From: Willy Tarreau <w@1wt.eu>
To: Andy Lutomirski <luto@amacapital.net>
Cc: "security@kernel.org" <security@kernel.org>,
Jan Beulich <jbeulich@suse.com>,
Peter Zijlstra <peterz@infradead.org>,
Andrew Cooper <andrew.cooper3@citrix.com>,
X86 ML <x86@kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
Steven Rostedt <rostedt@goodmis.org>,
xen-devel <xen-devel@lists.xen.org>,
Borislav Petkov <bp@alien8.de>, Andy Lutomirski <luto@kernel.org>,
Sasha Levin <sasha.levin@oracle.com>,
Boris Ostrovsky <boris.ostrovsky@oracle.com>,
Kees Cook <keescook@chromium.org>
Subject: [PATCH 4/3] x86/ldt: allow to disable modify_ldt at runtime
Date: Sat, 25 Jul 2015 15:03:40 +0200 [thread overview]
Message-ID: <20150725130340.GA17257__13223.0738331147$1437829604$gmane$org@1wt.eu> (raw)
In-Reply-To: <20150725075052.GA3918@1wt.eu>
[-- Attachment #1: Type: text/plain, Size: 1249 bytes --]
On Sat, Jul 25, 2015 at 09:50:52AM +0200, Willy Tarreau wrote:
> On Fri, Jul 24, 2015 at 11:44:52PM -0700, Andy Lutomirski wrote:
> > I'm all for it, but I think it should be hard-disablable in config,
> > too, for the -tiny people.
>
> I totally agree.
>
> > If we add a runtime disable, let's do a
> > separate patch, and you and Kees can fight over how general it should
> > be.
>
> Initially I was thinking about changing it for a 3-state option but
> that would prevent X86_16BIT from being hard-disablable, so I'll do
> something completely separate.
So here comes the proposed patch. It adds a default setting for the
sysctl when the option is not hard-disabled (eg: distros not wanting
to take risks with legacy apps). It suggests to leave the option off.
In case a syscall is blocked, a printk_ratelimited() is called with
relevant info (program name, pid, uid) so that the admin can decide
whether it's a legitimate call or not. Eg:
Denied a call to modify_ldt() from a.out[1736] (uid: 100). Adjust sysctl if this was not an exploit attempt.
I personally think it completes well your series, hence the 4/3 numbering.
Feel free to adopt it if you cycle another round and if you're OK with it
of course.
CCing Kees as well.
Willy
[-- Attachment #2: 0001-x86-ldt-allow-to-disable-modify_ldt-at-runtime.patch --]
[-- Type: text/plain, Size: 5342 bytes --]
>From 93cadf50b56a1f2f1e43137503edc1242f8476a7 Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Sat, 25 Jul 2015 12:18:33 +0200
Subject: x86/ldt: allow to disable modify_ldt at runtime
For distros who prefer not to take the risk of completely disabling the
modify_ldt syscall using CONFIG_MODIFY_LDT_SYSCALL, this patch adds a
sysctl to enable or/disable it at runtime, and proposes to disable it
by default. This can be a safe alternative. A message is logged if an
attempt was stopped so that it's easy to spot if/when it is needed.
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
Documentation/sysctl/kernel.txt | 15 +++++++++++++++
arch/x86/Kconfig | 17 +++++++++++++++++
arch/x86/kernel/ldt.c | 15 +++++++++++++++
kernel/sysctl.c | 12 ++++++++++++
4 files changed, 59 insertions(+)
diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
index 6fccb69..60c7c7a 100644
--- a/Documentation/sysctl/kernel.txt
+++ b/Documentation/sysctl/kernel.txt
@@ -41,6 +41,7 @@ show up in /proc/sys/kernel:
- kptr_restrict
- kstack_depth_to_print [ X86 only ]
- l2cr [ PPC only ]
+- modify_ldt [ X86 only ]
- modprobe ==> Documentation/debugging-modules.txt
- modules_disabled
- msg_next_id [ sysv ipc ]
@@ -391,6 +392,20 @@ This flag controls the L2 cache of G3 processor boards. If
==============================================================
+modify_ldt: (X86 only)
+
+Enables (1) or disables (0) the modify_ldt syscall. Modifying the LDT
+(Local Descriptor Table) may be needed to run a 16-bit or segmented code
+such as Dosemu or Wine. This is done via a system call which is not needed
+to run portable applications, and which can sometimes be abused to exploit
+some weaknesses of the architecture, opening new vulnerabilities.
+
+This sysctl allows one to increase the system's security by disabling the
+system call, or to restore compatibility with specific applications when it
+was already disabled.
+
+==============================================================
+
modules_disabled:
A toggle value indicating if modules are allowed to be loaded
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index ede52be..37f83d6 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -2069,6 +2069,23 @@ config MODIFY_LDT_SYSCALL
surface. Disabling it removes the modify_ldt(2) system call.
Saying 'N' here may make sense for embedded or server kernels.
+ If really unsure, say 'Y', you'll be able to disable it at runtime.
+
+config DEFAULT_MODIFY_LDT_SYSCALL
+ bool "Allow userspace to modify the LDT by default"
+ depends on MODIFY_LDT_SYSCALL
+ default y
+ ---help---
+ Modifying the LDT (Local Descriptor Table) may be needed to run a
+ 16-bit or segmented code such as Dosemu or Wine. This is done via
+ a system call which is not needed to run portable applications,
+ and which can sometimes be abused to exploit some weaknesses of
+ the architecture, opening new vulnerabilities.
+
+ For this reason this option allows one to enable or disable the
+ feature at runtime. It is recommended to say 'N' here to leave
+ the system protected, and to enable it at runtime only if needed
+ by setting the sys.kernel.modify_ldt sysctl.
source "kernel/livepatch/Kconfig"
diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
index 2bcc052..cb64b85 100644
--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -11,6 +11,7 @@
#include <linux/sched.h>
#include <linux/string.h>
#include <linux/mm.h>
+#include <linux/ratelimit.h>
#include <linux/smp.h>
#include <linux/slab.h>
#include <linux/vmalloc.h>
@@ -21,6 +22,11 @@
#include <asm/mmu_context.h>
#include <asm/syscalls.h>
+#ifdef CONFIG_MODIFY_LDT_SYSCALL
+int sysctl_modify_ldt __read_mostly =
+ IS_ENABLED(CONFIG_DEFAULT_MODIFY_LDT_SYSCALL);
+#endif
+
/* context.lock is held for us, so we don't need any locking. */
static void flush_ldt(void *current_mm)
{
@@ -276,6 +282,15 @@ asmlinkage int sys_modify_ldt(int func, void __user *ptr,
{
int ret = -ENOSYS;
+ if (!sysctl_modify_ldt) {
+ printk_ratelimited(KERN_INFO
+ "Denied a call to modify_ldt() from %s[%d] (uid: %d)."
+ " Adjust sysctl if this was not an exploit attempt.\n",
+ current->comm, task_pid_nr(current),
+ from_kuid_munged(current_user_ns(), current_uid()));
+ return ret;
+ }
+
switch (func) {
case 0:
ret = read_ldt(ptr, bytecount);
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 19b62b5..3dcf8e4 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -111,6 +111,9 @@ extern int sysctl_nr_open_min, sysctl_nr_open_max;
#ifndef CONFIG_MMU
extern int sysctl_nr_trim_pages;
#endif
+#ifdef CONFIG_MODIFY_LDT_SYSCALL
+extern int sysctl_modify_ldt;
+#endif
/* Constants used for minimum and maximum */
#ifdef CONFIG_LOCKUP_DETECTOR
@@ -960,6 +963,15 @@ static struct ctl_table kern_table[] = {
.mode = 0644,
.proc_handler = proc_dointvec,
},
+#ifdef CONFIG_MODIFY_LDT_SYSCALL
+ {
+ .procname = "modify_ldt",
+ .data = &sysctl_modify_ldt,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec,
+ },
+#endif
#endif
#if defined(CONFIG_MMU)
{
--
1.7.12.1
[-- Attachment #3: Type: text/plain, Size: 126 bytes --]
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
next prev parent reply other threads:[~2015-07-25 13:03 UTC|newest]
Thread overview: 63+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <cover.1437802102.git.luto@kernel.org>
2015-07-25 5:36 ` [PATCH v4 1/3] x86/ldt: Make modify_ldt synchronous Andy Lutomirski
2015-07-25 5:36 ` [PATCH v4 2/3] x86/ldt: Make modify_ldt optional Andy Lutomirski
2015-07-25 5:36 ` [PATCH v4 3/3] selftests/x86, x86/ldt: Add a selftest for modify_ldt Andy Lutomirski
2015-07-25 6:27 ` [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option Willy Tarreau
[not found] ` <12ddcec938d76238975dff9de7d66cfc6e574aa7.1437802102.git.luto@kernel.org>
2015-07-25 9:03 ` [PATCH v4 1/3] x86/ldt: Make modify_ldt synchronous Borislav Petkov
[not found] ` <7286d77aa81abc38dc40362e2439861427064f6f.1437802102.git.luto@kernel.org>
2015-07-25 6:23 ` [PATCH v4 2/3] x86/ldt: Make modify_ldt optional Willy Tarreau
[not found] ` <20150725062343.GA3902@1wt.eu>
2015-07-25 6:44 ` Andy Lutomirski
[not found] ` <CALCETrX0ExTFXVdNthwBRheg4vsffPThVuyn7uAcj_TGwpXgiA@mail.gmail.com>
2015-07-25 7:50 ` Willy Tarreau
[not found] ` <20150725075052.GA3918@1wt.eu>
2015-07-25 13:03 ` Willy Tarreau [this message]
[not found] ` <20150725130340.GA17257@1wt.eu>
2015-07-25 16:08 ` [PATCH 4/3] x86/ldt: allow to disable modify_ldt at runtime Andy Lutomirski
[not found] ` <CALCETrV+OB0qxtw5CHaZc5RftuCUax04RxTyi_bt4ZKDJ2GB0g@mail.gmail.com>
2015-07-25 16:33 ` Willy Tarreau
[not found] ` <20150725163356.GD17659@1wt.eu>
2015-07-25 17:42 ` Andy Lutomirski
[not found] ` <CALCETrXeWdugPpAkKhUD=f7ftuYSM5fxaPxnF2=PwygupP2_4w@mail.gmail.com>
2015-07-25 18:45 ` Willy Tarreau
2015-07-27 19:04 ` Kees Cook
[not found] ` <CAGXu5jJDfnkRG2F=L37CnrgnCN4Yxh0p9QWbYFqQ_Jw5qk3HsQ@mail.gmail.com>
2015-07-27 21:37 ` Willy Tarreau
2015-07-25 9:15 ` [PATCH v4 2/3] x86/ldt: Make modify_ldt optional Borislav Petkov
[not found] ` <20150725091531.GE3427@nazgul.tnic>
2015-07-25 16:03 ` Andy Lutomirski
[not found] ` <CALCETrV_oeS_kA3oNirWTwc00ze2v=QLmx6tZKU7sxt_+gMcAg@mail.gmail.com>
2015-07-25 16:35 ` Willy Tarreau
2015-07-27 15:36 ` [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option Boris Ostrovsky
[not found] ` <55B64FEA.70204@oracle.com>
2015-07-27 15:53 ` Andy Lutomirski
[not found] ` <CALCETrUEYTCwYzA0bvG=EJOi+pdXX=FZXoaQc4tYGkJATM7x3g@mail.gmail.com>
2015-07-27 16:18 ` Boris Ostrovsky
[not found] ` <55B659EC.5030009@oracle.com>
2015-07-28 2:20 ` Andy Lutomirski
[not found] ` <CALCETrV7zVbt0ZV4KYcSTUHjAOxzGmu3SXWoT7iECB=zWSN7Ew@mail.gmail.com>
2015-07-28 3:16 ` Andy Lutomirski
[not found] ` <CALCETrV275oYQY80yg6TJ-h9n2Db-uF-po90bF+JmKjnV5ZqYw@mail.gmail.com>
2015-07-28 3:23 ` Andy Lutomirski
2015-07-28 3:43 ` Boris Ostrovsky
2015-07-28 10:29 ` Andrew Cooper
[not found] ` <55B75993.90909@citrix.com>
2015-07-28 14:05 ` Boris Ostrovsky
[not found] ` <55B78C35.1050702@oracle.com>
2015-07-28 14:35 ` Andrew Cooper
[not found] ` <55B79314.8060009@citrix.com>
2015-07-28 14:50 ` Boris Ostrovsky
[not found] ` <55B796BF.1080005@oracle.com>
2015-07-28 15:15 ` Konrad Rzeszutek Wilk
2015-07-28 15:23 ` Andrew Cooper
[not found] ` <20150728151527.GI26623@x230.dumpdata.com>
2015-07-28 15:39 ` Boris Ostrovsky
[not found] ` <55B79E75.4010000@citrix.com>
2015-07-28 15:59 ` Boris Ostrovsky
2015-07-28 15:43 ` Andy Lutomirski
[not found] ` <CALCETrXt2OP=+JAj7gzUOJT+5=00Qg3Te11twSeK8F_9zn_nwg@mail.gmail.com>
2015-07-28 16:30 ` Andrew Cooper
[not found] ` <55B7AE39.7000101@citrix.com>
2015-07-28 17:07 ` Andy Lutomirski
[not found] ` <CALCETrVd56uwkZw0YtaSHKHp5dh7NugQouigibJkr=e3Q_mYyA@mail.gmail.com>
2015-07-28 17:10 ` Boris Ostrovsky
[not found] ` <55B7B791.2050208@oracle.com>
2015-07-29 0:21 ` Andy Lutomirski
[not found] ` <CALCETrXH5_PMqfH1en_5c+5gUpq8SjCnQ3Xaz-K6ej6FgBgLDQ@mail.gmail.com>
2015-07-29 0:47 ` Andrew Cooper
[not found] ` <55B822B8.3090608@citrix.com>
2015-07-29 3:01 ` Boris Ostrovsky
[not found] ` <55B841FF.2000102@oracle.com>
2015-07-29 4:26 ` Andy Lutomirski
2015-07-29 5:28 ` Andy Lutomirski
[not found] ` <CALCETrWkMRb+Y3FsJ7+kNYmPxtupM3ZPOeOPwagXytgBqM6tJQ@mail.gmail.com>
2015-07-29 14:21 ` Andrew Cooper
[not found] ` <55B8E16C.2050406@citrix.com>
2015-07-29 14:43 ` Boris Ostrovsky
[not found] ` <55B8E68B.2030305@oracle.com>
2015-07-29 19:03 ` Andrew Cooper
[not found] ` <55B9236B.9090507@citrix.com>
2015-07-29 21:23 ` Boris Ostrovsky
[not found] ` <55B94451.8040600@oracle.com>
2015-07-29 21:26 ` Andy Lutomirski
[not found] ` <CALCETrWA=hAyqqp=yzZ2r_S=9U9hLkd6dZEuNefew8hyLVA_eQ@mail.gmail.com>
2015-07-29 21:33 ` Boris Ostrovsky
2015-07-29 21:37 ` Andrew Cooper
[not found] ` <55B947AF.7020404@citrix.com>
2015-07-29 22:05 ` Andy Lutomirski
[not found] ` <CALCETrXp_DV-_Uvekwv7xLHO-5P8Oxkgn6OeXG-6tVOD4RkKMw@mail.gmail.com>
2015-07-29 22:11 ` Andrew Cooper
[not found] ` <55B94F9D.3000405@citrix.com>
2015-07-29 22:40 ` Boris Ostrovsky
2015-07-29 22:46 ` David Vrabel
2015-07-29 22:49 ` Boris Ostrovsky
[not found] ` <55B95863.2000102@oracle.com>
2015-07-29 22:55 ` David Vrabel
2015-07-29 23:02 ` Andrew Cooper
[not found] ` <55B95B70.8010902@citrix.com>
2015-07-29 23:13 ` Andy Lutomirski
[not found] ` <CALCETrWy93qobHmMWzTfqFN+0Y7DGyM7viwpPMGOeSiXEP0Z6w@mail.gmail.com>
2015-07-30 0:29 ` Andrew Cooper
[not found] ` <55B96FE0.6010600@citrix.com>
2015-07-30 18:30 ` Andy Lutomirski
[not found] ` <CALCETrUi2GBdGP2OX+3PwSf0UYjKuf2+DugENe3Y6mUoy-Rfkw@mail.gmail.com>
2015-07-30 18:54 ` Andrew Cooper
[not found] ` <55BA72E1.4050809@citrix.com>
2015-07-30 20:01 ` Boris Ostrovsky
[not found] ` <55BA828E.8070304@oracle.com>
2015-07-30 20:05 ` Andy Lutomirski
[not found] ` <CALCETrUsFn23tKf418VSbGCgXoXXRq8dk41ZfM3F55=_xWPQhw@mail.gmail.com>
2015-07-30 20:18 ` Boris Ostrovsky
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='20150725130340.GA17257__13223.0738331147$1437829604$gmane$org@1wt.eu' \
--to=w@1wt.eu \
--cc=andrew.cooper3@citrix.com \
--cc=boris.ostrovsky@oracle.com \
--cc=bp@alien8.de \
--cc=jbeulich@suse.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=luto@kernel.org \
--cc=peterz@infradead.org \
--cc=rostedt@goodmis.org \
--cc=sasha.levin@oracle.com \
--cc=security@kernel.org \
--cc=x86@kernel.org \
--cc=xen-devel@lists.xen.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).