From: Florian Weimer <fweimer@redhat.com>
To: Andy Lutomirski <luto@kernel.org>
Cc: Yu-cheng Yu <yu-cheng.yu@intel.com>, X86 ML <x86@kernel.org>,
"H. Peter Anvin" <hpa@zytor.com>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>,
LKML <linux-kernel@vger.kernel.org>,
"open list\:DOCUMENTATION" <linux-doc@vger.kernel.org>,
Linux-MM <linux-mm@kvack.org>,
linux-arch <linux-arch@vger.kernel.org>,
Linux API <linux-api@vger.kernel.org>,
Arnd Bergmann <arnd@arndb.de>,
Balbir Singh <bsingharora@gmail.com>,
Borislav Petkov <bp@alien8.de>,
Cyrill Gorcunov <gorcunov@gmail.com>,
Dave Hansen <dave.hansen@linux.intel.com>,
Eugene Syromiatnikov <esyr@redhat.com>,
"H.J. Lu" <hjl.tools@gmail.com>, Jann Horn <jannh@google.com>,
Jonathan Corbet <corbet@lwn.net>,
Kees Cook <keescook@chromium.org>,
Mike Kravetz <mike.kravetz@oracle.com>,
Nadav Amit <nadav.amit@gmail.com>,
Oleg Nesterov <oleg@redhat.com>, Pavel Machek <pavel@ucw.cz>,
Peter Zijlstra <peterz@infradead.org>,
Randy Dunlap <rdunlap@infradead.org>,
"Ravi V. Shankar" <ravi.v.shankar@intel.com>,
Vedvyas Shanbhogue <vedvyas.shanbhogue@intel.com>,
Dave Martin <Dave.Martin@arm.com>,
Weijiang Yang <weijiang.yang@intel.com>
Subject: Re: [PATCH v11 9/9] x86: Disallow vsyscall emulation when CET is enabled
Date: Tue, 25 Aug 2020 11:14:37 +0200 [thread overview]
Message-ID: <87pn7f9jeq.fsf@oldenburg2.str.redhat.com> (raw)
In-Reply-To: <CALCETrVXwUDu2m-XEd-_J03L=sricM4cMxQYVkdGRWZDjmMB2g@mail.gmail.com> (Andy Lutomirski's message of "Mon, 24 Aug 2020 17:32:35 -0700")
* Andy Lutomirski:
> On Mon, Aug 24, 2020 at 5:30 PM Yu-cheng Yu <yu-cheng.yu@intel.com> wrote:
>>
>> From: "H.J. Lu" <hjl.tools@gmail.com>
>>
>> Emulation of the legacy vsyscall page is required by some programs built
>> before 2013. Newer programs after 2013 don't use it. Disallow vsyscall
>> emulation when Control-flow Enforcement (CET) is enabled to enhance
>> security.
>
> NAK.
>
> By all means disable execute emulation if CET-IBT is enabled at the
> time emulation is attempted, and maybe even disable the vsyscall page
> entirely if you can magically tell that CET-IBT will be enabled when a
> process starts, but you don't get to just disable it outright on a
> CET-enabled kernel.
Yeah, we definitely would have to revert/avoid this downstream. People
definitely want to run glibc-2.12-era workloads on current kernels.
Thanks for catching it.
Florian
next prev parent reply other threads:[~2020-08-25 9:15 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-25 0:26 [PATCH v11 0/9] Control-flow Enforcement: Indirect Branch Tracking, PTRACE Yu-cheng Yu
2020-08-25 0:26 ` [PATCH v11 1/9] x86/cet/ibt: Add Kconfig option for user-mode Indirect Branch Tracking Yu-cheng Yu
2020-08-25 0:26 ` [PATCH v11 2/9] x86/cet/ibt: User-mode Indirect Branch Tracking support Yu-cheng Yu
2020-08-25 0:26 ` [PATCH v11 3/9] x86/cet/ibt: Handle signals for Indirect Branch Tracking Yu-cheng Yu
2020-08-25 0:26 ` [PATCH v11 4/9] x86/cet/ibt: ELF header parsing " Yu-cheng Yu
2020-08-25 0:26 ` [PATCH v11 5/9] x86/cet/ibt: Update arch_prctl functions " Yu-cheng Yu
2020-08-25 0:26 ` [PATCH v11 6/9] x86/cet: Add PTRACE interface for CET Yu-cheng Yu
2020-09-02 20:03 ` Jann Horn
2020-09-02 22:13 ` Yu, Yu-cheng
2020-09-02 23:50 ` Andy Lutomirski
2020-09-03 2:53 ` Yu, Yu-cheng
2020-09-03 4:35 ` Andy Lutomirski
2020-09-03 14:26 ` Dave Hansen
2020-09-03 14:54 ` Andy Lutomirski
2020-09-03 16:09 ` Yu, Yu-cheng
2020-09-03 16:11 ` Dave Hansen
2020-09-03 16:15 ` Andy Lutomirski
2020-09-03 16:25 ` Dave Hansen
2020-09-03 16:32 ` Andy Lutomirski
2020-09-03 16:42 ` Dave Hansen
2020-09-03 17:59 ` Yu, Yu-cheng
2020-09-03 16:21 ` Yu, Yu-cheng
2020-09-03 16:25 ` Andy Lutomirski
2020-09-03 0:33 ` Jann Horn
2020-09-03 2:53 ` Yu, Yu-cheng
2020-08-25 0:26 ` [PATCH v11 7/9] x86/vdso/32: Add ENDBR32 to __kernel_vsyscall entry point Yu-cheng Yu
2020-08-25 0:26 ` [PATCH v11 8/9] x86/vdso: Insert endbr32/endbr64 to vDSO Yu-cheng Yu
2020-08-25 0:33 ` Andy Lutomirski
2020-08-25 16:13 ` Yu, Yu-cheng
2020-08-25 0:26 ` [PATCH v11 9/9] x86: Disallow vsyscall emulation when CET is enabled Yu-cheng Yu
2020-08-25 0:32 ` Andy Lutomirski
2020-08-25 9:14 ` Florian Weimer [this message]
2020-08-25 15:08 ` Yu, Yu-cheng
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87pn7f9jeq.fsf@oldenburg2.str.redhat.com \
--to=fweimer@redhat.com \
--cc=Dave.Martin@arm.com \
--cc=arnd@arndb.de \
--cc=bp@alien8.de \
--cc=bsingharora@gmail.com \
--cc=corbet@lwn.net \
--cc=dave.hansen@linux.intel.com \
--cc=esyr@redhat.com \
--cc=gorcunov@gmail.com \
--cc=hjl.tools@gmail.com \
--cc=hpa@zytor.com \
--cc=jannh@google.com \
--cc=keescook@chromium.org \
--cc=linux-api@vger.kernel.org \
--cc=linux-arch@vger.kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=luto@kernel.org \
--cc=mike.kravetz@oracle.com \
--cc=mingo@redhat.com \
--cc=nadav.amit@gmail.com \
--cc=oleg@redhat.com \
--cc=pavel@ucw.cz \
--cc=peterz@infradead.org \
--cc=ravi.v.shankar@intel.com \
--cc=rdunlap@infradead.org \
--cc=tglx@linutronix.de \
--cc=vedvyas.shanbhogue@intel.com \
--cc=weijiang.yang@intel.com \
--cc=x86@kernel.org \
--cc=yu-cheng.yu@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.