From: Jeremy Linton <email@example.com> To: Dave Martin <Dave.Martin@arm.com>, Mark Brown <firstname.lastname@example.org> Cc: Catalin Marinas <email@example.com>, firstname.lastname@example.org, email@example.com, Szabolcs Nagy <firstname.lastname@example.org>, Will Deacon <email@example.com>, firstname.lastname@example.org Subject: Re: [PATCH v1 2/2] arm64: Enable BTI for main executable as well as the interpreter Date: Tue, 8 Jun 2021 10:42:41 -0500 [thread overview] Message-ID: <email@example.com> (raw) In-Reply-To: <20210608151914.GJ4187@arm.com> On 6/8/21 10:19 AM, Dave Martin wrote: > On Tue, Jun 08, 2021 at 12:33:18PM +0100, Mark Brown via Libc-alpha wrote: >> On Mon, Jun 07, 2021 at 07:12:13PM +0100, Catalin Marinas wrote: >> >>> I don't think we can document all the filters that can be added on top >>> various syscalls, so I'd leave it undocumented (or part of the systemd >>> documentation). It was a user space program (systemd) breaking another >>> user space program (well, anything with a new enough glibc). The kernel >>> ABI was still valid when /sbin/init started ;). >> >> Indeed. I think from a kernel point of view the main thing is to look >> at why userspace feels the need to do things like this and see if >> there's anything we can improve or do better with in future APIs, part >> of the original discussion here was figuring out that there's not really >> any other reasonable options for userspace to implement this check at >> the minute. > > Ack, that would be my policy -- just wanted to make it explicit. > It would be good if there were better dialogue between the systemd > and kernel folks on this kind of thing. > > SECCOMP makes it rather easy to (attempt to) paper over kernel/user API > design problems, which probably reduces the chance of the API ever being > fixed properly, if we're not careful... Well IMHO the problem is larger than just BTI here, what systemd is trying to do by fixing the exec state of a service is admirable but its a 90% solution without the entire linker/loader being in a more privileged context. While BTI makes finding a generic gadget that can call mprotect harder, it still seems like it might just be a little too easy. The secomp filter is providing a nice bonus by removing the ability to disable BTI via mprotect without also disabling X. So without moving more of the linker into the kernel its hard to see how one can really lock down X only pages. Anyway, i'm testing this on rawhide now. Thanks! _______________________________________________ linux-arm-kernel mailing list firstname.lastname@example.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2021-06-08 15:44 UTC|newest] Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-05-21 14:46 [PATCH v1 0/2] arm64: Enable BTI for the " Mark Brown 2021-05-21 14:46 ` [PATCH v1 1/2] elf: Allow architectures to parse properties on the main executable Mark Brown 2021-06-03 15:40 ` Dave Martin 2021-06-03 18:52 ` Mark Brown 2021-05-21 14:46 ` [PATCH v1 2/2] arm64: Enable BTI for main executable as well as the interpreter Mark Brown 2021-06-03 15:40 ` Dave Martin 2021-06-03 16:51 ` Mark Brown 2021-06-03 18:04 ` Catalin Marinas 2021-06-07 11:25 ` Dave Martin 2021-06-07 18:12 ` Catalin Marinas 2021-06-08 11:33 ` Mark Brown 2021-06-08 15:19 ` Dave Martin 2021-06-08 15:42 ` Jeremy Linton [this message] 2021-06-10 10:33 ` Dave Martin
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --email@example.com \ --firstname.lastname@example.org \ --cc=Dave.Martin@arm.com \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --subject='Re: [PATCH v1 2/2] arm64: Enable BTI for main executable as well as the interpreter' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).