From: "Michael S. Tsirkin" <mst@redhat.com>
To: Daniel Colascione <dancol@google.com>
Cc: Jonathan Corbet <corbet@lwn.net>,
Alexander Viro <viro@zeniv.linux.org.uk>,
Luis Chamberlain <mcgrof@kernel.org>,
Kees Cook <keescook@chromium.org>,
Iurii Zaikin <yzaikin@google.com>,
Mauro Carvalho Chehab <mchehab+samsung@kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
Andy Shevchenko <andy.shevchenko@gmail.com>,
Vlastimil Babka <vbabka@suse.cz>,
Mel Gorman <mgorman@techsingularity.net>,
Sebastian Andrzej Siewior <bigeasy@linutronix.de>,
Peter Xu <peterx@redhat.com>,
Andrea Arcangeli <aarcange@redhat.com>,
Mike Rapoport <rppt@linux.ibm.com>,
Jerome Glisse <jglisse@redhat.com>, Shaohua Li <shli@fb.com>,
linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-fsdevel@vger.kernel.org, timmurray@google.com,
minchan@google.com, sspatil@google.com, lokeshgidra@google.com
Subject: Re: [PATCH 2/2] Add a new sysctl knob: unprivileged_userfaultfd_user_mode_only
Date: Fri, 8 May 2020 12:54:03 -0400 [thread overview]
Message-ID: <20200508125314-mutt-send-email-mst@kernel.org> (raw)
In-Reply-To: <20200508125054-mutt-send-email-mst@kernel.org>
On Fri, May 08, 2020 at 12:52:34PM -0400, Michael S. Tsirkin wrote:
> On Wed, Apr 22, 2020 at 05:26:32PM -0700, Daniel Colascione wrote:
> > This sysctl can be set to either zero or one. When zero (the default)
> > the system lets all users call userfaultfd with or without
> > UFFD_USER_MODE_ONLY, modulo other access controls. When
> > unprivileged_userfaultfd_user_mode_only is set to one, users without
> > CAP_SYS_PTRACE must pass UFFD_USER_MODE_ONLY to userfaultfd or the API
> > will fail with EPERM. This facility allows administrators to reduce
> > the likelihood that an attacker with access to userfaultfd can delay
> > faulting kernel code to widen timing windows for other exploits.
> >
> > Signed-off-by: Daniel Colascione <dancol@google.com>
>
> The approach taken looks like a hard-coded security policy.
> For example, it won't be possible to set the sysctl knob
> in question on any sytem running kvm. So this is
> no good for any general purpose system.
>
> What's wrong with using a security policy for this instead?
In fact I see the original thread already mentions selinux,
so it's just a question of making this controllable by
selinux.
>
>
> > ---
> > Documentation/admin-guide/sysctl/vm.rst | 13 +++++++++++++
> > fs/userfaultfd.c | 11 ++++++++++-
> > include/linux/userfaultfd_k.h | 1 +
> > kernel/sysctl.c | 9 +++++++++
> > 4 files changed, 33 insertions(+), 1 deletion(-)
> >
> > diff --git a/Documentation/admin-guide/sysctl/vm.rst b/Documentation/admin-guide/sysctl/vm.rst
> > index 0329a4d3fa9e..4296b508ab74 100644
> > --- a/Documentation/admin-guide/sysctl/vm.rst
> > +++ b/Documentation/admin-guide/sysctl/vm.rst
> > @@ -850,6 +850,19 @@ privileged users (with SYS_CAP_PTRACE capability).
> >
> > The default value is 1.
> >
> > +unprivileged_userfaultfd_user_mode_only
> > +========================================
> > +
> > +This flag controls whether unprivileged users can use the userfaultfd
> > +system calls to handle page faults in kernel mode. If set to zero,
> > +userfaultfd works with or without UFFD_USER_MODE_ONLY, modulo
> > +unprivileged_userfaultfd above. If set to one, users without
> > +SYS_CAP_PTRACE must pass UFFD_USER_MODE_ONLY in order for userfaultfd
> > +to succeed. Prohibiting use of userfaultfd for handling faults from
> > +kernel mode may make certain vulnerabilities more difficult
> > +to exploit.
> > +
> > +The default value is 0.
> >
> > user_reserve_kbytes
> > ===================
> > diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
> > index 21378abe8f7b..85cc1ab74361 100644
> > --- a/fs/userfaultfd.c
> > +++ b/fs/userfaultfd.c
> > @@ -29,6 +29,7 @@
> > #include <linux/hugetlb.h>
> >
> > int sysctl_unprivileged_userfaultfd __read_mostly = 1;
> > +int sysctl_unprivileged_userfaultfd_user_mode_only __read_mostly = 0;
> >
> > static struct kmem_cache *userfaultfd_ctx_cachep __read_mostly;
> >
> > @@ -2009,8 +2010,16 @@ SYSCALL_DEFINE1(userfaultfd, int, flags)
> > static const int uffd_flags = UFFD_USER_MODE_ONLY;
> > struct userfaultfd_ctx *ctx;
> > int fd;
> > + bool need_cap_check = false;
> >
> > - if (!sysctl_unprivileged_userfaultfd && !capable(CAP_SYS_PTRACE))
> > + if (!sysctl_unprivileged_userfaultfd)
> > + need_cap_check = true;
> > +
> > + if (sysctl_unprivileged_userfaultfd_user_mode_only &&
> > + (flags & UFFD_USER_MODE_ONLY) == 0)
> > + need_cap_check = true;
> > +
> > + if (need_cap_check && !capable(CAP_SYS_PTRACE))
> > return -EPERM;
> >
> > BUG_ON(!current->mm);
> > diff --git a/include/linux/userfaultfd_k.h b/include/linux/userfaultfd_k.h
> > index a8e5f3ea9bb2..d81e30074bf5 100644
> > --- a/include/linux/userfaultfd_k.h
> > +++ b/include/linux/userfaultfd_k.h
> > @@ -31,6 +31,7 @@
> > #define UFFD_FLAGS_SET (EFD_SHARED_FCNTL_FLAGS)
> >
> > extern int sysctl_unprivileged_userfaultfd;
> > +extern int sysctl_unprivileged_userfaultfd_user_mode_only;
> >
> > extern vm_fault_t handle_userfault(struct vm_fault *vmf, unsigned long reason);
> >
> > diff --git a/kernel/sysctl.c b/kernel/sysctl.c
> > index 8a176d8727a3..9cbdf4483961 100644
> > --- a/kernel/sysctl.c
> > +++ b/kernel/sysctl.c
> > @@ -1719,6 +1719,15 @@ static struct ctl_table vm_table[] = {
> > .extra1 = SYSCTL_ZERO,
> > .extra2 = SYSCTL_ONE,
> > },
> > + {
> > + .procname = "unprivileged_userfaultfd_user_mode_only",
> > + .data = &sysctl_unprivileged_userfaultfd_user_mode_only,
> > + .maxlen = sizeof(sysctl_unprivileged_userfaultfd_user_mode_only),
> > + .mode = 0644,
> > + .proc_handler = proc_dointvec_minmax,
> > + .extra1 = SYSCTL_ZERO,
> > + .extra2 = SYSCTL_ONE,
> > + },
> > #endif
> > { }
> > };
> > --
> > 2.26.2.303.gf8c07b1a785-goog
> >
next prev parent reply other threads:[~2020-05-08 16:54 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-23 0:26 [PATCH 0/2] Control over userfaultfd kernel-fault handling Daniel Colascione
2020-04-23 0:26 ` [PATCH 1/2] Add UFFD_USER_MODE_ONLY Daniel Colascione
2020-07-24 14:28 ` Michael S. Tsirkin
2020-07-24 14:46 ` Lokesh Gidra
2020-07-26 10:09 ` Michael S. Tsirkin
2020-04-23 0:26 ` [PATCH 2/2] Add a new sysctl knob: unprivileged_userfaultfd_user_mode_only Daniel Colascione
2020-05-06 19:38 ` Peter Xu
2020-05-07 19:15 ` Jonathan Corbet
2020-05-20 4:06 ` Andrea Arcangeli
2020-05-08 16:52 ` Michael S. Tsirkin
2020-05-08 16:54 ` Michael S. Tsirkin [this message]
2020-05-20 4:59 ` Andrea Arcangeli
2020-05-20 18:03 ` Kees Cook
2020-05-20 19:48 ` Andrea Arcangeli
2020-05-20 19:51 ` Andrea Arcangeli
2020-05-20 20:17 ` Lokesh Gidra
2020-05-20 21:16 ` Andrea Arcangeli
2020-07-17 12:57 ` Jeffrey Vander Stoep
2020-07-23 17:30 ` Lokesh Gidra
2020-07-24 0:13 ` Nick Kralevich
2020-07-24 13:40 ` Michael S. Tsirkin
2020-08-06 0:43 ` Nick Kralevich
2020-08-06 5:44 ` Michael S. Tsirkin
2020-08-17 22:11 ` Lokesh Gidra
2020-09-04 3:34 ` Andrea Arcangeli
2020-09-05 0:36 ` Lokesh Gidra
2020-09-19 18:14 ` Nick Kralevich
2020-07-24 14:01 ` [PATCH 0/2] Control over userfaultfd kernel-fault handling Michael S. Tsirkin
2020-07-24 14:41 ` Lokesh Gidra
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200508125314-mutt-send-email-mst@kernel.org \
--to=mst@redhat.com \
--cc=aarcange@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=andy.shevchenko@gmail.com \
--cc=bigeasy@linutronix.de \
--cc=corbet@lwn.net \
--cc=dancol@google.com \
--cc=jglisse@redhat.com \
--cc=keescook@chromium.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lokeshgidra@google.com \
--cc=mcgrof@kernel.org \
--cc=mchehab+samsung@kernel.org \
--cc=mgorman@techsingularity.net \
--cc=minchan@google.com \
--cc=peterx@redhat.com \
--cc=rppt@linux.ibm.com \
--cc=shli@fb.com \
--cc=sspatil@google.com \
--cc=timmurray@google.com \
--cc=vbabka@suse.cz \
--cc=viro@zeniv.linux.org.uk \
--cc=yzaikin@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).