From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: Peter Xu <peterx@redhat.com>,
linux-kernel@vger.kernel.org, Paolo Bonzini <pbonzini@redhat.com>,
Hugh Dickins <hughd@google.com>,
Luis Chamberlain <mcgrof@kernel.org>,
Maxime Coquelin <maxime.coquelin@redhat.com>,
Maya Gokhale <gokhale2@llnl.gov>,
Jerome Glisse <jglisse@redhat.com>,
Pavel Emelyanov <xemul@virtuozzo.com>,
Johannes Weiner <hannes@cmpxchg.org>,
Martin Cracauer <cracauer@cons.org>,
Denis Plotnikov <dplotnikov@virtuozzo.com>,
linux-mm@kvack.org, Marty McFadden <mcfadden8@llnl.gov>,
Mike Kravetz <mike.kravetz@oracle.com>,
Andrea Arcangeli <aarcange@redhat.com>,
Mike Rapoport <rppt@linux.vnet.ibm.com>,
Kees Cook <keescook@chromium.org>, Mel Gorman <mgorman@suse.de>,
"Kirill A . Shutemov" <kirill@shutemov.name>,
linux-api@vger.kernel.org, linux-fsdevel@vger.kernel.org
Subject: Re: [PATCH v2 1/1] userfaultfd/sysctl: add vm.unprivileged_userfaultfd
Date: Tue, 19 Mar 2019 18:28:23 +0000 [thread overview]
Message-ID: <20190319182822.GK2727@work-vm> (raw)
In-Reply-To: <20190319110236.b6169d6b469a587a852c7e09@linux-foundation.org>
* Andrew Morton (akpm@linux-foundation.org) wrote:
> On Tue, 19 Mar 2019 11:07:22 +0800 Peter Xu <peterx@redhat.com> wrote:
>
> > Add a global sysctl knob "vm.unprivileged_userfaultfd" to control
> > whether userfaultfd is allowed by unprivileged users. When this is
> > set to zero, only privileged users (root user, or users with the
> > CAP_SYS_PTRACE capability) will be able to use the userfaultfd
> > syscalls.
>
> Please send along a full description of why you believe Linux needs
> this feature, for me to add to the changelog. What is the benefit to
> our users? How will it be used?
>
> etcetera. As it was presented I'm seeing no justification for adding
> the patch!
How about:
---
Userfaultfd can be misued to make it easier to exploit existing use-after-free
(and similar) bugs that might otherwise only make a short window
or race condition available. By using userfaultfd to stall a kernel
thread, a malicious program can keep some state, that it wrote, stable
for an extended period, which it can then access using an existing
exploit. While it doesn't cause the exploit itself, and while it's not
the only thing that can stall a kernel thread when accessing a memory location,
it's one of the few that never needs priviledge.
Add a flag, allowing userfaultfd to be restricted, so that in general
it won't be useable by arbitrary user programs, but in environments that
require userfaultfd it can be turned back on.
---
Dave
--
Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
next prev parent reply other threads:[~2019-03-19 18:28 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-19 3:07 [PATCH v2 0/1] userfaultfd: allow to forbid unprivileged users Peter Xu
2019-03-19 3:07 ` [PATCH v2 1/1] userfaultfd/sysctl: add vm.unprivileged_userfaultfd Peter Xu
2019-03-19 7:11 ` Mike Rapoport
2019-03-19 18:07 ` Andrea Arcangeli
2019-03-19 18:02 ` Andrew Morton
2019-03-19 18:28 ` Dr. David Alan Gilbert [this message]
2019-03-20 0:20 ` Peter Xu
2019-03-20 19:01 ` Andrea Arcangeli
2019-03-21 13:43 ` Luis Chamberlain
2019-03-21 21:06 ` Andrea Arcangeli
2019-04-23 22:19 ` Kees Cook
2020-05-27 6:54 Xiaoming Ni
2020-05-27 14:21 ` Peter Xu
2020-05-28 8:50 ` Xiaoming Ni
2020-05-28 12:49 ` Peter Xu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190319182822.GK2727@work-vm \
--to=dgilbert@redhat.com \
--cc=aarcange@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=cracauer@cons.org \
--cc=dplotnikov@virtuozzo.com \
--cc=gokhale2@llnl.gov \
--cc=hannes@cmpxchg.org \
--cc=hughd@google.com \
--cc=jglisse@redhat.com \
--cc=keescook@chromium.org \
--cc=kirill@shutemov.name \
--cc=linux-api@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=maxime.coquelin@redhat.com \
--cc=mcfadden8@llnl.gov \
--cc=mcgrof@kernel.org \
--cc=mgorman@suse.de \
--cc=mike.kravetz@oracle.com \
--cc=pbonzini@redhat.com \
--cc=peterx@redhat.com \
--cc=rppt@linux.vnet.ibm.com \
--cc=xemul@virtuozzo.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).