got no security benefit. > > There's always a pointer to the immutable data. How do you currently > get to the selinux context? file->f_security. You can't make 'file' > immutable, so file->f_security is the target of the arbitrary write. > All you can do is make life harder, and reduce the size of the target. In the patch that shows how to secure the selinux initialized state, there is a static _ro_after_init handle (the 'file' in your example), which is immutable, after init has completed. It is as immutable as any const data that is not optimized away. That is what the code uses to refer to the pmalloc data. Since the reference is static, I expect the code will use it through some offset, which will be in the code segment, which is also read-only, as much as the rest. Where is the writable pointer in this scenario? >> The goal of the patch is to reduce the window when stuff is writeable, >> so that an arbitrary write is likely to hit the time when data is read-only. > > Yes, reducing the size of the target in time as well as bytes. This patch > gives attackers a great roadmap (maybe even gadget) to unprotecting > a pool. Gadgets can be removed by inlining the function calls. Dave Hansen suggested I could do COW and replace the old page with the new one. I could implement that, if it is preferable, although I think it would be less efficient, for small writes, but it would not leave the current page mapped as writable, so there is certainly value in it. --- igor -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2018-04-25 20:58 UTC|newest] Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-04-23 12:54 [RFC PATCH v23 0/6] mm: security: write protection for dynamic data Igor Stoppa 2018-04-23 12:54 ` [PATCH 1/9] struct page: add field for vm_struct Igor Stoppa 2018-04-23 12:54 ` [PATCH 2/9] vmalloc: rename llist field in vmap_area Igor Stoppa 2018-04-23 12:54 ` [PATCH 3/9] Protectable Memory Igor Stoppa 2018-04-23 12:54 ` [PATCH 4/9] Documentation for Pmalloc Igor Stoppa 2018-04-23 12:54 ` [PATCH 5/9] Pmalloc selftest Igor Stoppa 2018-04-23 12:54 ` [PATCH 6/9] lkdtm: crash on overwriting protected pmalloc var Igor Stoppa 2018-04-23 12:54 ` [PATCH 7/9] Pmalloc Rare Write: modify selected pools Igor Stoppa 2018-04-24 11:50 ` Matthew Wilcox 2018-04-24 12:32 ` lazytyped 2018-04-24 12:32 ` lazytyped 2018-04-24 12:39 ` Igor Stoppa 2018-04-24 12:39 ` Igor Stoppa 2018-04-24 14:44 ` Matthew Wilcox 2018-04-24 15:03 ` lazytyped 2018-04-24 15:03 ` lazytyped 2018-04-24 15:29 ` Igor Stoppa 2018-04-25 20:58 ` Igor Stoppa [this message] 2018-04-25 20:58 ` Igor Stoppa 2018-04-24 12:33 ` Igor Stoppa 2018-04-24 12:33 ` Igor Stoppa 2018-04-24 17:04 ` Igor Stoppa 2018-04-24 17:04 ` Igor Stoppa 2018-04-24 17:04 ` Igor Stoppa 2018-05-03 21:52 ` Correct way to access the physmap? - Was: " Igor Stoppa 2018-05-03 21:52 ` Igor Stoppa 2018-05-03 21:55 ` Dave Hansen 2018-05-03 21:55 ` Dave Hansen 2018-05-03 22:52 ` Igor Stoppa 2018-05-03 22:52 ` Igor Stoppa 2018-04-23 12:54 ` [PATCH 8/9] Preliminary self test for pmalloc rare write Igor Stoppa 2018-04-23 12:54 ` [PATCH 9/9] Protect SELinux initialized state with pmalloc Igor Stoppa 2018-04-24 5:58 ` kbuild test robot 2018-04-24 5:58 ` kbuild test robot 2018-04-24 12:49 ` Stephen Smalley 2018-04-24 12:49 ` Stephen Smalley 2018-04-24 14:35 ` Igor Stoppa 2018-04-24 14:35 ` Igor Stoppa
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=6a28fa46-a6b4-2803-0f15-8c278811ec2f@gmail.com \ --to=igor.stoppa@gmail.com \ --cc=carlos.chinea.perez@huawei.com \ --cc=corbet@lwn.net \ --cc=dave.hansen@linux.intel.com \ --cc=david@fromorbit.com \ --cc=igor.stoppa@huawei.com \ --cc=keescook@chromium.org \ --cc=kernel-hardening@lists.openwall.com \ --cc=labbott@redhat.com \ --cc=lazytyped@gmail.com \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=linux-security-module@vger.kernel.org \ --cc=mhocko@kernel.org \ --cc=paul@paul-moore.com \ --cc=remi.denis.courmont@huawei.com \ --cc=rppt@linux.vnet.ibm.com \ --cc=sds@tycho.nsa.gov \ --cc=willy@infradead.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.