From mboxrd@z Thu Jan 1 00:00:00 1970 From: Willy Tarreau Subject: Re: [PATCH v3 2/3] x86/ldt: Make modify_ldt optional Date: Fri, 24 Jul 2015 09:48:01 +0200 Message-ID: <20150724074801.GA3396__12411.6693078124$1437724268$gmane$org@1wt.eu> References: <7bfde005b84a90a83bf668a320c7d4ad1b940065.1437592883.git.luto@kernel.org> <20150723102434.GA2929@1wt.eu> <20150723235805.GA3191@1wt.eu> <20150724072451.GB3293@1wt.eu> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: <20150724072451.GB3293@1wt.eu> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Kees Cook Cc: "security@kernel.org" , Jan Beulich , Peter Zijlstra , Andrew Cooper , X86 ML , LKML , Steven Rostedt , Andy Lutomirski , Borislav Petkov , Andy Lutomirski , Sasha Levin , Boris Ostrovsky , xen-devel List-Id: xen-devel@lists.xenproject.org On Fri, Jul 24, 2015 at 09:24:51AM +0200, Willy Tarreau wrote: > On Thu, Jul 23, 2015 at 05:09:21PM -0700, Kees Cook wrote: > > > All this to say that probably only a handful of tricky syscalls would > > > need an on/off switch but clearly not all of them at all, so I'd rather > > > add a few entries just for the relevant ones, mainly to fix compatibility > > > issues and nothing more. Eg: what's the point of disabling exit(), wait(), > > > kill(), fork() or getpid()... It would only increase the difficulty to > > > sort out bug reports. > > > > > > Just my opinion, > > > > Well, I would really like to have something like this around so that I > > can trivially globally disable syscalls when they have security risks. > > I understand, but while maybe it could make sense to have the option on > any linux-specific syscall, having it on the standard, portable ones > will be useless as disabling them will break most applications. > > > My hack[1] to disable kexec_load, for example, was terrible while I > > waited for a kernel that supported the disable_kexec_load sysctl. > > This typically is one linux-specific syscall which no regular application > would rely on and which can come with side effects. I think there are not > *that* many, none of them is performance-critical, and they'd rather be > dealt with one at a time. Looking at syscall_64.tbl, I'm seeing that the first ~133 syscalls have no reason for being disabled if we don't want to break portable applications, with the exception of ptrace I guess. Past this, things like uselib, personality, sysfs, prctl etc... could be disabled. There are still some exceptions in this area but I don't see them as critical if someone would accidently disable them (eg: getpriority, mlock, ...). Others like chroot, setrlimit, adjtimex, settimeofday, mount, umount, time need to be kept. And a few ones like sync or sethostname would be nice to have optional in order to lock down a system at boot. Many of the other ones are ns-specific versions of the first ones (*at) and would rather not being made optional either. I think maybe we can find between 10 and 30 that would make sense to optionally disable. Willy