From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matt Helsley Subject: Re: [PATCH v2] futex: mark get_robust_list as deprecated Date: Thu, 29 Mar 2012 22:05:44 -0700 Message-ID: <20120330050544.GA32299@count0.beaverton.ibm.com> References: <20120323190855.GA27213@www.outflux.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: "Eric W. Biederman" Cc: Pavel Emelyanov , spender-JNS0hek0TMl4qEwOxq4T+Q@public.gmane.org, Kees Cook , linux-doc-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Jiri Kosina , Darren Hart , kernel-hardening-ZwoEplunGu1jrUoiu81ncdBPR1lH4CV8@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Andrew Morton , David Howells , Gene Cooperman , Randy Dunlap , Cyrill Gorcunov , Thomas Gleixner , Linux Containers , Peter Zijlstra List-Id: containers.vger.kernel.org On Fri, Mar 23, 2012 at 03:06:02PM -0700, Eric W. Biederman wrote: > Kees Cook writes: > > > Notify get_robust_list users that the syscall is going away. > > Has anyone asked the question if the folks working on checkpoint/restart > are going to need this. > > This seems like important information to know if you want to checkpoint > a process. I have no idea if the CRIU and DMTCP folks care about this. I've added some folks related to those projects to the Cc list. > > Eric > > > Suggested-by: Thomas Gleixner > > Signed-off-by: Kees Cook > > --- > > v2: > > - add note to feature-removal-schedule.txt. > > --- > > Documentation/feature-removal-schedule.txt | 10 ++++++++++ > > kernel/futex.c | 2 ++ > > kernel/futex_compat.c | 2 ++ > > 3 files changed, 14 insertions(+), 0 deletions(-) > > > > diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt > > index 4bfd982..e3bf119 100644 > > --- a/Documentation/feature-removal-schedule.txt > > +++ b/Documentation/feature-removal-schedule.txt > > @@ -543,3 +543,13 @@ When: 3.5 > > Why: The old kmap_atomic() with two arguments is deprecated, we only > > keep it for backward compatibility for few cycles and then drop it. > > Who: Cong Wang > > + > > +---------------------------- > > + > > +What: get_robust_list syscall > > +When: 2013 > > +Why: There appear to be no production users of the get_robust_list syscall, > > + and it runs the risk of leaking address locations, allowing the bypass > > + of ASLR. It was only ever intended for debugging, so it should be > > + removed. So I've looked in glibc, gdb, and DMTCP. The description of the intended use of get_robust_list() is accurate. However the benefit of ASLR is less clear when it comes to the robust list. In glibc the robust list is only used from NPTL. The robust list head is in struct pthread which can be obtained from pthread_self() anyway. Thus I think ASLR doesn't really help obfuscate the robust futex list unless the program is using robust futexes without the aid of glibc. Cheers, -Matt Helsley From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751924Ab2C3FGb (ORCPT ); Fri, 30 Mar 2012 01:06:31 -0400 Received: from e35.co.us.ibm.com ([32.97.110.153]:52809 "EHLO e35.co.us.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750731Ab2C3FGZ (ORCPT ); Fri, 30 Mar 2012 01:06:25 -0400 Date: Thu, 29 Mar 2012 22:05:44 -0700 From: Matt Helsley To: "Eric W. Biederman" Cc: Kees Cook , spender@grsecurity.net, Peter Zijlstra , linux-doc@vger.kernel.org, Jiri Kosina , Darren Hart , kernel-hardening@lists.openwall.com, linux-kernel@vger.kernel.org, David Howells , Randy Dunlap , Linux Containers , Thomas Gleixner , Andrew Morton , Cyrill Gorcunov , Pavel Emelyanov , Gene Cooperman Subject: Re: [PATCH v2] futex: mark get_robust_list as deprecated Message-ID: <20120330050544.GA32299@count0.beaverton.ibm.com> References: <20120323190855.GA27213@www.outflux.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) X-Content-Scanned: Fidelis XPS MAILER x-cbid: 12033005-6148-0000-0000-000004A8EE0D Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Mar 23, 2012 at 03:06:02PM -0700, Eric W. Biederman wrote: > Kees Cook writes: > > > Notify get_robust_list users that the syscall is going away. > > Has anyone asked the question if the folks working on checkpoint/restart > are going to need this. > > This seems like important information to know if you want to checkpoint > a process. I have no idea if the CRIU and DMTCP folks care about this. I've added some folks related to those projects to the Cc list. > > Eric > > > Suggested-by: Thomas Gleixner > > Signed-off-by: Kees Cook > > --- > > v2: > > - add note to feature-removal-schedule.txt. > > --- > > Documentation/feature-removal-schedule.txt | 10 ++++++++++ > > kernel/futex.c | 2 ++ > > kernel/futex_compat.c | 2 ++ > > 3 files changed, 14 insertions(+), 0 deletions(-) > > > > diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt > > index 4bfd982..e3bf119 100644 > > --- a/Documentation/feature-removal-schedule.txt > > +++ b/Documentation/feature-removal-schedule.txt > > @@ -543,3 +543,13 @@ When: 3.5 > > Why: The old kmap_atomic() with two arguments is deprecated, we only > > keep it for backward compatibility for few cycles and then drop it. > > Who: Cong Wang > > + > > +---------------------------- > > + > > +What: get_robust_list syscall > > +When: 2013 > > +Why: There appear to be no production users of the get_robust_list syscall, > > + and it runs the risk of leaking address locations, allowing the bypass > > + of ASLR. It was only ever intended for debugging, so it should be > > + removed. So I've looked in glibc, gdb, and DMTCP. The description of the intended use of get_robust_list() is accurate. However the benefit of ASLR is less clear when it comes to the robust list. In glibc the robust list is only used from NPTL. The robust list head is in struct pthread which can be obtained from pthread_self() anyway. Thus I think ASLR doesn't really help obfuscate the robust futex list unless the program is using robust futexes without the aid of glibc. Cheers, -Matt Helsley From mboxrd@z Thu Jan 1 00:00:00 1970 Reply-To: kernel-hardening@lists.openwall.com Date: Thu, 29 Mar 2012 22:05:44 -0700 From: Matt Helsley Message-ID: <20120330050544.GA32299@count0.beaverton.ibm.com> References: <20120323190855.GA27213@www.outflux.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Subject: [kernel-hardening] Re: [PATCH v2] futex: mark get_robust_list as deprecated To: "Eric W. Biederman" Cc: Kees Cook , spender@grsecurity.net, Peter Zijlstra , linux-doc@vger.kernel.org, Jiri Kosina , Darren Hart , kernel-hardening@lists.openwall.com, linux-kernel@vger.kernel.org, David Howells , Randy Dunlap , Linux Containers , Thomas Gleixner , Andrew Morton , Cyrill Gorcunov , Pavel Emelyanov , Gene Cooperman List-ID: On Fri, Mar 23, 2012 at 03:06:02PM -0700, Eric W. Biederman wrote: > Kees Cook writes: > > > Notify get_robust_list users that the syscall is going away. > > Has anyone asked the question if the folks working on checkpoint/restart > are going to need this. > > This seems like important information to know if you want to checkpoint > a process. I have no idea if the CRIU and DMTCP folks care about this. I've added some folks related to those projects to the Cc list. > > Eric > > > Suggested-by: Thomas Gleixner > > Signed-off-by: Kees Cook > > --- > > v2: > > - add note to feature-removal-schedule.txt. > > --- > > Documentation/feature-removal-schedule.txt | 10 ++++++++++ > > kernel/futex.c | 2 ++ > > kernel/futex_compat.c | 2 ++ > > 3 files changed, 14 insertions(+), 0 deletions(-) > > > > diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt > > index 4bfd982..e3bf119 100644 > > --- a/Documentation/feature-removal-schedule.txt > > +++ b/Documentation/feature-removal-schedule.txt > > @@ -543,3 +543,13 @@ When: 3.5 > > Why: The old kmap_atomic() with two arguments is deprecated, we only > > keep it for backward compatibility for few cycles and then drop it. > > Who: Cong Wang > > + > > +---------------------------- > > + > > +What: get_robust_list syscall > > +When: 2013 > > +Why: There appear to be no production users of the get_robust_list syscall, > > + and it runs the risk of leaking address locations, allowing the bypass > > + of ASLR. It was only ever intended for debugging, so it should be > > + removed. So I've looked in glibc, gdb, and DMTCP. The description of the intended use of get_robust_list() is accurate. However the benefit of ASLR is less clear when it comes to the robust list. In glibc the robust list is only used from NPTL. The robust list head is in struct pthread which can be obtained from pthread_self() anyway. Thus I think ASLR doesn't really help obfuscate the robust futex list unless the program is using robust futexes without the aid of glibc. Cheers, -Matt Helsley