From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CA200C433FE for ; Thu, 21 Apr 2022 16:48:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232402AbiDUQvX (ORCPT ); Thu, 21 Apr 2022 12:51:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32866 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232072AbiDUQvW (ORCPT ); Thu, 21 Apr 2022 12:51:22 -0400 Received: from mail-lf1-x12d.google.com (mail-lf1-x12d.google.com [IPv6:2a00:1450:4864:20::12d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 73BDE49276; Thu, 21 Apr 2022 09:48:32 -0700 (PDT) Received: by mail-lf1-x12d.google.com with SMTP id w1so9741767lfa.4; Thu, 21 Apr 2022 09:48:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=message-id:date:mime-version:user-agent:subject:content-language:to :cc:references:from:in-reply-to:content-transfer-encoding; bh=H01S+Z7PoKhXtthwBx3mI1VVb20IHa0ThHfpXV2OsWk=; b=Te5bNS7bK0yTicPlwPilL/FHzAHcCqm56DhGAmSHJVeyNBi761kWJGIb9kl8TOYuck BiTT/cBsA/F5VgqiWxOJFnnaOZHoAT4gI5awBPaMEgiyrEJmcMFoF8VPBkGOxFB/SDy4 qqeDtPW45B92jzLhCXjMqi+0O7pfeh81IUjPs6/oytjFCbtCGr735rxBqlAvms8VYNT0 Jvb9G02yo002YknsCfyrj5wNC6z46s/QYuddL1MP5fcS9CizCQNamFZpPEZ8NcHpIzT4 CTDjLKjMhaRGxDTW8Gn5MvVYUXGQN4Ptv7zh47AOnsIAKcNf/WhNZKku9l22WYc3adFD kr+g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:message-id:date:mime-version:user-agent:subject :content-language:to:cc:references:from:in-reply-to :content-transfer-encoding; bh=H01S+Z7PoKhXtthwBx3mI1VVb20IHa0ThHfpXV2OsWk=; b=DykgAvzxpj6H3pt75Q4xkwWo0tzperKN4BGAAKJp89R4uG1Oz18zJRZY4WXFU7hpq2 e9n3ZkGR8CIBe9Nh6uYN0VdKFJhbeoTFgSYGJx2ebN3xjmLZt1+aPzyBSErwh41b9q/t ezT/3OCDSuNvpetqJjn6NpL8CkQBvtQT+hEl3jmj04YCIQQGqKqDM2r4CV+3uSVy6lQK S74a4Qi1MWsJRiEkq+30n6P801mHgBphjnFbkash8z61bA873qPn9fmaju7YA8ogOE+r jHABpQQg9K1jKMOFpDKTZUmQvCZSIm9w1INlNov0X/ttjmhBjd491y7XQi4wwHde4ZGZ SZ/g== X-Gm-Message-State: AOAM531lGlGb01gKwa6WSRSgWxPx+q3fFBZTVYm8tyK/nTv9Wq1qvup3 1WUOD9cIRlAYwD8D7F5T4cg= X-Google-Smtp-Source: ABdhPJw+VLfbypfCSe9stpbubNdMGXl9HD4DhVxLcd/U9wA78sssgaQaPBzfy770WHdBH+UXBFl2ag== X-Received: by 2002:a05:6512:151f:b0:44a:2508:1d01 with SMTP id bq31-20020a056512151f00b0044a25081d01mr228077lfb.675.1650559710555; Thu, 21 Apr 2022 09:48:30 -0700 (PDT) Received: from [192.168.1.38] (91-159-150-194.elisa-laajakaista.fi. [91.159.150.194]) by smtp.gmail.com with ESMTPSA id q64-20020a2e2a43000000b0024ee56ec2bbsm310284ljq.3.2022.04.21.09.48.29 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 21 Apr 2022 09:48:29 -0700 (PDT) Message-ID: <400be309-ef3f-4175-594d-7dc45a43dc36@gmail.com> Date: Thu, 21 Apr 2022 19:48:27 +0300 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.8.0 Subject: Re: [PATCH RFC 0/4] mm, arm64: In-kernel support for memory-deny-write-execute (MDWE) Content-Language: en-US To: Catalin Marinas , Kees Cook Cc: Andrew Morton , Christoph Hellwig , Lennart Poettering , =?UTF-8?Q?Zbigniew_J=c4=99drzejewski-Szmek?= , Will Deacon , Alexander Viro , Eric Biederman , Szabolcs Nagy , Mark Brown , Jeremy Linton , linux-mm@kvack.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-abi-devel@lists.sourceforge.net, linux-hardening@vger.kernel.org, Jann Horn , Salvatore Mesoraca , Igor Zhbanov References: <20220413134946.2732468-1-catalin.marinas@arm.com> <202204141028.0482B08@keescook> <202204201610.093C9D5FE8@keescook> From: Topi Miettinen In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 21.4.2022 18.35, Catalin Marinas wrote: > On Wed, Apr 20, 2022 at 04:21:45PM -0700, Kees Cook wrote: >> On Wed, Apr 20, 2022 at 10:34:33PM +0300, Topi Miettinen wrote: >>> For systemd, feature compatibility with the BPF version is important so that >>> we could automatically switch to the kernel version once available without >>> regressions. So I think PR_MDWX_MMAP (or maybe PR_MDWX_COMPAT) should match >>> exactly what MemoryDenyWriteExecute=yes as implemented with BPF has: only >>> forbid mmap(PROT_EXEC|PROT_WRITE) and mprotect(PROT_EXEC). Like BPF, once >>> installed there should be no way to escape and ELF flags should be also >>> ignored. ARM BTI should be allowed though (allow PROT_EXEC|PROT_BTI if the >>> old flags had PROT_EXEC). > > I agree. > >>> Then we could have improved versions (other PR_MDWX_ prctls) with lots more >>> checks. This could be enabled with MemoryDenyWriteExecute=strict or so. >>> >>> Perhaps also more relaxed versions (like SARA) could be interesting (system >>> service running Python with FFI, or perhaps JVM etc), enabled with for >>> example MemoryDenyWriteExecute=trampolines. That way even those programs >>> would get some protection (though there would be a gap in the defences). >> >> Yup, I think we're all on the same page. Catalin, can you respin with a >> prctl for enabling MDWE? I propose just: >> >> prctl(PR_MDWX_SET, flags); >> prctl(PR_MDWX_GET); >> >> PR_MDWX_FLAG_MMAP >> disallows PROT_EXEC on any VMA that is or was PROT_WRITE, >> covering at least: mmap, mprotect, pkey_mprotect, and shmat. > > Do we want the "was PROT_WRITE" or we just reject mprotect(PROT_EXEC) if > the vma is not already PROT_EXEC? The latter is closer to the current > systemd approach. The former allows an mprotect(PROT_EXEC) if the > mapping was PROT_READ only for example. > > I'd drop the "was PROT_WRITE" for now if the aim is a drop-in > replacement for BPF MDWE. > I think we'd want existing installations with MemoryDenyWriteExecute=yes not start failing when the implementation is changed to in-kernel version. The implementation could be very simple and not even check existing PROT_ flags (except for BTI case) to be maximally compatible to BPF version. So I'd leave "was PROT_WRITE" and other checks to more advanced versions, enabled with a different PR_MDWX_FLAG_. -Topi From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 6A9AFC433EF for ; Thu, 21 Apr 2022 16:49:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:Content-Type: Content-Transfer-Encoding:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:In-Reply-To:From:References:Cc:To:Subject: MIME-Version:Date:Message-ID:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=LK2IVVT3inal1Xpd9Bj1bEtvWIhMM2TryrGE9zGwRaE=; b=ldZ4Bg4ekAys3f BStAybVNEsg8J495mbovSj2E4I0ho1nEoWzYxvr3G/ANmhwHEDuJEgtTY4VHZb4NyxQMabgc66w9s U4HToWLHna8h6dcprzqqs9d/1YOEMxfs2u7rIMRwNv3fbIGUG9/9UPYz693mey4UHqn3aLeiqeAoo vOaGTaaa4I5hW0dmrdL1DO+pdCppuSiv9VTsYsew+MbQq+HZLNU6XgjIdNkOVdjLBXZlIBmMYKHT2 BhN1rJ7UxECZFAGuF+dCtvv7YZ4/FL9trLNYCZbaqoT6FyORt9OXrdZ56n6Mz3t8lOvNj/geyDjKL tsB9pECjWXAMe15YuyXQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1nhZyw-00EJFr-Mt; Thu, 21 Apr 2022 16:48:38 +0000 Received: from mail-lf1-x133.google.com ([2a00:1450:4864:20::133]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1nhZys-00EJCt-MO for linux-arm-kernel@lists.infradead.org; Thu, 21 Apr 2022 16:48:36 +0000 Received: by mail-lf1-x133.google.com with SMTP id x33so9761664lfu.1 for ; Thu, 21 Apr 2022 09:48:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=message-id:date:mime-version:user-agent:subject:content-language:to :cc:references:from:in-reply-to:content-transfer-encoding; bh=H01S+Z7PoKhXtthwBx3mI1VVb20IHa0ThHfpXV2OsWk=; b=Te5bNS7bK0yTicPlwPilL/FHzAHcCqm56DhGAmSHJVeyNBi761kWJGIb9kl8TOYuck BiTT/cBsA/F5VgqiWxOJFnnaOZHoAT4gI5awBPaMEgiyrEJmcMFoF8VPBkGOxFB/SDy4 qqeDtPW45B92jzLhCXjMqi+0O7pfeh81IUjPs6/oytjFCbtCGr735rxBqlAvms8VYNT0 Jvb9G02yo002YknsCfyrj5wNC6z46s/QYuddL1MP5fcS9CizCQNamFZpPEZ8NcHpIzT4 CTDjLKjMhaRGxDTW8Gn5MvVYUXGQN4Ptv7zh47AOnsIAKcNf/WhNZKku9l22WYc3adFD kr+g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:message-id:date:mime-version:user-agent:subject :content-language:to:cc:references:from:in-reply-to :content-transfer-encoding; bh=H01S+Z7PoKhXtthwBx3mI1VVb20IHa0ThHfpXV2OsWk=; b=u7wFVjmQahT/6/8hHZlAEOWMiAySrYG0LE/Wwl6TSKy4vQSTG66MMmrvGfLToQ+yMK HCIUf4ZJeksE7IicDGG7d6ophoXROX2vrUFM+Rq0dI+lvBGJZXIuZL/CHMkLPnTt1UY4 fWpQ821TIO+k5ANkzeDuR1Cv2I6/iqGrFcCk1iJ8e8S42nQ5RARPeSZudn/ZjVF0ggUk zsOZh1/3SUMWcwb9t9gPww6D4Qno+L+7F9eenGZro/qIKgXMmxcvkC0Awd54hpVJxziJ OeQ3diY0M4/ifnKqDyWF+A8fKNbcvlHWMMm8/ecVw79c+idCsSs80K7cNOUL0eKQfhYd uG8A== X-Gm-Message-State: AOAM533mjYftLEaXiF43X8kubLVaZ4YCkAgPymNtEnOP22a8O7t0/HDk QaMFCt/0Q/qsrXa4zgBY01c= X-Google-Smtp-Source: ABdhPJw+VLfbypfCSe9stpbubNdMGXl9HD4DhVxLcd/U9wA78sssgaQaPBzfy770WHdBH+UXBFl2ag== X-Received: by 2002:a05:6512:151f:b0:44a:2508:1d01 with SMTP id bq31-20020a056512151f00b0044a25081d01mr228077lfb.675.1650559710555; Thu, 21 Apr 2022 09:48:30 -0700 (PDT) Received: from [192.168.1.38] (91-159-150-194.elisa-laajakaista.fi. [91.159.150.194]) by smtp.gmail.com with ESMTPSA id q64-20020a2e2a43000000b0024ee56ec2bbsm310284ljq.3.2022.04.21.09.48.29 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 21 Apr 2022 09:48:29 -0700 (PDT) Message-ID: <400be309-ef3f-4175-594d-7dc45a43dc36@gmail.com> Date: Thu, 21 Apr 2022 19:48:27 +0300 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.8.0 Subject: Re: [PATCH RFC 0/4] mm, arm64: In-kernel support for memory-deny-write-execute (MDWE) Content-Language: en-US To: Catalin Marinas , Kees Cook Cc: Andrew Morton , Christoph Hellwig , Lennart Poettering , =?UTF-8?Q?Zbigniew_J=c4=99drzejewski-Szmek?= , Will Deacon , Alexander Viro , Eric Biederman , Szabolcs Nagy , Mark Brown , Jeremy Linton , linux-mm@kvack.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-abi-devel@lists.sourceforge.net, linux-hardening@vger.kernel.org, Jann Horn , Salvatore Mesoraca , Igor Zhbanov References: <20220413134946.2732468-1-catalin.marinas@arm.com> <202204141028.0482B08@keescook> <202204201610.093C9D5FE8@keescook> From: Topi Miettinen In-Reply-To: X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220421_094834_811147_D8BC647E X-CRM114-Status: GOOD ( 21.73 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On 21.4.2022 18.35, Catalin Marinas wrote: > On Wed, Apr 20, 2022 at 04:21:45PM -0700, Kees Cook wrote: >> On Wed, Apr 20, 2022 at 10:34:33PM +0300, Topi Miettinen wrote: >>> For systemd, feature compatibility with the BPF version is important so that >>> we could automatically switch to the kernel version once available without >>> regressions. So I think PR_MDWX_MMAP (or maybe PR_MDWX_COMPAT) should match >>> exactly what MemoryDenyWriteExecute=yes as implemented with BPF has: only >>> forbid mmap(PROT_EXEC|PROT_WRITE) and mprotect(PROT_EXEC). Like BPF, once >>> installed there should be no way to escape and ELF flags should be also >>> ignored. ARM BTI should be allowed though (allow PROT_EXEC|PROT_BTI if the >>> old flags had PROT_EXEC). > > I agree. > >>> Then we could have improved versions (other PR_MDWX_ prctls) with lots more >>> checks. This could be enabled with MemoryDenyWriteExecute=strict or so. >>> >>> Perhaps also more relaxed versions (like SARA) could be interesting (system >>> service running Python with FFI, or perhaps JVM etc), enabled with for >>> example MemoryDenyWriteExecute=trampolines. That way even those programs >>> would get some protection (though there would be a gap in the defences). >> >> Yup, I think we're all on the same page. Catalin, can you respin with a >> prctl for enabling MDWE? I propose just: >> >> prctl(PR_MDWX_SET, flags); >> prctl(PR_MDWX_GET); >> >> PR_MDWX_FLAG_MMAP >> disallows PROT_EXEC on any VMA that is or was PROT_WRITE, >> covering at least: mmap, mprotect, pkey_mprotect, and shmat. > > Do we want the "was PROT_WRITE" or we just reject mprotect(PROT_EXEC) if > the vma is not already PROT_EXEC? The latter is closer to the current > systemd approach. The former allows an mprotect(PROT_EXEC) if the > mapping was PROT_READ only for example. > > I'd drop the "was PROT_WRITE" for now if the aim is a drop-in > replacement for BPF MDWE. > I think we'd want existing installations with MemoryDenyWriteExecute=yes not start failing when the implementation is changed to in-kernel version. The implementation could be very simple and not even check existing PROT_ flags (except for BTI case) to be maximally compatible to BPF version. So I'd leave "was PROT_WRITE" and other checks to more advanced versions, enabled with a different PR_MDWX_FLAG_. -Topi _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel