From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1763375AbcINQRw (ORCPT ); Wed, 14 Sep 2016 12:17:52 -0400 Received: from mail-wm0-f45.google.com ([74.125.82.45]:37777 "EHLO mail-wm0-f45.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1761966AbcINQRr (ORCPT ); Wed, 14 Sep 2016 12:17:47 -0400 MIME-Version: 1.0 In-Reply-To: <20160914150416.2d938c60@lxorguk.ukuu.org.uk> References: <20160908223558.GA11742@www.outflux.net> <43f1953c-d8a3-647f-20eb-bec4898e1b8e@suse.cz> <20160914150416.2d938c60@lxorguk.ukuu.org.uk> From: Kees Cook Date: Wed, 14 Sep 2016 09:17:44 -0700 X-Google-Sender-Auth: SA1klU7ujFB16sBP2dAwcH5URtc Message-ID: Subject: Re: [PATCH] pty: make ptmx file ops read-only after init To: One Thousand Gnomes Cc: Jiri Slaby , Greg Kroah-Hartman , "kernel-hardening@lists.openwall.com" , LKML Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Sep 14, 2016 at 7:04 AM, One Thousand Gnomes wrote: > On Wed, 14 Sep 2016 09:59:42 +0200 > Jiri Slaby wrote: > >> On 09/09/2016, 12:35 AM, Kees Cook wrote: >> > The ptmx_fops structure is only changed during init, so mark it as such. >> >> Right, but I am missing what is the benefit? You would have to elaborate >> here... > > The pages end up marked read only even to the kernel (and in future could > even be marked read only forever when in kvm if we get suitable virtual > machine extensions). That makes it much harder to patch those vectors > when making security attacks. Correct, this is a continuing effort to reduce the internal attack surface of the kernel, where one of the most common exploitation methods is overwriting function pointers. Some examples of attacks and mitigations are here: http://kernsec.org/wiki/index.php/Exploit_Methods/Function_pointer_overwrite While this patch isn't a huge change, it's still a viable candidate. I send these as I notice them, and hope that other folks will start to see these opportunities and send more patches too. :) -Kees -- Kees Cook Nexus Security