From: Steve Grubb <sgrubb@redhat.com> To: Florian Weimer <fweimer@redhat.com> Cc: "Jan Kara" <jack@suse.cz>, "Mickaël Salaün" <mic@digikod.net>, linux-kernel@vger.kernel.org, "Al Viro" <viro@zeniv.linux.org.uk>, "James Morris" <jmorris@namei.org>, "Jonathan Corbet" <corbet@lwn.net>, "Kees Cook" <keescook@chromium.org>, "Matthew Garrett" <mjg59@google.com>, "Michael Kerrisk" <mtk.manpages@gmail.com>, "Mickaël Salaün" <mickael.salaun@ssi.gouv.fr>, "Mimi Zohar" <zohar@linux.ibm.com>, "Philippe Trébuchet" <philippe.trebuchet@ssi.gouv.fr>, "Shuah Khan" <shuah@kernel.org>, "Thibaut Sautereau" <thibaut.sautereau@ssi.gouv.fr>, "Vincent Strubel" <vincent.strubel@ssi.gouv.fr>, "Yves-Alexis Perez" <yves-alexis.perez@ssi.gouv.fr>, kernel-hardening@lists.openwall.com, linux-api@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org, "Matthew Bobrowski" <mbobrowski@mbobrowski.org> Subject: Re: [RFC PATCH v1 1/5] fs: Add support for an O_MAYEXEC flag on sys_open() Date: Tue, 16 Apr 2019 11:34:07 -0400 [thread overview] Message-ID: <2361288.r9sZr2NHLB@x2> (raw) In-Reply-To: <87wojuxj8s.fsf@oldenburg2.str.redhat.com> On Tuesday, April 16, 2019 7:49:39 AM EDT Florian Weimer wrote: > * Steve Grubb: > > This flag that is being proposed means that you would have to patch all > > interpreters to use it. If you are sure that upstreams will accept that, > > why not just change the policy to interpreters shouldn't execute > > anything unless the execute bit is set? That is simpler and doesn't need > > a kernel change. And setting the execute bit is an auditable event. > > I think we need something like O_MAYEXEC so that security policies can > be enforced and noexec mounts can be detected. Application whitelisting can already today stop unknown software without needing O_MAYEXEC. > I don't think it's a good idea to do this in userspace, especially the > latter. The problem is that passing O_MAYEXEC is opt-in. You can use ptrace/seccomp/ bpf/LD_PRELOAD/LD_AUDIT to remove that bit from an otherwise normal program. This does not require privs to do so. But let's consider that this comes to pass and every interpreter is updated and IMA can see the O_MAYEXEC flag. Attackers now simply pivot to running programs via stdin. It never touches disk and therefore nothing enforces security policy. This already is among the most common ways that malware runs today to evade detection. -Steve
WARNING: multiple messages have this Message-ID (diff)
From: Steve Grubb <sgrubb@redhat.com> To: Florian Weimer <fweimer@redhat.com> Cc: "Jan Kara" <jack@suse.cz>, "Mickaël Salaün" <mic@digikod.net>, linux-kernel@vger.kernel.org, "Al Viro" <viro@zeniv.linux.org.uk>, "James Morris" <jmorris@namei.org>, "Jonathan Corbet" <corbet@lwn.net>, "Kees Cook" <keescook@chromium.org>, "Matthew Garrett" <mjg59@google.com>, "Michael Kerrisk" <mtk.manpages@gmail.com>, "Mickaël Salaün" <mickael.salaun@ssi.gouv.fr>, "Mimi Zohar" <zohar@linux.ibm.com>, "Philippe Trébuchet" <philippe.trebuchet@ssi.gouv.fr>, "Shuah Khan" <shuah@kernel.org>, "Thibaut Sautereau" <thibaut.sautereau@ssi.gouv.fr>, "Vincent Strubel" <vincent.strubel@ssi.gouv.fr>, "Yves-Alexis Perez" <yves-alexis.perez@ssi.gouv.fr>, kernel-hardening@lists.openwall.com, linux-api@vger.kernel.org, linux-security-module@vge Subject: Re: [RFC PATCH v1 1/5] fs: Add support for an O_MAYEXEC flag on sys_open() Date: Tue, 16 Apr 2019 11:34:07 -0400 [thread overview] Message-ID: <2361288.r9sZr2NHLB@x2> (raw) In-Reply-To: <87wojuxj8s.fsf@oldenburg2.str.redhat.com> On Tuesday, April 16, 2019 7:49:39 AM EDT Florian Weimer wrote: > * Steve Grubb: > > This flag that is being proposed means that you would have to patch all > > interpreters to use it. If you are sure that upstreams will accept that, > > why not just change the policy to interpreters shouldn't execute > > anything unless the execute bit is set? That is simpler and doesn't need > > a kernel change. And setting the execute bit is an auditable event. > > I think we need something like O_MAYEXEC so that security policies can > be enforced and noexec mounts can be detected. Application whitelisting can already today stop unknown software without needing O_MAYEXEC. > I don't think it's a good idea to do this in userspace, especially the > latter. The problem is that passing O_MAYEXEC is opt-in. You can use ptrace/seccomp/ bpf/LD_PRELOAD/LD_AUDIT to remove that bit from an otherwise normal program. This does not require privs to do so. But let's consider that this comes to pass and every interpreter is updated and IMA can see the O_MAYEXEC flag. Attackers now simply pivot to running programs via stdin. It never touches disk and therefore nothing enforces security policy. This already is among the most common ways that malware runs today to evade detection. -Steve
next prev parent reply other threads:[~2019-04-16 15:34 UTC|newest] Thread overview: 68+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-12-12 8:17 [RFC PATCH v1 0/5] Add support for O_MAYEXEC Mickaël Salaün 2018-12-12 8:17 ` [RFC PATCH v1 1/5] fs: Add support for an O_MAYEXEC flag on sys_open() Mickaël Salaün 2018-12-12 14:43 ` Jan Kara 2018-12-12 14:43 ` Jan Kara 2018-12-12 14:43 ` Jan Kara 2018-12-12 17:09 ` Mickaël Salaün 2018-12-12 20:42 ` Mimi Zohar 2018-12-13 9:47 ` Matthew Bobrowski 2018-12-13 9:47 ` Matthew Bobrowski 2018-12-13 9:47 ` Matthew Bobrowski 2018-12-13 14:23 ` Mickaël Salaün 2019-04-15 18:47 ` Steve Grubb 2019-04-15 18:47 ` Steve Grubb 2019-04-16 11:49 ` Florian Weimer 2019-04-16 11:49 ` Florian Weimer 2019-04-16 15:34 ` Steve Grubb [this message] 2019-04-16 15:34 ` Steve Grubb 2019-04-17 10:01 ` Florian Weimer 2019-04-17 10:01 ` Florian Weimer 2019-04-17 15:04 ` Mickaël Salaün 2019-04-17 15:04 ` Mickaël Salaün 2019-04-17 14:55 ` Mickaël Salaün 2019-08-04 23:55 ` Andy Lutomirski 2019-08-04 23:55 ` Andy Lutomirski 2019-08-04 23:55 ` Andy Lutomirski 2019-08-06 16:40 ` Mickaël Salaün 2019-08-06 16:40 ` Mickaël Salaün 2018-12-12 8:17 ` [RFC PATCH v1 2/5] fs: Add a MAY_EXECMOUNT flag to infer the noexec mount propertie Mickaël Salaün 2018-12-12 8:17 ` [RFC PATCH v1 3/5] Yama: Enforces noexec mounts or file executability through O_MAYEXEC Mickaël Salaün 2018-12-12 14:28 ` Mickaël Salaün 2018-12-12 14:28 ` Mickaël Salaün 2018-12-12 17:09 ` Jann Horn 2018-12-13 14:49 ` Mickaël Salaün 2018-12-13 14:49 ` Mickaël Salaün 2019-01-03 11:17 ` Jann Horn 2019-01-08 13:29 ` Mickaël Salaün 2019-01-08 23:30 ` Kees Cook 2019-01-08 23:30 ` Kees Cook 2019-01-09 13:41 ` Mickaël Salaün 2018-12-12 8:17 ` [RFC PATCH v1 4/5] selftest/yama: Add tests for O_MAYEXEC enforcing Mickaël Salaün 2018-12-12 8:17 ` [RFC PATCH v1 5/5] doc: Add documentation for Yama's open_mayexec_enforce Mickaël Salaün 2018-12-12 16:29 ` [RFC PATCH v1 0/5] Add support for O_MAYEXEC Jordan Glover 2018-12-12 16:29 ` Jordan Glover 2018-12-12 17:01 ` Mickaël Salaün 2018-12-12 17:01 ` Mickaël Salaün 2018-12-12 19:51 ` James Morris 2018-12-12 19:51 ` James Morris 2018-12-12 20:13 ` Florian Weimer 2018-12-12 23:40 ` James Morris 2018-12-13 5:13 ` Florian Weimer 2018-12-13 14:57 ` Mickaël Salaün 2018-12-13 3:02 ` Matthew Wilcox 2018-12-13 3:02 ` Matthew Wilcox 2018-12-13 5:22 ` Florian Weimer 2018-12-13 5:22 ` Florian Weimer 2018-12-13 11:04 ` Mimi Zohar 2018-12-13 11:26 ` Florian Weimer 2018-12-13 11:26 ` Florian Weimer 2018-12-13 12:16 ` Mimi Zohar 2018-12-13 12:16 ` Mimi Zohar 2018-12-13 12:16 ` Matthew Wilcox 2018-12-13 12:16 ` Matthew Wilcox 2018-12-13 15:17 ` Mickaël Salaün 2018-12-13 17:13 ` Matthew Wilcox 2018-12-13 17:13 ` Matthew Wilcox 2018-12-13 17:36 ` Mickaël Salaün 2018-12-13 17:44 ` Matthew Wilcox 2018-12-13 17:44 ` Matthew Wilcox
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=2361288.r9sZr2NHLB@x2 \ --to=sgrubb@redhat.com \ --cc=corbet@lwn.net \ --cc=fweimer@redhat.com \ --cc=jack@suse.cz \ --cc=jmorris@namei.org \ --cc=keescook@chromium.org \ --cc=kernel-hardening@lists.openwall.com \ --cc=linux-api@vger.kernel.org \ --cc=linux-fsdevel@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=mbobrowski@mbobrowski.org \ --cc=mic@digikod.net \ --cc=mickael.salaun@ssi.gouv.fr \ --cc=mjg59@google.com \ --cc=mtk.manpages@gmail.com \ --cc=philippe.trebuchet@ssi.gouv.fr \ --cc=shuah@kernel.org \ --cc=thibaut.sautereau@ssi.gouv.fr \ --cc=vincent.strubel@ssi.gouv.fr \ --cc=viro@zeniv.linux.org.uk \ --cc=yves-alexis.perez@ssi.gouv.fr \ --cc=zohar@linux.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.