From: "Mickaël Salaün" <mickael.salaun@ssi.gouv.fr> To: Aleksa Sarai <cyphar@cyphar.com>, Andy Lutomirski <luto@amacapital.net> Cc: "Steve Grubb" <sgrubb@redhat.com>, "Florian Weimer" <fweimer@redhat.com>, "Mickaël Salaün" <mic@digikod.net>, linux-kernel@vger.kernel.org, "Alexei Starovoitov" <ast@kernel.org>, "Al Viro" <viro@zeniv.linux.org.uk>, "Andy Lutomirski" <luto@kernel.org>, "Christian Heimes" <christian@python.org>, "Daniel Borkmann" <daniel@iogearbox.net>, "Eric Chiang" <ericchiang@google.com>, "James Morris" <jmorris@namei.org>, "Jan Kara" <jack@suse.cz>, "Jann Horn" <jannh@google.com>, "Jonathan Corbet" <corbet@lwn.net>, "Kees Cook" <keescook@chromium.org>, "Matthew Garrett" <mjg59@google.com>, "Matthew Wilcox" <willy@infradead.org>, "Michael Kerrisk" <mtk.manpages@gmail.com>, "Mimi Zohar" <zohar@linux.ibm.com>, "Philippe Trébuchet" <philippe.trebuchet@ssi.gouv.fr>, "Scott Shell" <scottsh@microsoft.com>, "Sean Christopherson" <sean.j.christopherson@intel.com>, "Shuah Khan" <shuah@kernel.org>, "Song Liu" <songliubraving@fb.com>, "Steve Dower" <steve.dower@python.org>, "Thibaut S autereau" <thibaut.sautereau@ssi.gouv.fr>, "Vincent Strubel" <vincent.strubel@ssi.gouv.fr>, "Yves-Alexis Perez" <yves-alexis.perez@ssi.gouv.fr>, kernel-hardening@lists.openwall.com, linux-api@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org Subject: Re: [PATCH v2 0/5] Add support for O_MAYEXEC Date: Mon, 9 Sep 2019 11:09:24 +0200 [thread overview] Message-ID: <70e4244e-4dfb-6e67-416b-445e383aa1b5@ssi.gouv.fr> (raw) In-Reply-To: <20190906224410.lffd6l5lnm4z3hht@yavin.dot.cyphar.com> On 07/09/2019 00:44, Aleksa Sarai wrote: > On 2019-09-06, Andy Lutomirski <luto@amacapital.net> wrote: >>> On Sep 6, 2019, at 12:07 PM, Steve Grubb <sgrubb@redhat.com> wrote: >>> >>>> On Friday, September 6, 2019 2:57:00 PM EDT Florian Weimer wrote: >>>> * Steve Grubb: >>>>> Now with LD_AUDIT >>>>> $ LD_AUDIT=/home/sgrubb/test/openflags/strip-flags.so.0 strace ./test >>>>> 2>&1 | grep passwd openat(3, "passwd", O_RDONLY) = 4 >>>>> >>>>> No O_CLOEXEC flag. >>>> >>>> I think you need to explain in detail why you consider this a problem. Right, LD_PRELOAD and such things are definitely not part of the threat model for O_MAYEXEC, on purpose, because this must be addressed with other security mechanism (e.g. correct file system access-control, IMA policy, SELinux or other LSM security policies). This is a requirement for O_MAYEXEC to be useful. An interpreter is just a flexible program which is generic and doesn't have other purpose other than behaving accordingly to external rules (i.e. scripts). If you don't trust your interpreter, it should not be executable in the first place. O_MAYEXEC enables to restrict the use of (some) interpreters accordingly to a *global* system security policy. >>> >>> Because you can strip the O_MAYEXEC flag from being passed into the kernel. >>> Once you do that, you defeat the security mechanism because it never gets >>> invoked. The issue is that the only thing that knows _why_ something is being >>> opened is user space. With this mechanism, you can attempt to pass this >>> reason to the kernel so that it may see if policy permits this. But you can >>> just remove the flag. >> >> I’m with Florian here. Once you are executing code in a process, you >> could just emulate some other unapproved code. This series is not >> intended to provide the kind of absolute protection you’re imagining. > > I also agree, though I think that there is a separate argument to be > made that there are two possible problems with O_MAYEXEC (which might > not be really big concerns): > > * It's very footgun-prone if you didn't call O_MAYEXEC yourself and > you pass the descriptor elsewhere. You need to check f_flags to see > if it contains O_MAYEXEC. Maybe there is an argument to be made that > passing O_MAYEXECs around isn't a valid use-case, but in that case > there should be some warnings about that. That could be an issue if you don't trust your system, especially if the mount points (and the "noexec" option) can be changed by untrusted users. As I said above, there is a requirement for basic security properties as a meaningful file system access control, and obviously not letting any user change mount points (which can lead to much sever security issues anyway). If a process A pass a FD to an interpreter B, then the interpreter B must trust the process A. Moreover, being able to tell if the FD was open with O_MAYEXEC and relying on it may create a wrong feeling of security. As I said in a previous email, being able to probe for O_MAYEXEC does not make sense because it would not be enough to know the system policy (either this flag is enforced or not, for mount points, based on xattr, time…). The main goal of O_MAYEXEC is to ask the kernel, on a trusted link (hence without LD_PRELOAD-like interfering), for a file which is allowed to be interpreted/executed by this interpreter. To be able to correctly handle the case you pointed out (FD passing), either an existing or a new LSM should handle this behavior according to the origin of the FD and the chain of processes getting it. Some advanced LSM rules could tie interpreters with scripts dedicated to them, and have different behavior for the same scripts but with different interpreters. > > * There's effectively a TOCTOU flaw (even if you are sure O_MAYEXEC is > in f_flags) -- if the filesystem becomes re-mounted noexec (or the > file has a-x permissions) after you've done the check you won't get > hit with an error when you go to use the file descriptor later. Again, the threat model needs to be appropriate to make O_MAYEXEC useful. The security policies of the system need to be seen as a whole, and updated as such. As for most file system access control on Linux, it may be possible to have TOCTOU, but the whole system should be designed to protect against that. For example, changing file access control (e.g. mount point options) without a reboot may lead to inconsistent security properties, which is why such thing are discouraged by some access control systems (e.g. SELinux). > > To fix both you'd need to do what you mention later: > >> What the kernel *could* do is prevent mmapping a non-FMODE_EXEC file >> with PROT_EXEC, which would indeed have a real effect (in an iOS-like >> world, for example) but would break many, many things. > > And I think this would be useful (with the two possible ways of > executing .text split into FMODE_EXEC and FMODE_MAP_EXEC, as mentioned > in a sister subthread), but would have to be opt-in for the obvious > reason you outlined. However, we could make it the default for > openat2(2) -- assuming we can agree on what the semantics of a > theoretical FMODE_EXEC should be. > > And of course we'd need to do FMODE_UPGRADE_EXEC (which would need to > also permit fexecve(2) though probably not PROT_EXEC -- I don't think > you can mmap() an O_PATH descriptor). The mmapping restriction may be interesting but it is a different use case. This series address the interpreter/script problem. Either the script may be mapped executable is the choice of the interpreter. In most cases, no script are mapped as such, exactly because they are interpreted by a process but not by the CPU. -- Mickaël Salaün Les données à caractère personnel recueillies et traitées dans le cadre de cet échange, le sont à seule fin d’exécution d’une relation professionnelle et s’opèrent dans cette seule finalité et pour la durée nécessaire à cette relation. Si vous souhaitez faire usage de vos droits de consultation, de rectification et de suppression de vos données, veuillez contacter contact.rgpd@sgdsn.gouv.fr. Si vous avez reçu ce message par erreur, nous vous remercions d’en informer l’expéditeur et de détruire le message. The personal data collected and processed during this exchange aims solely at completing a business relationship and is limited to the necessary duration of that relationship. If you wish to use your rights of consultation, rectification and deletion of your data, please contact: contact.rgpd@sgdsn.gouv.fr. If you have received this message in error, we thank you for informing the sender and destroying the message.
WARNING: multiple messages have this Message-ID (diff)
From: "Mickaël Salaün" <mickael.salaun@ssi.gouv.fr> To: Aleksa Sarai <cyphar@cyphar.com>, Andy Lutomirski <luto@amacapital.net> Cc: "Steve Grubb" <sgrubb@redhat.com>, "Florian Weimer" <fweimer@redhat.com>, "Mickaël Salaün" <mic@digikod.net>, linux-kernel@vger.kernel.org, "Alexei Starovoitov" <ast@kernel.org>, "Al Viro" <viro@zeniv.linux.org.uk>, "Andy Lutomirski" <luto@kernel.org>, "Christian Heimes" <christian@python.org>, "Daniel Borkmann" <daniel@iogearbox.net>, "Eric Chiang" <ericchiang@google.com>, "James Morris" <jmorris@namei.org>, "Jan Kara" <jack@suse.cz>, "Jann Horn" <jannh@google.com>, "Jonathan Corbet" <corbet@lwn.net>, "Kees Cook" <keescook@chromium.org>, "Matthew Garrett" <mjg59@google.com>, "Matthew Wilcox" <willy@infradead.org>, "Michael Kerrisk" <mtk.manpages@gmail.com>, "Mimi Zohar" <zohar@linux.ibm.com>, "Philippe Trébuchet" <philippe.trebuchet@ssi.> Subject: Re: [PATCH v2 0/5] Add support for O_MAYEXEC Date: Mon, 9 Sep 2019 11:09:24 +0200 [thread overview] Message-ID: <70e4244e-4dfb-6e67-416b-445e383aa1b5@ssi.gouv.fr> (raw) In-Reply-To: <20190906224410.lffd6l5lnm4z3hht@yavin.dot.cyphar.com> On 07/09/2019 00:44, Aleksa Sarai wrote: > On 2019-09-06, Andy Lutomirski <luto@amacapital.net> wrote: >>> On Sep 6, 2019, at 12:07 PM, Steve Grubb <sgrubb@redhat.com> wrote: >>> >>>> On Friday, September 6, 2019 2:57:00 PM EDT Florian Weimer wrote: >>>> * Steve Grubb: >>>>> Now with LD_AUDIT >>>>> $ LD_AUDIT=/home/sgrubb/test/openflags/strip-flags.so.0 strace ./test >>>>> 2>&1 | grep passwd openat(3, "passwd", O_RDONLY) = 4 >>>>> >>>>> No O_CLOEXEC flag. >>>> >>>> I think you need to explain in detail why you consider this a problem. Right, LD_PRELOAD and such things are definitely not part of the threat model for O_MAYEXEC, on purpose, because this must be addressed with other security mechanism (e.g. correct file system access-control, IMA policy, SELinux or other LSM security policies). This is a requirement for O_MAYEXEC to be useful. An interpreter is just a flexible program which is generic and doesn't have other purpose other than behaving accordingly to external rules (i.e. scripts). If you don't trust your interpreter, it should not be executable in the first place. O_MAYEXEC enables to restrict the use of (some) interpreters accordingly to a *global* system security policy. >>> >>> Because you can strip the O_MAYEXEC flag from being passed into the kernel. >>> Once you do that, you defeat the security mechanism because it never gets >>> invoked. The issue is that the only thing that knows _why_ something is being >>> opened is user space. With this mechanism, you can attempt to pass this >>> reason to the kernel so that it may see if policy permits this. But you can >>> just remove the flag. >> >> I’m with Florian here. Once you are executing code in a process, you >> could just emulate some other unapproved code. This series is not >> intended to provide the kind of absolute protection you’re imagining. > > I also agree, though I think that there is a separate argument to be > made that there are two possible problems with O_MAYEXEC (which might > not be really big concerns): > > * It's very footgun-prone if you didn't call O_MAYEXEC yourself and > you pass the descriptor elsewhere. You need to check f_flags to see > if it contains O_MAYEXEC. Maybe there is an argument to be made that > passing O_MAYEXECs around isn't a valid use-case, but in that case > there should be some warnings about that. That could be an issue if you don't trust your system, especially if the mount points (and the "noexec" option) can be changed by untrusted users. As I said above, there is a requirement for basic security properties as a meaningful file system access control, and obviously not letting any user change mount points (which can lead to much sever security issues anyway). If a process A pass a FD to an interpreter B, then the interpreter B must trust the process A. Moreover, being able to tell if the FD was open with O_MAYEXEC and relying on it may create a wrong feeling of security. As I said in a previous email, being able to probe for O_MAYEXEC does not make sense because it would not be enough to know the system policy (either this flag is enforced or not, for mount points, based on xattr, time…). The main goal of O_MAYEXEC is to ask the kernel, on a trusted link (hence without LD_PRELOAD-like interfering), for a file which is allowed to be interpreted/executed by this interpreter. To be able to correctly handle the case you pointed out (FD passing), either an existing or a new LSM should handle this behavior according to the origin of the FD and the chain of processes getting it. Some advanced LSM rules could tie interpreters with scripts dedicated to them, and have different behavior for the same scripts but with different interpreters. > > * There's effectively a TOCTOU flaw (even if you are sure O_MAYEXEC is > in f_flags) -- if the filesystem becomes re-mounted noexec (or the > file has a-x permissions) after you've done the check you won't get > hit with an error when you go to use the file descriptor later. Again, the threat model needs to be appropriate to make O_MAYEXEC useful. The security policies of the system need to be seen as a whole, and updated as such. As for most file system access control on Linux, it may be possible to have TOCTOU, but the whole system should be designed to protect against that. For example, changing file access control (e.g. mount point options) without a reboot may lead to inconsistent security properties, which is why such thing are discouraged by some access control systems (e.g. SELinux). > > To fix both you'd need to do what you mention later: > >> What the kernel *could* do is prevent mmapping a non-FMODE_EXEC file >> with PROT_EXEC, which would indeed have a real effect (in an iOS-like >> world, for example) but would break many, many things. > > And I think this would be useful (with the two possible ways of > executing .text split into FMODE_EXEC and FMODE_MAP_EXEC, as mentioned > in a sister subthread), but would have to be opt-in for the obvious > reason you outlined. However, we could make it the default for > openat2(2) -- assuming we can agree on what the semantics of a > theoretical FMODE_EXEC should be. > > And of course we'd need to do FMODE_UPGRADE_EXEC (which would need to > also permit fexecve(2) though probably not PROT_EXEC -- I don't think > you can mmap() an O_PATH descriptor). The mmapping restriction may be interesting but it is a different use case. This series address the interpreter/script problem. Either the script may be mapped executable is the choice of the interpreter. In most cases, no script are mapped as such, exactly because they are interpreted by a process but not by the CPU. -- Mickaël Salaün Les données à caractère personnel recueillies et traitées dans le cadre de cet échange, le sont à seule fin d’exécution d’une relation professionnelle et s’opèrent dans cette seule finalité et pour la durée nécessaire à cette relation. Si vous souhaitez faire usage de vos droits de consultation, de rectification et de suppression de vos données, veuillez contacter contact.rgpd@sgdsn.gouv.fr. Si vous avez reçu ce message par erreur, nous vous remercions d’en informer l’expéditeur et de détruire le message. The personal data collected and processed during this exchange aims solely at completing a business relationship and is limited to the necessary duration of that relationship. If you wish to use your rights of consultation, rectification and deletion of your data, please contact: contact.rgpd@sgdsn.gouv.fr. If you have received this message in error, we thank you for informing the sender and destroying the message.
next prev parent reply other threads:[~2019-09-09 9:09 UTC|newest] Thread overview: 90+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-09-06 15:24 [PATCH v2 0/5] Add support for O_MAYEXEC Mickaël Salaün 2019-09-06 15:24 ` Mickaël Salaün 2019-09-06 15:24 ` [PATCH v2 1/5] fs: Add support for an O_MAYEXEC flag on sys_open() Mickaël Salaün 2019-09-06 15:24 ` Mickaël Salaün 2019-09-06 15:56 ` Florian Weimer 2019-09-06 15:56 ` Florian Weimer 2019-09-06 16:06 ` Mickaël Salaün 2019-09-06 16:06 ` Mickaël Salaün 2019-09-06 16:48 ` Jeff Layton 2019-09-06 16:48 ` Jeff Layton 2019-09-06 17:13 ` Aleksa Sarai 2019-09-06 17:13 ` Aleksa Sarai 2019-09-06 19:43 ` Jeff Layton 2019-09-06 19:43 ` Jeff Layton 2019-09-06 20:06 ` Andy Lutomirski 2019-09-06 20:06 ` Andy Lutomirski 2019-09-06 20:51 ` Jeff Layton 2019-09-06 20:51 ` Jeff Layton 2019-09-06 21:27 ` Andy Lutomirski 2019-09-06 21:27 ` Andy Lutomirski 2019-09-06 22:12 ` Aleksa Sarai 2019-09-06 22:12 ` Aleksa Sarai 2019-09-09 9:33 ` Mickaël Salaün 2019-09-09 9:33 ` Mickaël Salaün 2019-09-06 22:05 ` Aleksa Sarai 2019-09-06 22:05 ` Aleksa Sarai 2019-09-06 22:18 ` Aleksa Sarai 2019-09-06 22:18 ` Aleksa Sarai 2019-09-06 17:14 ` Mickaël Salaün 2019-09-06 17:14 ` Mickaël Salaün 2019-09-06 18:38 ` Jeff Layton 2019-09-06 18:38 ` Jeff Layton 2019-09-06 18:41 ` Andy Lutomirski 2019-09-06 18:41 ` Andy Lutomirski 2019-09-09 9:18 ` Mickaël Salaün 2019-09-09 9:18 ` Mickaël Salaün 2019-09-09 15:49 ` Andy Lutomirski 2019-09-09 15:49 ` Andy Lutomirski 2019-09-06 18:44 ` Florian Weimer 2019-09-06 18:44 ` Florian Weimer 2019-09-06 19:03 ` James Morris 2019-09-06 19:03 ` James Morris 2019-09-09 9:25 ` Mickaël Salaün 2019-09-09 9:25 ` Mickaël Salaün 2019-09-09 10:12 ` James Morris 2019-09-09 10:12 ` James Morris 2019-09-09 10:54 ` Mickaël Salaün 2019-09-09 10:54 ` Mickaël Salaün 2019-09-09 12:28 ` Aleksa Sarai 2019-09-09 12:28 ` Aleksa Sarai 2019-09-09 12:33 ` Mickaël Salaün 2019-09-09 12:33 ` Mickaël Salaün 2019-09-09 11:54 ` Aleksa Sarai 2019-09-09 11:54 ` Aleksa Sarai 2019-09-09 12:28 ` Mickaël Salaün 2019-09-09 12:28 ` Mickaël Salaün 2019-09-06 17:07 ` Aleksa Sarai 2019-09-06 17:07 ` Aleksa Sarai 2019-09-06 17:20 ` Christian Brauner 2019-09-06 17:20 ` Christian Brauner 2019-09-06 17:24 ` Mickaël Salaün 2019-09-06 17:24 ` Mickaël Salaün 2019-09-06 17:40 ` Tycho Andersen 2019-09-06 17:40 ` Tycho Andersen 2019-09-06 18:27 ` Florian Weimer 2019-09-06 18:27 ` Florian Weimer 2019-09-06 18:46 ` Tycho Andersen 2019-09-06 18:46 ` Tycho Andersen 2019-09-06 15:24 ` [PATCH v2 2/5] fs: Add a MAY_EXECMOUNT flag to infer the noexec mount propertie Mickaël Salaün 2019-09-06 15:24 ` Mickaël Salaün 2019-09-06 15:24 ` [PATCH v2 3/5] fs: Enable to enforce noexec mounts or file exec through O_MAYEXEC Mickaël Salaün 2019-09-06 15:24 ` Mickaël Salaün 2019-09-06 15:24 ` [PATCH v2 4/5] selftest/exec: Add tests for O_MAYEXEC enforcing Mickaël Salaün 2019-09-06 15:24 ` Mickaël Salaün 2019-09-06 15:24 ` [PATCH v2 5/5] doc: Add documentation for the fs.open_mayexec_enforce sysctl Mickaël Salaün 2019-09-06 15:24 ` Mickaël Salaün 2019-09-06 18:50 ` [PATCH v2 0/5] Add support for O_MAYEXEC Steve Grubb 2019-09-06 18:50 ` Steve Grubb 2019-09-06 18:57 ` Florian Weimer 2019-09-06 18:57 ` Florian Weimer 2019-09-06 19:07 ` Steve Grubb 2019-09-06 19:07 ` Steve Grubb 2019-09-06 19:26 ` Andy Lutomirski 2019-09-06 19:26 ` Andy Lutomirski 2019-09-06 22:44 ` Aleksa Sarai 2019-09-06 22:44 ` Aleksa Sarai 2019-09-09 9:09 ` Mickaël Salaün [this message] 2019-09-09 9:09 ` Mickaël Salaün 2019-09-09 0:16 ` James Morris 2019-09-09 0:16 ` James Morris
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=70e4244e-4dfb-6e67-416b-445e383aa1b5@ssi.gouv.fr \ --to=mickael.salaun@ssi.gouv.fr \ --cc=ast@kernel.org \ --cc=christian@python.org \ --cc=corbet@lwn.net \ --cc=cyphar@cyphar.com \ --cc=daniel@iogearbox.net \ --cc=ericchiang@google.com \ --cc=fweimer@redhat.com \ --cc=jack@suse.cz \ --cc=jannh@google.com \ --cc=jmorris@namei.org \ --cc=keescook@chromium.org \ --cc=kernel-hardening@lists.openwall.com \ --cc=linux-api@vger.kernel.org \ --cc=linux-fsdevel@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=luto@amacapital.net \ --cc=luto@kernel.org \ --cc=mic@digikod.net \ --cc=mjg59@google.com \ --cc=mtk.manpages@gmail.com \ --cc=philippe.trebuchet@ssi.gouv.fr \ --cc=scottsh@microsoft.com \ --cc=sean.j.christopherson@intel.com \ --cc=sgrubb@redhat.com \ --cc=shuah@kernel.org \ --cc=songliubraving@fb.com \ --cc=steve.dower@python.org \ --cc=thibaut.sautereau@ssi.gouv.fr \ --cc=vincent.strubel@ssi.gouv.fr \ --cc=viro@zeniv.linux.org.uk \ --cc=willy@infradead.org \ --cc=yves-alexis.perez@ssi.gouv.fr \ --cc=zohar@linux.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.