From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.2 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE,SPF_PASS, UNPARSEABLE_RELAY,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F3380C388F9 for ; Fri, 23 Oct 2020 06:14:58 +0000 (UTC) Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 6C78B2074A for ; Fri, 23 Oct 2020 06:14:58 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="romtwJq+"; dkim=fail reason="signature verification failed" (1024-bit key) header.d=armh.onmicrosoft.com header.i=@armh.onmicrosoft.com header.b="ck8qNqvM"; dkim=fail reason="signature verification failed" (1024-bit key) header.d=armh.onmicrosoft.com header.i=@armh.onmicrosoft.com header.b="ck8qNqvM" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 6C78B2074A Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=arm.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:MIME-Version:In-Reply-To:References:Message-ID: Subject:To:From:Date:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=9obHnjjvn+r/U3Ehba9qusf3QFtZTnCueasz7E0wEzs=; b=romtwJq+o5RYeWS8bvs+WtbMa /fsVe3dmJ2Ughv/TNSjUiDfmr/0DXPQUij2L0Tj9tbSvj1Gg0l3piF6U5H01LUqlsYsPYVw7cCqSA rlMqUqbn5E60cOWUETJI7FG3xhSoyhNj7zQ4gyVJQ1hA9GgsfPZC7kVGW4kF5L5YtxgliBEWaTwGH 2/IWoaIO2vGmpS/fn2htC+bWlMbc4CScwR95Iw7fFvoeO9GgCpgqftq47x3oqElSV9Q6JpKo2ttzC Ucn/PbwA5SMar/0QS9RB4SA2d8zRAjX8BBM39sWkxRTa9F2NYNmhvXAPYZNidng5AjyuDjeVVbX7+ eavpQCaIA==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1kVqKb-0005Ui-9u; Fri, 23 Oct 2020 06:13:41 +0000 Received: from mail-eopbgr40052.outbound.protection.outlook.com ([40.107.4.52] helo=EUR03-DB5-obe.outbound.protection.outlook.com) by merlin.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1kVqKX-0005TM-VE for linux-arm-kernel@lists.infradead.org; Fri, 23 Oct 2020 06:13:39 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=bGI5v4C3s67hzaAPFM5NOxhUyVogZl2FQvTGIRk6tTY=; b=ck8qNqvMRkobToEP2jmrEbjfVKYNSBa8ykwOYBai1MfmvTx1HLyDSYIISHwYeYLKBBk4QVDm82nbQS78EWfi1tVDJlFJ/zn5L5lKNKNOTnJN73tCnHYSCzpKlBlxoScT/mSt3ki1u6sShm7xu/PCLTjs/LlMQPXbSfYXD6iK2cQ= Received: from AM6PR04CA0035.eurprd04.prod.outlook.com (2603:10a6:20b:92::48) by VI1PR08MB5408.eurprd08.prod.outlook.com (2603:10a6:803:130::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3477.20; Fri, 23 Oct 2020 06:13:27 +0000 Received: from AM5EUR03FT063.eop-EUR03.prod.protection.outlook.com (2603:10a6:20b:92:cafe::6d) by AM6PR04CA0035.outlook.office365.com (2603:10a6:20b:92::48) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3499.18 via Frontend Transport; Fri, 23 Oct 2020 06:13:27 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; lists.infradead.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;lists.infradead.org; dmarc=pass action=none header.from=arm.com; Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com; Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by AM5EUR03FT063.mail.protection.outlook.com (10.152.16.226) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3499.18 via Frontend Transport; Fri, 23 Oct 2020 06:13:26 +0000 Received: ("Tessian outbound 68da730eaaba:v64"); Fri, 23 Oct 2020 06:13:25 +0000 X-CheckRecipientChecked: true X-CR-MTA-CID: 0326b32da17b340d X-CR-MTA-TID: 64aa7808 Received: from e9aeef0569f2.3 by 64aa7808-outbound-1.mta.getcheckrecipient.com id 91E9E363-1CA9-4422-BE53-30A67A1C9035.1; Fri, 23 Oct 2020 06:13:19 +0000 Received: from EUR01-DB5-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id e9aeef0569f2.3 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Fri, 23 Oct 2020 06:13:19 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=MPtiyWOTWk92VfVXUpHM+EafXF6GV0PhPlLQjDXyhwge/TdzN98QGAq6LhlwksFFNNHyhJt8j7DdV7/57mKAd/XwKzimE6yxclTkGvlXjKVNAANZujScuHNzg31UBerHXHrcMwAcMj2wzmNJXIpz+SoZW2mFfzokKtkL9+A9qWA3y4FABwQFiYCjjBh2QK+D2kt0RlB0xZHh0yhEWfCBDq2hjmy2yy+3K762a06yy/wyjsafWjvhxAqEVJHepuHru6zw+3OgwwX9DcA3J9PDNJ+a6sUL12Z3bf/T8E0SqRcfGYnxXPPO+oPcshzI4t1SJaV/1/K+lISSqIflkM0VYg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=bGI5v4C3s67hzaAPFM5NOxhUyVogZl2FQvTGIRk6tTY=; b=VEOQdiGf5jui0q8qFMu7K1hSGWpTYW/9Yefwui2mWNFG48O4msG+dSdv+EbtVD+xzTSLphqB7dATVCzHmyx+uV/px48aJE6M2hmrzDgiMF0u0A05YkTwo6771zeJyWnpbLsfhSkAb4D9eHznjW1AnHkaxeXYzULDThPw0lVxidqn+E7m0mDhr9D8Djx3FOiyYmXIa/IK+YHE4glyOBXGtbECQ/iSY5NXyDmvY4/mSa40oExaI63FR5w2/F2M/3NTiTe6m7lCaXc01/QfLfRcgHLgE9zXb34Xx6xFCwDtxgrzwTzk+CkcWATxvonPipMJn0fIzxzDd11d43T6eVfmYg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=bGI5v4C3s67hzaAPFM5NOxhUyVogZl2FQvTGIRk6tTY=; b=ck8qNqvMRkobToEP2jmrEbjfVKYNSBa8ykwOYBai1MfmvTx1HLyDSYIISHwYeYLKBBk4QVDm82nbQS78EWfi1tVDJlFJ/zn5L5lKNKNOTnJN73tCnHYSCzpKlBlxoScT/mSt3ki1u6sShm7xu/PCLTjs/LlMQPXbSfYXD6iK2cQ= Authentication-Results-Original: arm.com; dkim=none (message not signed) header.d=none;arm.com; dmarc=none action=none header.from=arm.com; Received: from PR3PR08MB5564.eurprd08.prod.outlook.com (2603:10a6:102:87::18) by PA4PR08MB6014.eurprd08.prod.outlook.com (2603:10a6:102:ee::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3477.20; Fri, 23 Oct 2020 06:13:19 +0000 Received: from PR3PR08MB5564.eurprd08.prod.outlook.com ([fe80::957e:c80e:98f4:23d6]) by PR3PR08MB5564.eurprd08.prod.outlook.com ([fe80::957e:c80e:98f4:23d6%6]) with mapi id 15.20.3477.028; Fri, 23 Oct 2020 06:13:19 +0000 Date: Fri, 23 Oct 2020 07:13:17 +0100 From: Szabolcs Nagy To: Catalin Marinas Subject: Re: [systemd-devel] BTI interaction between seccomp filters in systemd and glibc mprotect calls, causing service failures Message-ID: <20201023061316.GR3819@arm.com> References: <8584c14f-5c28-9d70-c054-7c78127d84ea@arm.com> <20201022071812.GA324655@gardel-login> <87sga6snjn.fsf@oldenburg2.str.redhat.com> <511318fd-efde-f2fc-9159-9d16ac8d33a7@gmail.com> <20201022082912.GQ3819@arm.com> <20201022083823.GA324825@gardel-login> <20201022093104.GB1229@gaia> Content-Disposition: inline In-Reply-To: <20201022093104.GB1229@gaia> User-Agent: Mutt/1.9.4 (2018-02-28) X-Originating-IP: [217.140.106.54] X-ClientProxiedBy: LO3P123CA0018.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:ba::23) To PR3PR08MB5564.eurprd08.prod.outlook.com (2603:10a6:102:87::18) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from arm.com (217.140.106.54) by LO3P123CA0018.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:ba::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3499.18 via Frontend Transport; Fri, 23 Oct 2020 06:13:18 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: 610d613f-605a-44b5-4f02-08d8771ac0e6 X-MS-TrafficTypeDiagnostic: PA4PR08MB6014:|VI1PR08MB5408: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true NoDisclaimer: true X-MS-Oob-TLC-OOBClassifiers: OLM:9508;OLM:9508; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Untrusted: BCL:0; X-Microsoft-Antispam-Message-Info-Original: Mo1L8Dce+xHQb76VA3E0qpZwU5xLDi+qxZWiuvxgHGd2/JANbQQNKA+oeXVx2FcHAMYNAq/Xxbm6nzpD9FVGxgsG8GtA3S/OUywqCGO9FD1zrWGbw50Guh4HKVrh+aAqg6XvN1nkn4qUQSOxsk7Sl4XbLwzn1SAGdJzm3kU8T5o4p8V4CQYGHxSmxKj/VQwS5JMSwgzBnM3KhymXQOMjlbNeF8IAUla5fq1F6EvL3ChPRRYIcne4aqEzKDCzZzsM9pK0ldp8uHQojN/a7XXIeg+6zN0TucscDGAWJ8Yb+XQza03coWESNe8OV4bl2onwqMyjmrjpH4I+xgi3cRUkmQ== X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:PR3PR08MB5564.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(396003)(136003)(39860400002)(366004)(376002)(346002)(956004)(316002)(52116002)(54906003)(44832011)(5660300002)(4326008)(7696005)(33656002)(186003)(26005)(16526019)(8676002)(478600001)(66476007)(37006003)(66556008)(6862004)(8936002)(2616005)(66946007)(83380400001)(86362001)(1076003)(6636002)(36756003)(8886007)(2906002)(55016002); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData: kD3pCqYs44WU7S7mDA8+JmSW/4jy6Ok1+ZP9Ga2+bQuO/1BJyeEcotKPwl714pldjz0RNSM//Lk0fS8NLGw8TnDfeGgZ2cI3751hEO3U6wyuWGLxj6gtVRjuX2DY/jpsoMm80/+RPftfdm/rXOhiHdRKs5TIro+HNFXqPyxsmYfAS+Lc5IAlM93/EDmyNVkZ8WubV4hwL9jsa9AoScZxQRObT7Xxjj9hDlEsNopAUgM9MNZFWGccvdpqTY34RF92z7fKl/kc+h7gzVjO/+tNFlFKuYro/vUyIzyNSczkwtLUBwAqJIqfDtwj7oICR4VcePEvghshCvQf9drY4BFezPzwkPMLY3VX/beggSBh0+w0S+CV2Jgf0hFw5bUcy5cwyvcfmfxZb60OKYtDieh6Xdl7B9N9sSYgTGpJGzjy5C2TZJkGGv3hcB97VN95FOZbkgEGrzbGuMbVtrJOtC0Hew0ZD9XUi4RNFoI3gtnHQOGc72MEFxRpwtpzo5H2ECer5+cEBtnRgaYx+lojv2ZARn2hPrGHjMYJEeNFQMhTHSuYdagEwNk/gR0M6ghgqZJxWwMRTtnx6bTNWqKp0zI3FDu8Gq+LJNtVMzNlyk125YH+IGvD+BShXcUkbenafOG/lH98brEQTwda2+XCuiUNBg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA4PR08MB6014 Original-Authentication-Results: arm.com; dkim=none (message not signed) header.d=none;arm.com; dmarc=none action=none header.from=arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: AM5EUR03FT063.eop-EUR03.prod.protection.outlook.com X-MS-Office365-Filtering-Correlation-Id-Prvs: 2f59cc67-e0ad-4d78-c899-08d8771abc77 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: XFqCvFFtfXG96Se6P0A08u6TygrwueIBSiVpJ20FlGAtgfORYkunP/QXKqzTcI3Oc6hux46JUmWXVAsoW6pnZAwAnkZFFMf4GYDmfyC+ooaQsGW0Sr1WwfS/VAdq2kwQY3aohE7Gtyg12RrZ4sAXVYDCr58TU1imvhCJ9zpZSNweFnLOqwIWzI8zjKQrWvTmcUMV5vNoecMOx0Q7BHazekaSd/VZMIG+qdOryPN5+huvZ6/3rLRaQSbsCVey3lmJhdXfskxH0Sbp8Z5f8MNO9B5KJiGqzDbhcwYzGiyzVs+/miXDxvnbOw+3daLBz5afFrW6VTfsa2Ws4xRp/wu9k1mgbzB0ZuputdLDCOLvWWQawsirKyIG+JL9bpgBk4/Nu5rCAA15QCN+adE66hfJSg== X-Forefront-Antispam-Report: CIP:63.35.35.123; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:64aa7808-outbound-1.mta.getcheckrecipient.com; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; CAT:NONE; SFS:(4636009)(39860400002)(346002)(376002)(396003)(136003)(46966005)(956004)(44832011)(86362001)(8936002)(356005)(2616005)(16526019)(8886007)(36906005)(316002)(37006003)(6862004)(36756003)(82310400003)(54906003)(5660300002)(4326008)(336012)(6636002)(82740400003)(83380400001)(2906002)(8676002)(186003)(47076004)(55016002)(70586007)(26005)(7696005)(70206006)(33656002)(478600001)(81166007)(1076003); DIR:OUT; SFP:1101; X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Oct 2020 06:13:26.1375 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 610d613f-605a-44b5-4f02-08d8771ac0e6 X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-AuthSource: AM5EUR03FT063.eop-EUR03.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR08MB5408 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20201023_021338_076241_F80531CD X-CRM114-Status: GOOD ( 21.85 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Florian Weimer , Mark Rutland , systemd-devel@lists.freedesktop.org, Kees Cook , libc-alpha@sourceware.org, Will Deacon , "linux-kernel@vger.kernel.org" , Mark Brown , Topi Miettinen , Lennart Poettering , Dave Martin , "linux-arm-kernel@lists.infradead.org" Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The 10/22/2020 10:31, Catalin Marinas wrote: > IIUC, the problem is with the main executable which is mapped by the > kernel without PROT_BTI. The dynamic loader wants to set PROT_BTI but > does not have the original file descriptor to be able to remap. Its only > choice is mprotect() and this fails because of the MDWX policy. > > Not sure whether the kernel has the right information but could it map > the main executable with PROT_BTI if the corresponding PT_GNU_PROPERTY > is found? The current ABI states it only sets PROT_BTI for the > interpreter who'd be responsible for setting the PROT_BTI on the main > executable. I can't tell whether it would break anything but it's worth > a try: i think it would work, but now i can't easily tell from the libc if i have to do the mprotect on the main exe or not. i guess i can just always mprotect and ignore the failure? > > diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c > index 4784011cecac..0a08fb9133e8 100644 > --- a/arch/arm64/kernel/process.c > +++ b/arch/arm64/kernel/process.c > @@ -730,14 +730,6 @@ asmlinkage void __sched arm64_preempt_schedule_irq(void) > int arch_elf_adjust_prot(int prot, const struct arch_elf_state *state, > bool has_interp, bool is_interp) > { > - /* > - * For dynamically linked executables the interpreter is > - * responsible for setting PROT_BTI on everything except > - * itself. > - */ > - if (is_interp != has_interp) > - return prot; > - > if (!(state->flags & ARM64_ELF_BTI)) > return prot; > > > -- > Catalin -- _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel