From: "Mickaël Salaün" <mickael.salaun@ssi.gouv.fr>
To: Florian Weimer <fweimer@redhat.com>, James Morris <jmorris@namei.org>
Cc: "Mickaël Salaün" <mic@digikod.net>,
linux-kernel@vger.kernel.org, "Al Viro" <viro@zeniv.linux.org.uk>,
"Jonathan Corbet" <corbet@lwn.net>,
"Kees Cook" <keescook@chromium.org>,
"Matthew Garrett" <mjg59@google.com>,
"Michael Kerrisk" <mtk.manpages@gmail.com>,
"Mimi Zohar" <zohar@linux.ibm.com>,
"Philippe Trébuchet" <philippe.trebuchet@ssi.gouv.fr>,
"Shuah Khan" <shuah@kernel.org>,
"Thibaut Sautereau" <thibaut.sautereau@ssi.gouv.fr>,
"Vincent Strubel" <vincent.strubel@ssi.gouv.fr>,
"Yves-Alexis Perez" <yves-alexis.perez@ssi.gouv.fr>,
kernel-hardening@lists.openwall.com, linux-api@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-fsdevel@vger.kernel.org
Subject: Re: [RFC PATCH v1 0/5] Add support for O_MAYEXEC
Date: Thu, 13 Dec 2018 15:57:15 +0100 [thread overview]
Message-ID: <21824ed9-0fe4-85dd-bdd2-d4426e97233d@ssi.gouv.fr> (raw)
In-Reply-To: <87ftv2ovp8.fsf@oldenburg2.str.redhat.com>
On 13/12/2018 06:13, Florian Weimer wrote:
> * James Morris:
>
>> On Wed, 12 Dec 2018, Florian Weimer wrote:
>>
>>> * James Morris:
>>>
>>>> If you're depending on the script interpreter to flag that the user may
>>>> execute code, this seems to be equivalent in security terms to depending
>>>> on the user. e.g. what if the user uses ptrace and clears O_MAYEXEC?
This security mechanism makes sense in an hardened system where the user
is not allowed to import and execute new file (write xor execute
policy). This can be enforced with appropriate mount points a more
advanced access control policy.
>>>
>>> The argument I've heard is this: Using ptrace (and adding the +x
>>> attribute) are auditable events.
>>
>> I guess you could also preload a modified libc which strips the flag.
>
> My understanding is that this new libc would have to come somewhere, and
> making it executable would be an auditable even as well.
Auditing is a possible use case as well, but the W^X idea is to deny use
of libraries which are not in an executable mount point, i.e. only
execute trusted code.
next prev parent reply other threads:[~2018-12-13 14:57 UTC|newest]
Thread overview: 43+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-12 8:17 [RFC PATCH v1 0/5] Add support for O_MAYEXEC Mickaël Salaün
2018-12-12 8:17 ` [RFC PATCH v1 1/5] fs: Add support for an O_MAYEXEC flag on sys_open() Mickaël Salaün
2018-12-12 14:43 ` Jan Kara
2018-12-12 17:09 ` Mickaël Salaün
2018-12-12 20:42 ` Mimi Zohar
2018-12-13 9:47 ` Matthew Bobrowski
2018-12-13 14:23 ` Mickaël Salaün
2019-04-15 18:47 ` Steve Grubb
2019-04-16 11:49 ` Florian Weimer
2019-04-16 15:34 ` Steve Grubb
2019-04-17 10:01 ` Florian Weimer
2019-04-17 15:04 ` Mickaël Salaün
2019-04-17 14:55 ` Mickaël Salaün
2019-08-04 23:55 ` Andy Lutomirski
2019-08-06 16:40 ` Mickaël Salaün
2018-12-12 8:17 ` [RFC PATCH v1 2/5] fs: Add a MAY_EXECMOUNT flag to infer the noexec mount propertie Mickaël Salaün
2018-12-12 8:17 ` [RFC PATCH v1 3/5] Yama: Enforces noexec mounts or file executability through O_MAYEXEC Mickaël Salaün
2018-12-12 14:28 ` Mickaël Salaün
2018-12-12 17:09 ` Jann Horn
2018-12-13 14:49 ` Mickaël Salaün
2019-01-03 11:17 ` Jann Horn
2019-01-08 13:29 ` Mickaël Salaün
2019-01-08 23:30 ` Kees Cook
2019-01-09 13:41 ` Mickaël Salaün
2018-12-12 8:17 ` [RFC PATCH v1 4/5] selftest/yama: Add tests for O_MAYEXEC enforcing Mickaël Salaün
2018-12-12 8:17 ` [RFC PATCH v1 5/5] doc: Add documentation for Yama's open_mayexec_enforce Mickaël Salaün
2018-12-12 16:29 ` [RFC PATCH v1 0/5] Add support for O_MAYEXEC Jordan Glover
2018-12-12 17:01 ` Mickaël Salaün
2018-12-12 19:51 ` James Morris
2018-12-12 20:13 ` Florian Weimer
2018-12-12 23:40 ` James Morris
2018-12-13 5:13 ` Florian Weimer
2018-12-13 14:57 ` Mickaël Salaün [this message]
2018-12-13 3:02 ` Matthew Wilcox
2018-12-13 5:22 ` Florian Weimer
2018-12-13 11:04 ` Mimi Zohar
2018-12-13 11:26 ` Florian Weimer
2018-12-13 12:16 ` Mimi Zohar
2018-12-13 12:16 ` Matthew Wilcox
2018-12-13 15:17 ` Mickaël Salaün
2018-12-13 17:13 ` Matthew Wilcox
2018-12-13 17:36 ` Mickaël Salaün
2018-12-13 17:44 ` Matthew Wilcox
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=21824ed9-0fe4-85dd-bdd2-d4426e97233d@ssi.gouv.fr \
--to=mickael.salaun@ssi.gouv.fr \
--cc=corbet@lwn.net \
--cc=fweimer@redhat.com \
--cc=jmorris@namei.org \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-api@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mic@digikod.net \
--cc=mjg59@google.com \
--cc=mtk.manpages@gmail.com \
--cc=philippe.trebuchet@ssi.gouv.fr \
--cc=shuah@kernel.org \
--cc=thibaut.sautereau@ssi.gouv.fr \
--cc=vincent.strubel@ssi.gouv.fr \
--cc=viro@zeniv.linux.org.uk \
--cc=yves-alexis.perez@ssi.gouv.fr \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).