From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andy Lutomirski Subject: Re: [PATCH v4 2/3] x86/ldt: Make modify_ldt optional Date: Sat, 25 Jul 2015 09:03:54 -0700 Message-ID: References: <7286d77aa81abc38dc40362e2439861427064f6f.1437802102.git.luto@kernel.org> <20150725091531.GE3427@nazgul.tnic> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20150725091531.GE3427@nazgul.tnic> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Borislav Petkov Cc: "security@kernel.org" , Jan Beulich , Peter Zijlstra , Andrew Cooper , X86 ML , "linux-kernel@vger.kernel.org" , Steven Rostedt , xen-devel , Andy Lutomirski , Sasha Levin , Boris Ostrovsky List-Id: xen-devel@lists.xenproject.org On Sat, Jul 25, 2015 at 2:15 AM, Borislav Petkov wrote: > On Fri, Jul 24, 2015 at 10:36:45PM -0700, Andy Lutomirski wrote: >> The modify_ldt syscall exposes a large attack surface and is >> unnecessary for modern userspace. Make it optional. >> >> Signed-off-by: Andy Lutomirski >> --- >> arch/x86/Kconfig | 17 +++++++++++++++++ >> arch/x86/include/asm/mmu.h | 2 ++ >> arch/x86/include/asm/mmu_context.h | 31 +++++++++++++++++++++++-------- >> arch/x86/kernel/Makefile | 3 ++- >> arch/x86/kernel/cpu/perf_event.c | 4 ++++ >> arch/x86/kernel/process_64.c | 2 ++ >> arch/x86/kernel/step.c | 2 ++ >> kernel/sys_ni.c | 1 + >> 8 files changed, 53 insertions(+), 9 deletions(-) >> >> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig >> index b3a1a5d77d92..ede52be845db 100644 >> --- a/arch/x86/Kconfig >> +++ b/arch/x86/Kconfig >> @@ -1015,6 +1015,7 @@ config VM86 >> config X86_16BIT >> bool "Enable support for 16-bit segments" if EXPERT >> default y >> + depends on MODIFY_LDT_SYSCALL >> ---help--- >> This option is required by programs like Wine to run 16-bit >> protected mode legacy code on x86 processors. Disabling >> @@ -2053,6 +2054,22 @@ config CMDLINE_OVERRIDE >> This is used to work around broken boot loaders. This should >> be set to 'N' under normal conditions. >> >> +config MODIFY_LDT_SYSCALL >> + bool "Enable the LDT (local descriptor table)" if EXPERT > > bool "Enable modify_ldt() for per-process Local Descriptor Table" > > is how I'd call it. Okay with me. > >> + default y > > Is that "default y" going to turn into a "default n" after a grace > period? Let's see how Willy's default-off sysctl plays out. In the long run, maybe we'll have it compiled in but runtime-disabled by default. There's a big community of users who *really* like using Wine :) --Andy