Re: Should mprotect(..., PROT_EXEC) be checked by IMA? - Perez Yves-Alexis

From: Perez Yves-Alexis <yves-alexis.perez@ssi.gouv.fr>
To: Mimi Zohar <zohar@linux.ibm.com>,
	Matthew Garrett <mjg59@google.com>,
	Igor Zhbanov <i.zhbanov@omprussia.ru>
Cc: "Stephen Smalley" <sds@tycho.nsa.gov>,
	"Kees Cook" <keescook@chromium.org>,
	"Casey Schaufler" <casey@schaufler-ca.com>,
	"Paul Moore" <paul@paul-moore.com>,
	"John Johansen" <john.johansen@canonical.com>,
	linux-integrity <linux-integrity@vger.kernel.org>,
	"Jann Horn" <jannh@google.com>,
	linux-security-module <linux-security-module@vger.kernel.org>,
	"Mickaël Salaün" <mickael.salaun@ssi.gouv.fr>,
	"Yves-Alexis Perez" <corsac@corsac.net>,
	"Mickaël Salaün" <mic@digikod.net>
Subject: Re: Should mprotect(..., PROT_EXEC) be checked by IMA?
Date: Wed, 3 Apr 2019 15:18:00 +0200	[thread overview]
Message-ID: <1d8264fb-495b-3b68-0192-0338247e6b54@ssi.gouv.fr> (raw)
In-Reply-To: <1554293478.7309.54.camel@linux.ibm.com>

Le 03/04/2019 à 14:11, Mimi Zohar a écrit :
> On Tue, 2019-04-02 at 15:31 -0700, Matthew Garrett wrote:
>> On Fri, Mar 29, 2019 at 5:50 AM Igor Zhbanov <i.zhbanov@omprussia.ru> wrote:
>>> I want to be sure that no unsigned code page could be executed. So exploits
>>> could only be of ROP kind and not being able to download any extra code
>>> from their servers. That's why I found that disabling of anonymous executable
>>> pages could be useful for that (as well as disabling of making executable
>>> pages writable to modify already mapped code). In conjunction with IMA it
>>> should guarantee that no untrusted code could be executed.
>>
>> Remember that many interpreted languages allow execution of code
>> provided to them on the command line (eg, python -c) and also grant
>> access to arbitrary syscalls, so there's still no guarantee that
>> you're only executing trusted code.
>
> Interpreters are a known concern, as Yves-Alexis Perez pointed out in
> his LSS-2018 Europe talk[1].
>
> Mimi
>
> [1] https://events.linuxfoundation.org/wp-content/uploads/2017/12/Linu
> x-Kernel-Security-Contributions-by-ANSSI-Yves-Alexis-Perez-ANSSI.pdf
>
And Mickaël Salaün posted the O_MAYEXEC patch RFC back in December
(https://lore.kernel.org/lkml/20181212081712.32347-1-mic@digikod.net/)

Regards,
--
Yves-Alexis Perez
ANSSI/SDE/ST/LAM
Les données à caractère personnel recueillies et traitées dans le cadre de cet échange, le sont à seule fin d’exécution d’une relation professionnelle et s’opèrent dans cette seule finalité et pour la durée nécessaire à cette relation. Si vous souhaitez faire usage de vos droits de consultation, de rectification et de suppression de vos données, veuillez contacter contact.rgpd@sgdsn.gouv.fr. Si vous avez reçu ce message par erreur, nous vous remercions d’en informer l’expéditeur et de détruire le message. The personal data collected and processed during this exchange aims solely at completing a business relationship and is limited to the necessary duration of that relationship. If you wish to use your rights of consultation, rectification and deletion of your data, please contact: contact.rgpd@sgdsn.gouv.fr. If you have received this message in error, we thank you for informing the sender and destroying the message.