From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.3 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, NICE_REPLY_A,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6803CC433E7 for ; Tue, 14 Jul 2020 18:41:01 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4671E225AA for ; Tue, 14 Jul 2020 18:41:01 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b="W1Yl3XUG" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729124AbgGNSk5 (ORCPT ); Tue, 14 Jul 2020 14:40:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37484 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726817AbgGNSk4 (ORCPT ); Tue, 14 Jul 2020 14:40:56 -0400 Received: from merlin.infradead.org (merlin.infradead.org [IPv6:2001:8b0:10b:1231::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5AA6BC061755; Tue, 14 Jul 2020 11:40:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=merlin.20170209; h=Content-Transfer-Encoding:Content-Type: In-Reply-To:MIME-Version:Date:Message-ID:From:References:Cc:To:Subject:Sender :Reply-To:Content-ID:Content-Description; bh=SimmloHZQtBhOnb9Pbgsw72I1O5VIdL523t/ncOnsgk=; b=W1Yl3XUG9MzYNah9l9+4fRf5F9 h49otnq+/660uWOaP2mI+uT0FEtijYl0Z857koqs/q/DNBdtGnEnRubTJQU9UgUwlXeirrE5ICls4 DWrWjQzBhwo4RR3cM1LZCT32KQQ+TSv84fz0enXVKcFX7mD/5DI07ID3Gi1BeY4O8NSMW5T9hgsUh KWey6VEaUzKEgOu0f6LrbD4+qQ/Mw0Wgyca6+KZCj9zJxv+Cy/YyUK8bfcv4QUcN1NScLN0PUpkBq t94ot1QTNg7Vknoh/C0CW2OlronpItPtycZ0sCKu8ruViFpHqOiyjMlOgsT2spFr1GtAw56/Llwu/ tS4ScVZQ==; Received: from [2601:1c0:6280:3f0::19c2] by merlin.infradead.org with esmtpsa (Exim 4.92.3 #3 (Red Hat Linux)) id 1jvPrD-00061s-ES; Tue, 14 Jul 2020 18:40:47 +0000 Subject: Re: [PATCH v6 5/7] fs,doc: Enable to enforce noexec mounts or file exec through O_MAYEXEC To: =?UTF-8?Q?Micka=c3=abl_Sala=c3=bcn?= , linux-kernel@vger.kernel.org Cc: Aleksa Sarai , Alexei Starovoitov , Al Viro , Andrew Morton , Andy Lutomirski , Christian Brauner , Christian Heimes , Daniel Borkmann , Deven Bowers , Dmitry Vyukov , Eric Biggers , Eric Chiang , Florian Weimer , James Morris , Jan Kara , Jann Horn , Jonathan Corbet , Kees Cook , Lakshmi Ramasubramanian , Matthew Garrett , Matthew Wilcox , Michael Kerrisk , =?UTF-8?Q?Micka=c3=abl_Sala=c3=bcn?= , Mimi Zohar , =?UTF-8?Q?Philippe_Tr=c3=a9buchet?= , Scott Shell , Sean Christopherson , Shuah Khan , Steve Dower , Steve Grubb , Tetsuo Handa , Thibaut Sautereau , Vincent Strubel , kernel-hardening@lists.openwall.com, linux-api@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org References: <20200714181638.45751-1-mic@digikod.net> <20200714181638.45751-6-mic@digikod.net> From: Randy Dunlap Message-ID: <038639b1-92da-13c1-b3e5-8f13639a815e@infradead.org> Date: Tue, 14 Jul 2020 11:40:34 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.9.0 MIME-Version: 1.0 In-Reply-To: <20200714181638.45751-6-mic@digikod.net> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Sender: linux-api-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-api@vger.kernel.org Hi, On 7/14/20 11:16 AM, Mickaël Salaün wrote: > --- > Documentation/admin-guide/sysctl/fs.rst | 45 +++++++++++++++++++++++++ > fs/namei.c | 29 +++++++++++++--- > include/linux/fs.h | 1 + > kernel/sysctl.c | 12 +++++-- > 4 files changed, 80 insertions(+), 7 deletions(-) > > diff --git a/Documentation/admin-guide/sysctl/fs.rst b/Documentation/admin-guide/sysctl/fs.rst > index 2a45119e3331..02ec384b8bbf 100644 > --- a/Documentation/admin-guide/sysctl/fs.rst > +++ b/Documentation/admin-guide/sysctl/fs.rst Reviewed-by: Randy Dunlap with one tiny nit: > @@ -165,6 +166,50 @@ system needs to prune the inode list instead of allocating > +The ability to restrict code execution must be thought as a system-wide policy, > +which first starts by restricting mount points with the ``noexec`` option. > +This option is also automatically applied to special filesystems such as /proc > +. This prevents files on such mount points to be directly executed by the Can you move that period from the beginning of the line to the end of the previous line? > +kernel or mapped as executable memory (e.g. libraries). With script > +interpreters using the ``O_MAYEXEC`` flag, the executable permission can then > +be checked before reading commands from files. This makes it possible to > +enforce the ``noexec`` at the interpreter level, and thus propagates this > +security policy to scripts. To be fully effective, these interpreters also > +need to handle the other ways to execute code: command line parameters (e.g., > +option ``-e`` for Perl), module loading (e.g., option ``-m`` for Python), > +stdin, file sourcing, environment variables, configuration files, etc. > +According to the threat model, it may be acceptable to allow some script > +interpreters (e.g. Bash) to interpret commands from stdin, may it be a TTY or a > +pipe, because it may not be enough to (directly) perform syscalls. thanks. -- ~Randy