From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754176AbcGZIex (ORCPT ); Tue, 26 Jul 2016 04:34:53 -0400 Received: from mail-lf0-f68.google.com ([209.85.215.68]:34498 "EHLO mail-lf0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751692AbcGZIet (ORCPT ); Tue, 26 Jul 2016 04:34:49 -0400 Date: Tue, 26 Jul 2016 11:34:45 +0300 From: Cyrill Gorcunov To: "Eric W. Biederman" Cc: Stanislav Kinsburskiy , peterz@infradead.org, mingo@redhat.com, mhocko@suse.com, keescook@chromium.org, linux-kernel@vger.kernel.org, mguzik@redhat.com, bsegall@google.com, john.stultz@linaro.org, oleg@redhat.com, matthltc@us.ibm.com, akpm@linux-foundation.org, luto@amacapital.net, vbabka@suse.cz, xemul@virtuozzo.com Subject: Re: [PATCH] prctl: remove one-shot limitation for changing exe link Message-ID: <20160726083445.GB26208@uranus> References: <20160712152940.24895.61315.stgit@localhost.localdomain> <8a863273-c571-63d6-c0c3-637dff5645a3@virtuozzo.com> <87y44pbmtc.fsf@x220.int.ebiederm.org> <20160725192242.GA26208@uranus> <87a8h58pac.fsf@x220.int.ebiederm.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <87a8h58pac.fsf@x220.int.ebiederm.org> User-Agent: Mutt/1.6.1 (2016-04-27) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Jul 25, 2016 at 02:56:43PM -0500, Eric W. Biederman wrote: ... > >> > >> Also there is a big fat bug in prctl_set_mm_exe_file. It doesn't > >> validate that the new file is a actually mmaped executable. We would > >> definitely need that to be fixed before even considering removing the > >> limit. > > > > Could you please elaborate? We check for inode being executable, > > what else needed? > > That the inode is mmaped into the process with executable mappings. > > Effectively what we check the old mapping for and refuse to remove the old > mm_exe_file if it exists. > > I think a reasonable argument can be made that if the file is > executable, and it is mmaped with executable pages that exe_file is not > a complete lie. I might be missing something obvious, so sorry for the question -- when criu setups old exe link the inode we obtain from file open is not mapped into memory, the old exe not read by anyone because it's not even executed anyhow. So I don't really understand which mapping we should check here. Mind to point me? > Which is the important part. At the end of the day how much can > userspace trust /proc/pid/exe? If we are too lax it is just a random > file descriptor we can not trust at all. At which point there is > exactly no point in preserving it in checkpoint/restart, because nothing > will trust or look at it. You know, I think we should not trust exe link much, and in real we never could: this link is rather a hint pointing which executable a process has been using on execve call, once the process start working one can't be sure if the code currently running is exactly from the file pointed by exe link. It just a hint suitable for debuggin and obtain clean view of which processes are running on noncompromised system. Monitoring exe link change won't help much if there are malicious software running on the system. > If the only user is checkpoint/restart perhaps it should be only ptrace > that can set this and not the process itself with a prctl. I don't > know. All I know is that we should work on making it a very trustable > value even though in some specific instances we can set it. Since as I said I suppose nobody except us using this feature, we can setup some sysctl trigger for it (I personally think this is an overkill, but OTOH if people rely on the exe link and not going to use criu at all, this trigger will help). Cyrill