From: Kyle Huey <me@kylehuey.com>
To: Andy Lutomirski <luto@amacapital.net>
Cc: "Robert O'Callahan" <robert@ocallahan.org>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, "H. Peter Anvin" <hpa@zytor.com>,
"maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT)"
<x86@kernel.org>, Shuah Khan <shuah@kernel.org>,
"Peter Zijlstra (Intel)" <peterz@infradead.org>,
Borislav Petkov <bp@suse.de>,
"Rafael J. Wysocki" <rafael.j.wysocki@intel.com>,
Len Brown <len.brown@intel.com>,
Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>,
Aravind Gopalakrishnan <Aravind.Gopalakrishnan@amd.com>,
Alexander Shishkin <alexander.shishkin@linux.intel.com>,
Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>,
Andy Lutomirski <luto@kernel.org>,
Frederic Weisbecker <fweisbec@gmail.com>,
Dmitry Safonov <dsafonov@virtuozzo.com>,
Kees Cook <keescook@chromium.org>,
"Michael S. Tsirkin" <mst@redhat.com>,
Andrey Ryabinin <aryabinin@virtuozzo.com>,
Jiri Slaby <jslaby@suse.cz>,
Paul Gortmaker <paul.gortmaker@windriver.com>,
Denys Vlasenko <dvlasenk@redhat.com>,
Dave Hansen <dave.hansen@linux.intel.com>,
"open list:X86 ARCHITECTURE (32-BIT AND 64-BIT)"
<linux-kernel@vger.kernel.org>,
"open list:KERNEL SELFTEST FRAMEWORK"
<linux-kselftest@vger.kernel.org>
Subject: Re: [PATCH v2 3/3] x86,arch_prctl Add ARCH_[GET|SET]_CPUID for controlling the CPUID instruction
Date: Wed, 14 Sep 2016 19:19:49 -0700 [thread overview]
Message-ID: <CAP045AqaB=+QKOnm7iOXimF0JxRfvHfBGhRoyRd1u2D19EMDqA@mail.gmail.com> (raw)
In-Reply-To: <CALCETrWqYrotMSKqvsug-fgbO1-4X6q0FQpsiTrPkWSzu56NAA@mail.gmail.com>
On Wed, Sep 14, 2016 at 6:54 PM, Andy Lutomirski <luto@amacapital.net> wrote:
> On Wed, Sep 14, 2016 at 6:47 PM, Kyle Huey <me@kylehuey.com> wrote:
>> On Wed, Sep 14, 2016 at 6:29 PM, Andy Lutomirski <luto@amacapital.net> wrote:
>>> On Wed, Sep 14, 2016 at 2:01 PM, Kyle Huey <me@kylehuey.com> wrote:
>
>>>> +
>>>> +int set_cpuid_mode(struct task_struct *task, unsigned long val)
>>>> +{
>>>> + /* Only disable/enable_cpuid() if it is supported on this hardware. */
>>>> + bool cpuid_fault_supported = static_cpu_has(X86_FEATURE_CPUID_FAULT);
>>>> +
>>>> + if (val == ARCH_CPUID_ENABLE && cpuid_fault_supported) {
>>>> + if (task_no_new_privs(task) && test_thread_flag(TIF_NOCPUID))
>>>> + return -EACCES;
>>>
>>> This check seems confused. If this flag were preserved on execve,
>>> it's the SIGSEGV mode that would need the check.
>>
>> Not sure I follow this one. no_new_privs should block transitions
>> from SIGSEGV to ENABLE, right? That's what this check does.
>
> It's the other way around entirely: if you make a change to your
> process context such that a subseqently execve()'d setuid program
> might malfunction, you've just done something dangerous. This is only
> okay, at least in newly-supported instances, if you are either
> privileged or if you have no_new_privs set. Having privilege makes it
> okay: unprivileged programs can't use it to subvert setuid programs.
> no_new_privs makes it safe as well: if no_new_privs is set, you can't
> gain privilege via execve(), so there's no attack surface. So, if you
> have execve() keep ARCH_CPUID_SIGSEGV set, then setting it that way in
> the first place should require privilege or no_new_privs.
>
> I personally favor resetting to ARCH_CPUID_ENABLE on execve() and not
> worrying about no_new_privs.
>
> Does that make sense?
Yes, ok. Robert and I agree that resetting does make the most sense.
Using this usefully requires a ptrace supervisor (to catch the traps),
which can easily inject a call to arch_prctl to reenable
ARCH_CPUID_SIGSEGV when desired.
- Kyle
prev parent reply other threads:[~2016-09-15 2:20 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <1473886902-17902-1-git-send-email-khuey@kylehuey.com>
2016-09-14 21:01 ` [PATCH v2 1/3] syscalls,x86 Expose arch_prctl on x86-32 Kyle Huey
2016-09-14 21:29 ` Dave Hansen
2016-09-14 21:35 ` Kyle Huey
2016-09-14 21:46 ` Dave Hansen
2016-09-14 21:56 ` Kyle Huey
2016-09-14 22:23 ` kbuild test robot
2016-09-15 0:01 ` kbuild test robot
2016-09-15 0:01 ` kbuild test robot
2016-09-15 1:14 ` Andy Lutomirski
2016-09-14 21:01 ` [PATCH v2 2/3] x86 Test and expose CPUID faulting capabilities in /proc/cpuinfo Kyle Huey
2016-09-14 21:35 ` Dave Hansen
2016-09-14 22:03 ` Kyle Huey
2016-09-15 1:17 ` Andy Lutomirski
2016-09-15 2:20 ` Kyle Huey
2016-09-15 20:38 ` H. Peter Anvin
2016-09-15 23:18 ` Andy Lutomirski
2016-09-15 10:07 ` David Vrabel
2016-09-15 10:05 ` [Xen-devel] " David Vrabel
2016-09-15 10:25 ` Jan Beulich
2016-09-15 19:11 ` Kyle Huey
2016-09-15 19:37 ` Andy Lutomirski
2016-09-15 23:36 ` Kyle Huey
2016-09-15 19:41 ` Boris Ostrovsky
2016-09-14 21:01 ` [PATCH v2 3/3] x86,arch_prctl Add ARCH_[GET|SET]_CPUID for controlling the CPUID instruction Kyle Huey
2016-09-15 1:29 ` Andy Lutomirski
2016-09-15 1:47 ` Kyle Huey
2016-09-15 1:54 ` Andy Lutomirski
2016-09-15 2:19 ` Kyle Huey [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAP045AqaB=+QKOnm7iOXimF0JxRfvHfBGhRoyRd1u2D19EMDqA@mail.gmail.com' \
--to=me@kylehuey.com \
--cc=Aravind.Gopalakrishnan@amd.com \
--cc=alexander.shishkin@linux.intel.com \
--cc=aryabinin@virtuozzo.com \
--cc=bp@suse.de \
--cc=dave.hansen@linux.intel.com \
--cc=dsafonov@virtuozzo.com \
--cc=dvlasenk@redhat.com \
--cc=fweisbec@gmail.com \
--cc=hpa@zytor.com \
--cc=jslaby@suse.cz \
--cc=keescook@chromium.org \
--cc=len.brown@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=mst@redhat.com \
--cc=paul.gortmaker@windriver.com \
--cc=peterz@infradead.org \
--cc=rafael.j.wysocki@intel.com \
--cc=robert@ocallahan.org \
--cc=shuah@kernel.org \
--cc=srinivas.pandruvada@linux.intel.com \
--cc=tglx@linutronix.de \
--cc=vladimir_zapolskiy@mentor.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).