From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, MSGID_FROM_MTA_HEADER,SPF_HELO_NONE,SPF_PASS,UNPARSEABLE_RELAY,URIBL_BLOCKED, USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E6214C2D0A3 for ; Wed, 4 Nov 2020 08:58:06 +0000 (UTC) Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 5C59D216C4 for ; Wed, 4 Nov 2020 08:58:06 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="AarHsHJU"; dkim=fail reason="signature verification failed" (1024-bit key) header.d=armh.onmicrosoft.com header.i=@armh.onmicrosoft.com header.b="w6MgidbL"; dkim=fail reason="signature verification failed" (1024-bit key) header.d=armh.onmicrosoft.com header.i=@armh.onmicrosoft.com header.b="w6MgidbL" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 5C59D216C4 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=arm.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:MIME-Version:In-Reply-To:References:Message-ID: Subject:To:From:Date:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=5Z9RLvyUbb3cDyuTJGYfCSD57ZDZDzc8mqdIdMKZ6jQ=; b=AarHsHJUwAmxOkGMCUpPsLPcU Z+kkJv7SVywhYQXIMS08Oji28JeEDqHbxq943y6Z525CQHLqlBk5pDlJ+Khn9uomfdshnPSM/+p1g DVeAhVwgwXyCjsHPE6Gc7WpiUX90v0aulJqIUMDGvQo5yHchPHKopvJrJc0A1RMod4oeZUVQOMKcA 0EnBhQGyVmtXAHk8os4uM6uyw9nkSPBI0m0pi+VOvGZagRWlKIEDavYHKC/ySc8w5gsxUDjTKO/6M tyjn3UeZl6+80/sL274WHepaoZZ/ENJL6ovuTI3KcxtdKELyq3L8C76ZuE78abW0Trv3wYKws93Zr idnlGoXvg==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1kaEbc-0002k9-MY; Wed, 04 Nov 2020 08:57:24 +0000 Received: from mail-eopbgr80088.outbound.protection.outlook.com ([40.107.8.88] helo=EUR04-VI1-obe.outbound.protection.outlook.com) by merlin.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1kaEbY-0002jT-Oj for linux-arm-kernel@lists.infradead.org; Wed, 04 Nov 2020 08:57:22 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=sbg7ZlkQGrs9mWpDpDnhBnGQgwzsQZ68Hh/dPW1plb4=; b=w6MgidbLJ+bSeTglCo1E+12pzjSHsXwxAmvcgzFBGF/571oVdYB7yJ1C5RjXRhPqyeN9W+PKC0b26qklSoLUVb96eIml8ZARWujHJm9nYGXHYc/XGz8e3tV/Aj0D8GDw1Bxg9t9NF4Gl8re4/m6ZIihSm4kT6PODIWOZze/EN28= Received: from AM5PR0101CA0013.eurprd01.prod.exchangelabs.com (2603:10a6:206:16::26) by VI1PR08MB3517.eurprd08.prod.outlook.com (2603:10a6:803:79::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3499.32; Wed, 4 Nov 2020 08:57:17 +0000 Received: from AM5EUR03FT062.eop-EUR03.prod.protection.outlook.com (2603:10a6:206:16:cafe::5d) by AM5PR0101CA0013.outlook.office365.com (2603:10a6:206:16::26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3499.19 via Frontend Transport; Wed, 4 Nov 2020 08:57:17 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; lists.infradead.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;lists.infradead.org; dmarc=pass action=none header.from=arm.com; Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com; Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by AM5EUR03FT062.mail.protection.outlook.com (10.152.17.120) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3520.15 via Frontend Transport; Wed, 4 Nov 2020 08:57:17 +0000 Received: ("Tessian outbound c189680f801b:v64"); Wed, 04 Nov 2020 08:57:16 +0000 X-CheckRecipientChecked: true X-CR-MTA-CID: abf9ad6c60bd9186 X-CR-MTA-TID: 64aa7808 Received: from 686517b86fe5.2 by 64aa7808-outbound-1.mta.getcheckrecipient.com id 49233017-96AF-41A5-A13C-7E914095B800.1; Wed, 04 Nov 2020 08:57:10 +0000 Received: from EUR04-HE1-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id 686517b86fe5.2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Wed, 04 Nov 2020 08:57:10 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=fRzt1Ww7p9tvIHcuY2dmCrbkNjh5ySNjvJ2GO7W70VtWyFYqYltgfCIxvbbW9RVgnQoh08FjVYmX6gKA/ZTWdwL72jTH3nu1aJmoP46+YDAHNSUtVffxDb2Dj6dpmY6C/U18gijs/7rNWD7Jk8U94cgSt53hbQSVPTU2Q6mUEZ+DR8IZz4Sa7M/BZZNxqdH/ny4Mwfny+4MHtGoVI6lgvka5MSaxlsApCMmZY80BuxnTtoELVqOhebTrEJwblMuzjOWwZ5Hu8cD93U8YTN327YHdNdZgXtAUhEb7JOFT2lBGqUagdAkcIThB8fYbaj3fpsV4KYYSxKdWBSlBWt4asA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=sbg7ZlkQGrs9mWpDpDnhBnGQgwzsQZ68Hh/dPW1plb4=; b=FREze/9ehdrHDs7X2VGvVa9vJ+bUF5Bb5CNVav29UVyaaNdghYJxUvmaGMDYrAFsDgUFrggBM1hOF5UubVlTU7Ed55r4Yo2LX6GS0h9Bt3BYaHaCrDQS8GTuaeBOhqajyIEfWQQtVvBU0vgwd6RKruyo+FiNGYOthYr6LxhRPvvEgGk0bDcGkCZu5zsszam8nJ+b2gAWNmiIH2auUY+iJYg0TJ0ngKUXWOBi1do5JPQGzGL4ejwt647F4iT9o4us3OgOHMIDxJGKd5XR18nl42rjlrbQoU4Ays9dlroIPgQkJqqwP9X9sqrJ1iprLpepjl1E+vjOYCEO/BNpp7dfWg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=sbg7ZlkQGrs9mWpDpDnhBnGQgwzsQZ68Hh/dPW1plb4=; b=w6MgidbLJ+bSeTglCo1E+12pzjSHsXwxAmvcgzFBGF/571oVdYB7yJ1C5RjXRhPqyeN9W+PKC0b26qklSoLUVb96eIml8ZARWujHJm9nYGXHYc/XGz8e3tV/Aj0D8GDw1Bxg9t9NF4Gl8re4/m6ZIihSm4kT6PODIWOZze/EN28= Authentication-Results-Original: arm.com; dkim=none (message not signed) header.d=none;arm.com; dmarc=none action=none header.from=arm.com; Received: from PR3PR08MB5564.eurprd08.prod.outlook.com (2603:10a6:102:87::18) by PR3PR08MB5564.eurprd08.prod.outlook.com (2603:10a6:102:87::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3499.19; Wed, 4 Nov 2020 08:57:07 +0000 Received: from PR3PR08MB5564.eurprd08.prod.outlook.com ([fe80::2904:edcf:b299:f792]) by PR3PR08MB5564.eurprd08.prod.outlook.com ([fe80::2904:edcf:b299:f792%3]) with mapi id 15.20.3499.032; Wed, 4 Nov 2020 08:57:07 +0000 Date: Wed, 4 Nov 2020 08:57:05 +0000 From: Szabolcs Nagy To: Jeremy Linton Subject: Re: [PATCH 0/4] aarch64: avoid mprotect(PROT_BTI|PROT_EXEC) [BZ #26831] Message-ID: <20201104085704.GB24704@arm.com> References: <20201103173438.GD5545@sirena.org.uk> <8c99cc8e-41af-d066-b786-53ac13c2af8a@arm.com> Content-Disposition: inline In-Reply-To: <8c99cc8e-41af-d066-b786-53ac13c2af8a@arm.com> User-Agent: Mutt/1.9.4 (2018-02-28) X-Originating-IP: [217.140.106.54] X-ClientProxiedBy: LO2P265CA0248.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:8a::20) To PR3PR08MB5564.eurprd08.prod.outlook.com (2603:10a6:102:87::18) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from arm.com (217.140.106.54) by LO2P265CA0248.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:8a::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3499.18 via Frontend Transport; Wed, 4 Nov 2020 08:57:07 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: 73361d83-3289-4735-53c0-08d8809fa185 X-MS-TrafficTypeDiagnostic: PR3PR08MB5564:|VI1PR08MB3517: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true NoDisclaimer: true X-MS-Oob-TLC-OOBClassifiers: OLM:8882;OLM:8882; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Untrusted: BCL:0; X-Microsoft-Antispam-Message-Info-Original: lJkiyGppbMyn6xQP8zi6Yi6ibBpMVjELjR432SfnFytFUSXEvhxRRX4GMsgmDZZNCb+ZeQx+KwWSiMNu7NS2fb7WNdi9Gt2pqTEl1tnsHqMM98gR0n8rUoBOc8sRD/arBhrw+Q871raUpr6bfGnE5Ba416H/4RM/JjoEthXX7GsB8HndGTf6bow+f6rLWP9hgNpp5RmRxmx3tZ3XSX+891uyxAQjdXA5GHzR7veok0ztRFdHLKx8fRGAXFWs9gy5EQqE0Cov9Ajr5nlRVG1006aCgANzq1nxikXm0wmoZXvMsHktqjMj+dOv7beoTiEHXv5ANT4+DrA4618jrEZSfZGZAaInhf5FomK81Ue+enKB2H/qBUDTorCQBe/XX1cO X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:PR3PR08MB5564.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(376002)(136003)(39860400002)(396003)(346002)(366004)(86362001)(186003)(66476007)(66556008)(44832011)(66946007)(5660300002)(4326008)(7696005)(55016002)(16526019)(8676002)(52116002)(83380400001)(36756003)(2906002)(8886007)(1076003)(2616005)(6636002)(6862004)(33656002)(54906003)(7416002)(37006003)(316002)(53546011)(8936002)(956004)(26005)(478600001)(83133001); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData: D46UPxVWWHNfMsRySJMroSbD6x51AOjRT5W2DJTfz0NsOGoBptx4oD5vF9MvkiajZOMI0DNwMnBnpeh+4IyIJDKg3BEk2y6CfIUJwe693NCf9reWxbinx0hnCfzvqK4e+wipchXjbzo1+Zsj8390YvnQ/UiGEMbl15YakcA8aqJuOROvHHbMU5/r46gbAdLmB/oiVNIuQIjkwzVJB/UEMC5ijtytH1giekCkPhbTKHebS6DjDzVGvH9C1RPmt5JM0aDBYpTxyRXlDPsscAnT7wBjYtBf8AndLB2U61pABswfI0109Bt0TAurpBHO2cdjf+jjc6CWOBnH8AUAV10OfwtlkFqEXU5roWcHBLHq0zowPEDqm8Nj7J6KeS7Kv8MDre9w+ssU6u9lbAddXFqTmi+L1g9boIZC0H9g2hIzs8E+AzPpYznGFYjyvR6mkfnbVmFhiS6x4+hWDOTIQJgw2bbM14nchakpu/X/THAkQ8yVKQ5+IsXvOzc/IlpMzVMBUgqzq/jE7aC3hoDb5QH+6uzA7nlJB0OWNUSxr4KYMBodbJASLPYuPE29WFFDPgij6/X9fUwpjE9RdbygkmBqd5roXzOeRumdKCz+B15Xz3pzMx6sMia7mqr4gE8YyOB7zr87DfSZ+NSCGl9bheIelw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: PR3PR08MB5564 Original-Authentication-Results: arm.com; dkim=none (message not signed) header.d=none;arm.com; dmarc=none action=none header.from=arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: AM5EUR03FT062.eop-EUR03.prod.protection.outlook.com X-MS-Office365-Filtering-Correlation-Id-Prvs: 062ded2c-a6d6-497b-3f52-08d8809f9bba X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: yakqn30EGMB6+rWBLDu2BbWE6fWCX+CVSbcE3iUgJ0NF3iwb4OhAZxu5NThKBohC2hiTIc4HGGyVN3WNHw41WbhPFJN/Tj/JCrGDI7Re9rKOj1+3TkjGjn1Zw8GfkxoQ8IaOp7JsFETlYrnP3etTf3CsNDS0NStk4GtmkuKiLUFmvAnD3OfSQ/eTdA9SW2xivEe3eIdS409Q/XBrfv1ahXkPtlPjbODUHf2Pk/78HtOjWm37dJAnOgnII8+4T8XTTEYHOj4+vPfcII5Ez8n0eXtLQ3K672Czg0nm7gpwAYKUV3bPtZKbnN8WDYSI17AUIX26ZUnWx5y10dfKQnoTOl7WQ/YiOkGvGBRpPM1eHmmxPzJIBxhInep6WU/AfEU2gHR4Gk3tS5nHlpXT5pmXCQhsKdNYfiLGQuVdVw66Glo= X-Forefront-Antispam-Report: CIP:63.35.35.123; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:64aa7808-outbound-1.mta.getcheckrecipient.com; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; CAT:NONE; SFS:(4636009)(376002)(396003)(39860400002)(136003)(346002)(46966005)(82310400003)(55016002)(1076003)(54906003)(82740400003)(33656002)(5660300002)(47076004)(37006003)(8936002)(316002)(107886003)(2906002)(81166007)(36906005)(356005)(26005)(6636002)(186003)(8886007)(16526019)(956004)(53546011)(478600001)(83380400001)(6862004)(8676002)(336012)(36756003)(44832011)(7696005)(4326008)(70206006)(70586007)(86362001)(2616005)(83133001); DIR:OUT; SFP:1101; X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Nov 2020 08:57:17.0380 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 73361d83-3289-4735-53c0-08d8809fa185 X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-AuthSource: AM5EUR03FT062.eop-EUR03.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR08MB3517 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20201104_035720_927578_01910748 X-CRM114-Status: GOOD ( 35.29 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Mark Rutland , Florian Weimer , libc-alpha@sourceware.org, Kees Cook , kernel-hardening@lists.openwall.com, Salvatore Mesoraca , Catalin Marinas , linux-kernel@vger.kernel.org, Mark Brown , Lennart Poettering , linux-hardening@vger.kernel.org, Topi Miettinen , Will Deacon , linux-arm-kernel@lists.infradead.org Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The 11/03/2020 23:41, Jeremy Linton wrote: > On 11/3/20 11:34 AM, Mark Brown wrote: > > On Tue, Nov 03, 2020 at 10:25:37AM +0000, Szabolcs Nagy wrote: > > > > > Re-mmap executable segments instead of mprotecting them in > > > case mprotect is seccomp filtered. > > > > > For the kernel mapped main executable we don't have the fd > > > for re-mmap so linux needs to be updated to add BTI. (In the > > > presence of seccomp filters for mprotect(PROT_EXEC) the libc > > > cannot change BTI protection at runtime based on user space > > > policy so it is better if the kernel maps BTI compatible > > > binaries with PROT_BTI by default.) > > > > Given that there were still some ongoing discussions on a more robust > > kernel interface here and there seem to be a few concerns with this > > series should we perhaps just take a step back and disable this seccomp > > filter in systemd on arm64, at least for the time being? That seems > > safer than rolling out things that set ABI quickly, a big part of the > > So, that's a bigger hammer than I think is needed and punishes !BTI > machines. I'm going to suggest that if we need to carry a temp patch its > more like the glibc patch I mentioned in the Fedora defect. That patch > simply logs a message, on the mprotect failures rather than aborting. Its > fairly non-intrusive. > > That leaves seccomp functional, and BTI generally functional except when > seccomp is restricting it. I've also been asked that if a patch like that is > needed, its (temporary?) merged to the glibc trunk, rather than just being > carried by the distro's. note that changing mprotect into mmap in glibc works even if the kernel or systemd decides to do things differently: currently the only wart is that on the main exe we have to use mprotect and silently ignore the failures. (but e.g. some return to libc attacks are reliably prevented since libc.so guaranteed to have PROT_BTI this way.) the patchset is a bit more intrusive than i hoped for, so if we expect to get a new syscall then simply ignoring mprotect failures may be a better temporary solution. (and i still need to do benchmarks to see if the cost of re-mmap is not much more than the cost of mprotect.) changing the seccomp filter in systemd does not help if there are other seccomp filters elsewhere doing the same. i think we will have to avoid using mprotect(PROT_EXEC) or at least ignore the failure. > > reason we went with having the dynamic linker enable PROT_BTI in the > > first place was to give us more flexibility to handle any unforseen > > consequences of enabling BTI that we run into. We are going to have > > similar issues with other features like MTE so we need to make sure that > > whatever we're doing works with them too. > > > > Also updated to Will's current e-mail address - Will, do you have > > thoughts on what we should do here? > > _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel