From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.4 required=3.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 86343C83004 for ; Tue, 28 Apr 2020 22:02:10 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 625C5206D6 for ; Tue, 28 Apr 2020 22:02:10 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="Nb6/Li2p" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726661AbgD1WCI (ORCPT ); Tue, 28 Apr 2020 18:02:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48674 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S1726381AbgD1WCG (ORCPT ); Tue, 28 Apr 2020 18:02:06 -0400 Received: from mail-lj1-x243.google.com (mail-lj1-x243.google.com [IPv6:2a00:1450:4864:20::243]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8DC1FC03C1AC for ; Tue, 28 Apr 2020 15:02:06 -0700 (PDT) Received: by mail-lj1-x243.google.com with SMTP id a21so461089ljb.9 for ; Tue, 28 Apr 2020 15:02:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=qgsuGKbVjYSeRuT0TDuIXexAYzlpaF3ybirX/bZdq/M=; b=Nb6/Li2pKgIuauzZc2N7D4986KwsAReiq+tNfzAVNQVdh/FoY66ln1u7c/OYs5nAIQ 5UN/eOvHcUkIcP4q9blPXT94fH+WWdxswwCB5DKULdEHPi1YqR1dvk2z6PvlWWeAQAcm wQwwSDA8HHbq+YgMhNTWRBM/CImHC0LY9UotCwM0UgXh0tABr3MbTh+50pfQ0KbVJKi8 cg4w5xhIpzuG6Bd892VjlS1HnODoa4vjODLOrKsg/dV5ZzXRX6o13x78TwXT7LaG0BJE xgEIremOXnl4KN3PAUhl/lbPEuA27Zm/tMJk1F0bDyX0J3fzcmWjvKcuxbldGRhUrvwA AVzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=qgsuGKbVjYSeRuT0TDuIXexAYzlpaF3ybirX/bZdq/M=; b=GCBQcBFVJcMfnWDjctmUa7ZMStNut6uGsFe52ukzAZCC3J2aQpKH/eHsrvIk32zSYR BKpL8xk0CQTtrP+4uGVAUxX63+qeh4ZylUqb7mU59Oo9NULBJKRusxizCSGZPakb5tq/ ZRtxYxfI0bCVFpT+Z+zpMjef3nJl4CInVr4eBHTbjWx7ZgGgw/sX7mJZamIH2fBtT0R8 9fKAbRGrbakKhr6NOsThbh6MZJmHdSz82j+IKvsSRIQNbxTo+7JXw9cTAEfE61idww8L 1Y3gxZyI1F4sGI3ZTe9nLPVhHxVk+g6IQ3UGof02jRXDXTIM1x32dJM+KK33P5aZx3Bv GrzA== X-Gm-Message-State: AGi0PuYQ2m6sewsGf7o1ygq+OpNW37ltBbWnCHU1owuAV4hfL4vj7UjS y4E0CM3xbXVAKw20LQ5w4k8unbjgY9yG9M4zKbQydAkjxzHe5A== X-Google-Smtp-Source: APiQypK6ydV759YI7StmjgOVJfSU2MfnmxevWP+lyXRgv9iMHdwfQp34+B8t21gh6ZdagByaUv/XhQqYXuOXjfVzfUY= X-Received: by 2002:a2e:b249:: with SMTP id n9mr18998872ljm.221.1588111324730; Tue, 28 Apr 2020 15:02:04 -0700 (PDT) MIME-Version: 1.0 References: <20200428175129.634352-1-mic@digikod.net> <87blnb48a3.fsf@mid.deneb.enyo.de> In-Reply-To: <87blnb48a3.fsf@mid.deneb.enyo.de> From: Jann Horn Date: Wed, 29 Apr 2020 00:01:38 +0200 Message-ID: Subject: Re: [PATCH v3 0/5] Add support for RESOLVE_MAYEXEC To: Florian Weimer Cc: =?UTF-8?B?TWlja2HDq2wgU2FsYcO8bg==?= , kernel list , Aleksa Sarai , Alexei Starovoitov , Al Viro , Andy Lutomirski , Christian Heimes , Daniel Borkmann , Deven Bowers , Eric Chiang , James Morris , Jan Kara , Jonathan Corbet , Kees Cook , Matthew Garrett , Matthew Wilcox , Michael Kerrisk , =?UTF-8?B?TWlja2HDq2wgU2FsYcO8bg==?= , Mimi Zohar , =?UTF-8?Q?Philippe_Tr=C3=A9buchet?= , Scott Shell , Sean Christopherson , Shuah Khan , Steve Dower , Steve Grubb , Thibaut Sautereau , Vincent Strubel , Kernel Hardening , Linux API , linux-security-module , linux-fsdevel Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Apr 28, 2020 at 11:21 PM Florian Weimer wrote: > * Jann Horn: > > > Just as a comment: You'd probably also have to use RESOLVE_MAYEXEC in > > the dynamic linker. > > Absolutely. In typical configurations, the kernel does not enforce > that executable mappings must be backed by files which are executable. > It's most obvious with using an explicit loader invocation to run > executables on noexec mounts. RESOLVE_MAYEXEC is much more useful > than trying to reimplement the kernel permission checks (or what some > believe they should be) in userspace. Oh, good point. That actually seems like something Micka=C3=ABl could add to his series? If someone turns on that knob for "When an interpreter wants to execute something, enforce that we have execute access to it", they probably also don't want it to be possible to just map files as executable? So perhaps when that flag is on, the kernel should either refuse to map anything as executable if it wasn't opened with RESOLVE_MAYEXEC or (less strict) if RESOLVE_MAYEXEC wasn't used, print a warning, then check whether the file is executable and bail out if not? A configuration where interpreters verify that scripts are executable, but other things can just mmap executable pages, seems kinda inconsistent...