* [PATCH] ELF: warn if process starts with executable stack
@ 2019-11-18 14:51 Alexey Dobriyan
2019-11-18 17:13 ` Ben Dooks
2019-11-18 20:54 ` Andrew Morton
0 siblings, 2 replies; 10+ messages in thread
From: Alexey Dobriyan @ 2019-11-18 14:51 UTC (permalink / raw)
To: akpm; +Cc: linux-kernel, linux-arch, security
PT_GNU_STACK is fail open design, at least warn people that something
isn't right.
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
---
fs/exec.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -762,6 +762,13 @@ int setup_arg_pages(struct linux_binprm *bprm,
goto out_unlock;
BUG_ON(prev != vma);
+#ifdef CONFIG_MMU
+ if (vm_flags & VM_EXEC) {
+ pr_warn_once("process '%s'/%u started with executable stack\n",
+ current->comm, current->pid);
+ }
+#endif
+
/* Move stack pages down in memory. */
if (stack_shift) {
ret = shift_arg_pages(vma, stack_shift);
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] ELF: warn if process starts with executable stack
2019-11-18 14:51 [PATCH] ELF: warn if process starts with executable stack Alexey Dobriyan
@ 2019-11-18 17:13 ` Ben Dooks
2019-11-18 20:54 ` Andrew Morton
1 sibling, 0 replies; 10+ messages in thread
From: Ben Dooks @ 2019-11-18 17:13 UTC (permalink / raw)
To: Alexey Dobriyan, akpm; +Cc: linux-kernel, linux-arch, security
On 18/11/2019 14:51, Alexey Dobriyan wrote:
> PT_GNU_STACK is fail open design, at least warn people that something
> isn't right.
>
> Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
> ---
>
> fs/exec.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> --- a/fs/exec.c
> +++ b/fs/exec.c
> @@ -762,6 +762,13 @@ int setup_arg_pages(struct linux_binprm *bprm,
> goto out_unlock;
> BUG_ON(prev != vma);
>
it might be worth to use:
if (IS_ENABLED(CONFIG_MMU) && vm_flags & VM_EXEC) {
instead of the #ifdef
> +#ifdef CONFIG_MMU
> + if (vm_flags & VM_EXEC) {
> + pr_warn_once("process '%s'/%u started with executable stack\n",
> + current->comm, current->pid);
> + }
> +#endif
> +
> /* Move stack pages down in memory. */
> if (stack_shift) {
> ret = shift_arg_pages(vma, stack_shift);
>
--
Ben Dooks http://www.codethink.co.uk/
Senior Engineer Codethink - Providing Genius
https://www.codethink.co.uk/privacy.html
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] ELF: warn if process starts with executable stack
2019-11-18 14:51 [PATCH] ELF: warn if process starts with executable stack Alexey Dobriyan
2019-11-18 17:13 ` Ben Dooks
@ 2019-11-18 20:54 ` Andrew Morton
2019-11-18 21:36 ` Alexey Dobriyan
2019-11-18 21:52 ` [PATCH] exec: " Alexey Dobriyan
1 sibling, 2 replies; 10+ messages in thread
From: Andrew Morton @ 2019-11-18 20:54 UTC (permalink / raw)
To: Alexey Dobriyan; +Cc: linux-kernel, linux-arch, security
On Mon, 18 Nov 2019 17:51:15 +0300 Alexey Dobriyan <adobriyan@gmail.com> wrote:
> PT_GNU_STACK is fail open design,
Not sure what this means. Please expand on the motivation for this
change.
> at least warn people that something
> isn't right.
People who use an executable stack get a kernel splat. How is that
useful?
> ...
>
> --- a/fs/exec.c
> +++ b/fs/exec.c
> @@ -762,6 +762,13 @@ int setup_arg_pages(struct linux_binprm *bprm,
> goto out_unlock;
> BUG_ON(prev != vma);
>
> +#ifdef CONFIG_MMU
> + if (vm_flags & VM_EXEC) {
> + pr_warn_once("process '%s'/%u started with executable stack\n",
> + current->comm, current->pid);
> + }
> +#endif
>
> /* Move stack pages down in memory. */
> if (stack_shift) {
> ret = shift_arg_pages(vma, stack_shift);
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] ELF: warn if process starts with executable stack
2019-11-18 20:54 ` Andrew Morton
@ 2019-11-18 21:36 ` Alexey Dobriyan
2019-11-18 21:52 ` [PATCH] exec: " Alexey Dobriyan
1 sibling, 0 replies; 10+ messages in thread
From: Alexey Dobriyan @ 2019-11-18 21:36 UTC (permalink / raw)
To: Andrew Morton; +Cc: linux-kernel, linux-arch, security, ben.dooks
On Mon, Nov 18, 2019 at 12:54:57PM -0800, Andrew Morton wrote:
> On Mon, 18 Nov 2019 17:51:15 +0300 Alexey Dobriyan <adobriyan@gmail.com> wrote:
>
> > PT_GNU_STACK is fail open design,
>
> Not sure what this means. Please expand on the motivation for this
> change.
>
> > at least warn people that something
> > isn't right.
>
> People who use an executable stack get a kernel splat. How is that
> useful?
There were two stories about silent downgrade to an executable stack:
1)
compiling .S file and linking it to normal code:
$ cat f.S
.intel_syntax noprefix
.text
.globl f
f:
ret
will silently add PT_GNU_STACK segment with RWE permissions
2)
closures with nested functions will require executable stack
https://nullprogram.com/blog/2019/11/15/
> > --- a/fs/exec.c
> > +++ b/fs/exec.c
> > @@ -762,6 +762,13 @@ int setup_arg_pages(struct linux_binprm *bprm,
> > goto out_unlock;
> > BUG_ON(prev != vma);
> >
> > +#ifdef CONFIG_MMU
This code is already under CONFIG_MMU. I'll resend.
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH] exec: warn if process starts with executable stack
2019-11-18 20:54 ` Andrew Morton
2019-11-18 21:36 ` Alexey Dobriyan
@ 2019-11-18 21:52 ` Alexey Dobriyan
2019-11-19 5:32 ` Dan Carpenter
2019-11-20 19:17 ` Will Deacon
1 sibling, 2 replies; 10+ messages in thread
From: Alexey Dobriyan @ 2019-11-18 21:52 UTC (permalink / raw)
To: Andrew Morton; +Cc: linux-kernel, linux-arch, security, ben.dooks
There were few episodes of silent downgrade to an executable stack:
1) linking innocent looking assembly file
$ cat f.S
.intel_syntax noprefix
.text
.globl f
f:
ret
$ cat main.c
void f(void);
int main(void)
{
f();
return 0;
}
$ gcc main.c f.S
$ readelf -l ./a.out
GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 RWE 0x10
2) converting C99 nested function into a closure
https://nullprogram.com/blog/2019/11/15/
void intsort2(int *base, size_t nmemb, _Bool invert)
{
int cmp(const void *a, const void *b)
{
int r = *(int *)a - *(int *)b;
return invert ? -r : r;
}
qsort(base, nmemb, sizeof(*base), cmp);
}
will silently require stack trampolines while non-closure version will not.
While without a double this behaviour is documented somewhere, add a warning
so that developers and users can at least notice. After so many years of x86_64
having proper executable stack support it should not cause too much problems.
If the system is old or CPU is old, then there will be an early warning
against init and/or support personnel will write that "uh-oh, our Enterprise
Software absolutely requires executable stack" and close tickets and customers
will nod heads and life moves on.
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
---
fs/exec.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -762,6 +762,11 @@ int setup_arg_pages(struct linux_binprm *bprm,
goto out_unlock;
BUG_ON(prev != vma);
+ if (vm_flags & VM_EXEC) {
+ pr_warn_once("process '%s'/%u started with executable stack\n",
+ current->comm, current->pid);
+ }
+
/* Move stack pages down in memory. */
if (stack_shift) {
ret = shift_arg_pages(vma, stack_shift);
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] exec: warn if process starts with executable stack
2019-11-18 21:52 ` [PATCH] exec: " Alexey Dobriyan
@ 2019-11-19 5:32 ` Dan Carpenter
2019-11-20 19:17 ` Will Deacon
1 sibling, 0 replies; 10+ messages in thread
From: Dan Carpenter @ 2019-11-19 5:32 UTC (permalink / raw)
To: Alexey Dobriyan
Cc: Andrew Morton, linux-kernel, linux-arch, security, ben.dooks
On Tue, Nov 19, 2019 at 12:52:27AM +0300, Alexey Dobriyan wrote:
> There were few episodes of silent downgrade to an executable stack:
>
> 1) linking innocent looking assembly file
>
> $ cat f.S
> .intel_syntax noprefix
> .text
> .globl f
> f:
> ret
>
> $ cat main.c
> void f(void);
> int main(void)
> {
> f();
> return 0;
> }
>
> $ gcc main.c f.S
> $ readelf -l ./a.out
> GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000
> 0x0000000000000000 0x0000000000000000 RWE 0x10
>
> 2) converting C99 nested function into a closure
> https://nullprogram.com/blog/2019/11/15/
>
> void intsort2(int *base, size_t nmemb, _Bool invert)
> {
> int cmp(const void *a, const void *b)
> {
> int r = *(int *)a - *(int *)b;
> return invert ? -r : r;
> }
> qsort(base, nmemb, sizeof(*base), cmp);
> }
>
> will silently require stack trampolines while non-closure version will not.
>
> While without a double this behaviour is documented somewhere, add a warning
^^^^^^
doubt
> so that developers and users can at least notice. After so many years of x86_64
> having proper executable stack support it should not cause too much problems.
>
> If the system is old or CPU is old, then there will be an early warning
> against init and/or support personnel will write that "uh-oh, our Enterprise
> Software absolutely requires executable stack" and close tickets and customers
> will nod heads and life moves on.
>
regards,
dan carpenter
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] exec: warn if process starts with executable stack
2019-11-18 21:52 ` [PATCH] exec: " Alexey Dobriyan
2019-11-19 5:32 ` Dan Carpenter
@ 2019-11-20 19:17 ` Will Deacon
2019-11-20 20:28 ` Eric W. Biederman
1 sibling, 1 reply; 10+ messages in thread
From: Will Deacon @ 2019-11-20 19:17 UTC (permalink / raw)
To: Alexey Dobriyan
Cc: Andrew Morton, linux-kernel, linux-arch, security, ben.dooks
On Tue, Nov 19, 2019 at 12:52:27AM +0300, Alexey Dobriyan wrote:
> There were few episodes of silent downgrade to an executable stack:
>
> 1) linking innocent looking assembly file
>
> $ cat f.S
> .intel_syntax noprefix
> .text
> .globl f
> f:
> ret
>
> $ cat main.c
> void f(void);
> int main(void)
> {
> f();
> return 0;
> }
>
> $ gcc main.c f.S
> $ readelf -l ./a.out
> GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000
> 0x0000000000000000 0x0000000000000000 RWE 0x10
>
> 2) converting C99 nested function into a closure
> https://nullprogram.com/blog/2019/11/15/
>
> void intsort2(int *base, size_t nmemb, _Bool invert)
> {
> int cmp(const void *a, const void *b)
> {
> int r = *(int *)a - *(int *)b;
> return invert ? -r : r;
> }
> qsort(base, nmemb, sizeof(*base), cmp);
> }
>
> will silently require stack trampolines while non-closure version will not.
>
> While without a double this behaviour is documented somewhere, add a warning
> so that developers and users can at least notice. After so many years of x86_64
> having proper executable stack support it should not cause too much problems.
>
> If the system is old or CPU is old, then there will be an early warning
> against init and/or support personnel will write that "uh-oh, our Enterprise
> Software absolutely requires executable stack" and close tickets and customers
> will nod heads and life moves on.
>
> Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
> ---
>
> fs/exec.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> --- a/fs/exec.c
> +++ b/fs/exec.c
> @@ -762,6 +762,11 @@ int setup_arg_pages(struct linux_binprm *bprm,
> goto out_unlock;
> BUG_ON(prev != vma);
>
> + if (vm_flags & VM_EXEC) {
> + pr_warn_once("process '%s'/%u started with executable stack\n",
> + current->comm, current->pid);
> + }
Given that this is triggerable by userspace, is there a concern about PID
namespaces here?
Will
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] exec: warn if process starts with executable stack
2019-11-20 19:17 ` Will Deacon
@ 2019-11-20 20:28 ` Eric W. Biederman
2019-11-21 9:38 ` Will Deacon
0 siblings, 1 reply; 10+ messages in thread
From: Eric W. Biederman @ 2019-11-20 20:28 UTC (permalink / raw)
To: Will Deacon
Cc: Alexey Dobriyan, Andrew Morton, linux-kernel, linux-arch,
security, ben.dooks
Will Deacon <will@kernel.org> writes:
> On Tue, Nov 19, 2019 at 12:52:27AM +0300, Alexey Dobriyan wrote:
>> There were few episodes of silent downgrade to an executable stack:
>>
>> 1) linking innocent looking assembly file
>>
>> $ cat f.S
>> .intel_syntax noprefix
>> .text
>> .globl f
>> f:
>> ret
>>
>> $ cat main.c
>> void f(void);
>> int main(void)
>> {
>> f();
>> return 0;
>> }
>>
>> $ gcc main.c f.S
>> $ readelf -l ./a.out
>> GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000
>> 0x0000000000000000 0x0000000000000000 RWE 0x10
>>
>> 2) converting C99 nested function into a closure
>> https://nullprogram.com/blog/2019/11/15/
>>
>> void intsort2(int *base, size_t nmemb, _Bool invert)
>> {
>> int cmp(const void *a, const void *b)
>> {
>> int r = *(int *)a - *(int *)b;
>> return invert ? -r : r;
>> }
>> qsort(base, nmemb, sizeof(*base), cmp);
>> }
>>
>> will silently require stack trampolines while non-closure version will not.
>>
>> While without a double this behaviour is documented somewhere, add a warning
>> so that developers and users can at least notice. After so many years of x86_64
>> having proper executable stack support it should not cause too much problems.
>>
>> If the system is old or CPU is old, then there will be an early warning
>> against init and/or support personnel will write that "uh-oh, our Enterprise
>> Software absolutely requires executable stack" and close tickets and customers
>> will nod heads and life moves on.
>>
>> Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
>> ---
>>
>> fs/exec.c | 5 +++++
>> 1 file changed, 5 insertions(+)
>>
>> --- a/fs/exec.c
>> +++ b/fs/exec.c
>> @@ -762,6 +762,11 @@ int setup_arg_pages(struct linux_binprm *bprm,
>> goto out_unlock;
>> BUG_ON(prev != vma);
>>
>> + if (vm_flags & VM_EXEC) {
>> + pr_warn_once("process '%s'/%u started with executable stack\n",
>> + current->comm, current->pid);
>> + }
>
> Given that this is triggerable by userspace, is there a concern about PID
> namespaces here?
In what sense? Are you thinking about the printing of the pid?
Pretty much by fiat and by definition the kernel log always print things
in the initial pid namespace. Which this printk does.
Eric
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] exec: warn if process starts with executable stack
2019-11-20 20:28 ` Eric W. Biederman
@ 2019-11-21 9:38 ` Will Deacon
2019-12-08 16:43 ` Alexey Dobriyan
0 siblings, 1 reply; 10+ messages in thread
From: Will Deacon @ 2019-11-21 9:38 UTC (permalink / raw)
To: Eric W. Biederman
Cc: Alexey Dobriyan, Andrew Morton, linux-kernel, linux-arch,
security, ben.dooks
On Wed, Nov 20, 2019 at 02:28:37PM -0600, Eric W. Biederman wrote:
> Will Deacon <will@kernel.org> writes:
>
> > On Tue, Nov 19, 2019 at 12:52:27AM +0300, Alexey Dobriyan wrote:
> >> There were few episodes of silent downgrade to an executable stack:
> >>
> >> 1) linking innocent looking assembly file
> >>
> >> $ cat f.S
> >> .intel_syntax noprefix
> >> .text
> >> .globl f
> >> f:
> >> ret
> >>
> >> $ cat main.c
> >> void f(void);
> >> int main(void)
> >> {
> >> f();
> >> return 0;
> >> }
> >>
> >> $ gcc main.c f.S
> >> $ readelf -l ./a.out
> >> GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000
> >> 0x0000000000000000 0x0000000000000000 RWE 0x10
> >>
> >> 2) converting C99 nested function into a closure
> >> https://nullprogram.com/blog/2019/11/15/
> >>
> >> void intsort2(int *base, size_t nmemb, _Bool invert)
> >> {
> >> int cmp(const void *a, const void *b)
> >> {
> >> int r = *(int *)a - *(int *)b;
> >> return invert ? -r : r;
> >> }
> >> qsort(base, nmemb, sizeof(*base), cmp);
> >> }
> >>
> >> will silently require stack trampolines while non-closure version will not.
> >>
> >> While without a double this behaviour is documented somewhere, add a warning
> >> so that developers and users can at least notice. After so many years of x86_64
> >> having proper executable stack support it should not cause too much problems.
> >>
> >> If the system is old or CPU is old, then there will be an early warning
> >> against init and/or support personnel will write that "uh-oh, our Enterprise
> >> Software absolutely requires executable stack" and close tickets and customers
> >> will nod heads and life moves on.
> >>
> >> Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
> >> ---
> >>
> >> fs/exec.c | 5 +++++
> >> 1 file changed, 5 insertions(+)
> >>
> >> --- a/fs/exec.c
> >> +++ b/fs/exec.c
> >> @@ -762,6 +762,11 @@ int setup_arg_pages(struct linux_binprm *bprm,
> >> goto out_unlock;
> >> BUG_ON(prev != vma);
> >>
> >> + if (vm_flags & VM_EXEC) {
> >> + pr_warn_once("process '%s'/%u started with executable stack\n",
> >> + current->comm, current->pid);
> >> + }
> >
> > Given that this is triggerable by userspace, is there a concern about PID
> > namespaces here?
>
> In what sense? Are you thinking about the printing of the pid?
>
> Pretty much by fiat and by definition the kernel log always print things
> in the initial pid namespace. Which this printk does.
Ok, fair enough. Just wanted to make sure it was ok, since we're not using
a task_pid_nr*() accessor and it might have been overlooked.
Will
Will
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] exec: warn if process starts with executable stack
2019-11-21 9:38 ` Will Deacon
@ 2019-12-08 16:43 ` Alexey Dobriyan
0 siblings, 0 replies; 10+ messages in thread
From: Alexey Dobriyan @ 2019-12-08 16:43 UTC (permalink / raw)
To: Will Deacon
Cc: Eric W. Biederman, Andrew Morton, linux-kernel, linux-arch,
security, ben.dooks
On Thu, Nov 21, 2019 at 09:38:06AM +0000, Will Deacon wrote:
> On Wed, Nov 20, 2019 at 02:28:37PM -0600, Eric W. Biederman wrote:
> > Will Deacon <will@kernel.org> writes:
> >
> > > On Tue, Nov 19, 2019 at 12:52:27AM +0300, Alexey Dobriyan wrote:
> > >> There were few episodes of silent downgrade to an executable stack:
> > >>
> > >> 1) linking innocent looking assembly file
> > >>
> > >> $ cat f.S
> > >> .intel_syntax noprefix
> > >> .text
> > >> .globl f
> > >> f:
> > >> ret
> > >>
> > >> $ cat main.c
> > >> void f(void);
> > >> int main(void)
> > >> {
> > >> f();
> > >> return 0;
> > >> }
> > >>
> > >> $ gcc main.c f.S
> > >> $ readelf -l ./a.out
> > >> GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000
> > >> 0x0000000000000000 0x0000000000000000 RWE 0x10
> > >>
> > >> 2) converting C99 nested function into a closure
> > >> https://nullprogram.com/blog/2019/11/15/
> > >>
> > >> void intsort2(int *base, size_t nmemb, _Bool invert)
> > >> {
> > >> int cmp(const void *a, const void *b)
> > >> {
> > >> int r = *(int *)a - *(int *)b;
> > >> return invert ? -r : r;
> > >> }
> > >> qsort(base, nmemb, sizeof(*base), cmp);
> > >> }
> > >>
> > >> will silently require stack trampolines while non-closure version will not.
> > >>
> > >> While without a double this behaviour is documented somewhere, add a warning
> > >> so that developers and users can at least notice. After so many years of x86_64
> > >> having proper executable stack support it should not cause too much problems.
> > >>
> > >> If the system is old or CPU is old, then there will be an early warning
> > >> against init and/or support personnel will write that "uh-oh, our Enterprise
> > >> Software absolutely requires executable stack" and close tickets and customers
> > >> will nod heads and life moves on.
> > >>
> > >> Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
> > >> ---
> > >>
> > >> fs/exec.c | 5 +++++
> > >> 1 file changed, 5 insertions(+)
> > >>
> > >> --- a/fs/exec.c
> > >> +++ b/fs/exec.c
> > >> @@ -762,6 +762,11 @@ int setup_arg_pages(struct linux_binprm *bprm,
> > >> goto out_unlock;
> > >> BUG_ON(prev != vma);
> > >>
> > >> + if (vm_flags & VM_EXEC) {
> > >> + pr_warn_once("process '%s'/%u started with executable stack\n",
> > >> + current->comm, current->pid);
> > >> + }
> > >
> > > Given that this is triggerable by userspace, is there a concern about PID
> > > namespaces here?
> >
> > In what sense? Are you thinking about the printing of the pid?
> >
> > Pretty much by fiat and by definition the kernel log always print things
> > in the initial pid namespace. Which this printk does.
>
> Ok, fair enough. Just wanted to make sure it was ok, since we're not using
> a task_pid_nr*() accessor and it might have been overlooked.
PID is printed both as ->pid and a task_pid_vnr().
I'll just print filename, so that executable can be easily found.
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2019-12-08 16:44 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-11-18 14:51 [PATCH] ELF: warn if process starts with executable stack Alexey Dobriyan
2019-11-18 17:13 ` Ben Dooks
2019-11-18 20:54 ` Andrew Morton
2019-11-18 21:36 ` Alexey Dobriyan
2019-11-18 21:52 ` [PATCH] exec: " Alexey Dobriyan
2019-11-19 5:32 ` Dan Carpenter
2019-11-20 19:17 ` Will Deacon
2019-11-20 20:28 ` Eric W. Biederman
2019-11-21 9:38 ` Will Deacon
2019-12-08 16:43 ` Alexey Dobriyan
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).