From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S933497AbcIOBzj (ORCPT <rfc822;w@1wt.eu>);
        Wed, 14 Sep 2016 21:55:39 -0400
Received: from mail-vk0-f42.google.com ([209.85.213.42]:36164 "EHLO
        mail-vk0-f42.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1756264AbcIOBzg (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Wed, 14 Sep 2016 21:55:36 -0400
MIME-Version: 1.0
In-Reply-To: <CAP045ArmdQhULh36k3b72-QNQ+BfNbw6We+iLM_WdVKRBf9s4Q@mail.gmail.com>
References: <1473886902-17902-1-git-send-email-khuey@kylehuey.com>
 <1473886902-17902-4-git-send-email-khuey@kylehuey.com> <CALCETrVpbXgrVJ62fydV-uLXXbcrV1qmbb7QvhswiJ3W3oExmg@mail.gmail.com>
 <CAP045ArmdQhULh36k3b72-QNQ+BfNbw6We+iLM_WdVKRBf9s4Q@mail.gmail.com>
From: Andy Lutomirski <luto@amacapital.net>
Date: Wed, 14 Sep 2016 18:54:59 -0700
Message-ID: <CALCETrWqYrotMSKqvsug-fgbO1-4X6q0FQpsiTrPkWSzu56NAA@mail.gmail.com>
Subject: Re: [PATCH v2 3/3] x86,arch_prctl Add ARCH_[GET|SET]_CPUID for
 controlling the CPUID instruction
To: Kyle Huey <me@kylehuey.com>
Cc: "Robert O'Callahan" <robert@ocallahan.org>,
        Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@redhat.com>,
        "H. Peter Anvin" <hpa@zytor.com>,
        "maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT)" <x86@kernel.org>,
        Shuah Khan <shuah@kernel.org>,
        "Peter Zijlstra (Intel)" <peterz@infradead.org>,
        Borislav Petkov <bp@suse.de>,
        "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>,
        Len Brown <len.brown@intel.com>,
        Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>,
        Aravind Gopalakrishnan <Aravind.Gopalakrishnan@amd.com>,
        Alexander Shishkin <alexander.shishkin@linux.intel.com>,
        Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>,
        Andy Lutomirski <luto@kernel.org>,
        Frederic Weisbecker <fweisbec@gmail.com>,
        Dmitry Safonov <dsafonov@virtuozzo.com>,
        Kees Cook <keescook@chromium.org>,
        "Michael S. Tsirkin" <mst@redhat.com>,
        Andrey Ryabinin <aryabinin@virtuozzo.com>, Jiri Slaby <jslaby@suse.cz>,
        Paul Gortmaker <paul.gortmaker@windriver.com>,
        Denys Vlasenko <dvlasenk@redhat.com>,
        Dave Hansen <dave.hansen@linux.intel.com>,
        "open list:X86 ARCHITECTURE (32-BIT AND 64-BIT)" 
        <linux-kernel@vger.kernel.org>,
        "open list:KERNEL SELFTEST FRAMEWORK" 
        <linux-kselftest@vger.kernel.org>
Content-Type: text/plain; charset=UTF-8
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Wed, Sep 14, 2016 at 6:47 PM, Kyle Huey <me@kylehuey.com> wrote:
> On Wed, Sep 14, 2016 at 6:29 PM, Andy Lutomirski <luto@amacapital.net> wrote:
>> On Wed, Sep 14, 2016 at 2:01 PM, Kyle Huey <me@kylehuey.com> wrote:

>>> +
>>> +int set_cpuid_mode(struct task_struct *task, unsigned long val)
>>> +{
>>> +       /* Only disable/enable_cpuid() if it is supported on this hardware. */
>>> +       bool cpuid_fault_supported = static_cpu_has(X86_FEATURE_CPUID_FAULT);
>>> +
>>> +       if (val == ARCH_CPUID_ENABLE && cpuid_fault_supported) {
>>> +               if (task_no_new_privs(task) && test_thread_flag(TIF_NOCPUID))
>>> +                       return -EACCES;
>>
>> This check seems confused.  If this flag were preserved on execve,
>> it's the SIGSEGV mode that would need the check.
>
> Not sure I follow this one.  no_new_privs should block transitions
> from SIGSEGV to ENABLE, right?  That's what this check does.

It's the other way around entirely: if you make a change to your
process context such that a subseqently execve()'d setuid program
might malfunction, you've just done something dangerous.  This is only
okay, at least in newly-supported instances, if you are either
privileged or if you have no_new_privs set.  Having privilege makes it
okay: unprivileged programs can't use it to subvert setuid programs.
no_new_privs makes it safe as well: if no_new_privs is set, you can't
gain privilege via execve(), so there's no attack surface.  So, if you
have execve() keep ARCH_CPUID_SIGSEGV set, then setting it that way in
the first place should require privilege or no_new_privs.

I personally favor resetting to ARCH_CPUID_ENABLE on execve() and not
worrying about no_new_privs.

Does that make sense?