From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andrew Morton Subject: Re: [PATCH v2] execve: warn if process starts with executable stack Date: Tue, 10 Dec 2019 17:47:26 -0800 Message-ID: <20191210174726.101e434df59b6aec8a53cca1@linux-foundation.org> References: <20191208171918.GC19716@avx2> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20191208171918.GC19716@avx2> Sender: linux-kernel-owner@vger.kernel.org To: Alexey Dobriyan Cc: dan.carpenter@oracle.com, will@kernel.org, ebiederm@xmission.com, linux-arch@vger.kernel.org, security@kernel.org, linux-kernel@vger.kernel.org List-Id: linux-arch.vger.kernel.org On Sun, 8 Dec 2019 20:19:18 +0300 Alexey Dobriyan wrote: > There were few episodes of silent downgrade to an executable stack over > years: > > 1) linking innocent looking assembly file will silently add executable > stack if proper linker options is not given as well: > > $ cat f.S > .intel_syntax noprefix > .text > .globl f > f: > ret > > $ cat main.c > void f(void); > int main(void) > { > f(); > return 0; > } > > $ gcc main.c f.S > $ readelf -l ./a.out > GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000 > 0x0000000000000000 0x0000000000000000 RWE 0x10 > ^^^ > > 2) converting C99 nested function into a closure > https://nullprogram.com/blog/2019/11/15/ > > void intsort2(int *base, size_t nmemb, _Bool invert) > { > int cmp(const void *a, const void *b) > { > int r = *(int *)a - *(int *)b; > return invert ? -r : r; > } > qsort(base, nmemb, sizeof(*base), cmp); > } > > will silently require stack trampolines while non-closure version will not. > > Without doubt this behaviour is documented somewhere, add a warning so that > developers and users can at least notice. After so many years of x86_64 having > proper executable stack support it should not cause too many problems. hm, OK, let's give it a trial run. > --- a/fs/exec.c > +++ b/fs/exec.c > @@ -761,6 +761,11 @@ int setup_arg_pages(struct linux_binprm *bprm, > goto out_unlock; > BUG_ON(prev != vma); > > + if (unlikely(vm_flags & VM_EXEC)) { > + pr_warn_once("process '%pD4' started with executable stack\n", > + bprm->file); > + } > + > /* Move stack pages down in memory. */ > if (stack_shift) { > ret = shift_arg_pages(vma, stack_shift); What are poor users supposed to do if this message comes out? Hopefully google the message and end up at this thread. What do you want to tell them? From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.kernel.org ([198.145.29.99]:57846 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726532AbfLKBr1 (ORCPT ); Tue, 10 Dec 2019 20:47:27 -0500 Date: Tue, 10 Dec 2019 17:47:26 -0800 From: Andrew Morton Subject: Re: [PATCH v2] execve: warn if process starts with executable stack Message-ID: <20191210174726.101e434df59b6aec8a53cca1@linux-foundation.org> In-Reply-To: <20191208171918.GC19716@avx2> References: <20191208171918.GC19716@avx2> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-arch-owner@vger.kernel.org List-ID: To: Alexey Dobriyan Cc: dan.carpenter@oracle.com, will@kernel.org, ebiederm@xmission.com, linux-arch@vger.kernel.org, security@kernel.org, linux-kernel@vger.kernel.org Message-ID: <20191211014726.rt8hiqs_SLQcsbG0HpF0Cd3BbuK1tkaVP7Mzruk611w@z> On Sun, 8 Dec 2019 20:19:18 +0300 Alexey Dobriyan wrote: > There were few episodes of silent downgrade to an executable stack over > years: > > 1) linking innocent looking assembly file will silently add executable > stack if proper linker options is not given as well: > > $ cat f.S > .intel_syntax noprefix > .text > .globl f > f: > ret > > $ cat main.c > void f(void); > int main(void) > { > f(); > return 0; > } > > $ gcc main.c f.S > $ readelf -l ./a.out > GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000 > 0x0000000000000000 0x0000000000000000 RWE 0x10 > ^^^ > > 2) converting C99 nested function into a closure > https://nullprogram.com/blog/2019/11/15/ > > void intsort2(int *base, size_t nmemb, _Bool invert) > { > int cmp(const void *a, const void *b) > { > int r = *(int *)a - *(int *)b; > return invert ? -r : r; > } > qsort(base, nmemb, sizeof(*base), cmp); > } > > will silently require stack trampolines while non-closure version will not. > > Without doubt this behaviour is documented somewhere, add a warning so that > developers and users can at least notice. After so many years of x86_64 having > proper executable stack support it should not cause too many problems. hm, OK, let's give it a trial run. > --- a/fs/exec.c > +++ b/fs/exec.c > @@ -761,6 +761,11 @@ int setup_arg_pages(struct linux_binprm *bprm, > goto out_unlock; > BUG_ON(prev != vma); > > + if (unlikely(vm_flags & VM_EXEC)) { > + pr_warn_once("process '%pD4' started with executable stack\n", > + bprm->file); > + } > + > /* Move stack pages down in memory. */ > if (stack_shift) { > ret = shift_arg_pages(vma, stack_shift); What are poor users supposed to do if this message comes out? Hopefully google the message and end up at this thread. What do you want to tell them?