From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, MSGID_FROM_MTA_HEADER,SPF_HELO_NONE,SPF_PASS,UNPARSEABLE_RELAY,URIBL_BLOCKED, USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B64B4C00A89 for ; Thu, 5 Nov 2020 11:33:00 +0000 (UTC) Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id B9FA52078E for ; Thu, 5 Nov 2020 11:32:58 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="1Q3ZxJfk"; dkim=fail reason="signature verification failed" (1024-bit key) header.d=armh.onmicrosoft.com header.i=@armh.onmicrosoft.com header.b="62WlQt/g"; dkim=fail reason="signature verification failed" (1024-bit key) header.d=armh.onmicrosoft.com header.i=@armh.onmicrosoft.com header.b="62WlQt/g" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org B9FA52078E Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=arm.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:MIME-Version:In-Reply-To:References:Message-ID: Subject:To:From:Date:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=DSpFKC0qXtSuJ5EiiucRMKg5AP4eA+7FNyRbu+zuOwc=; b=1Q3ZxJfkbEugoAzPSFOZ7uepm Lq8kiu6qaXyM6DGC3Pw1oBSqfieAe3hiN0YI8KfxE0ION7UfT75SgKroa0ww6F40i46HwcZZ6sghH PEQWCKlhf6xGZB4tIzjrakra4I3euGKV455Ei85vMPL7QyhIGcsNTqdg7vhoyqitQvpXmo6070WC6 p2AJ8W2g8ZI8VKtioHmf2b88Oc846cArFp0IcsYcVrc/qQVCi8hAdSOlLAmJZxWL9xk/duk5RE8G0 QwszZNi+hp0ZP3/hDmi3HnvHG2R2RJ0XuOCO9IpEnGlpwYf0uNyDe0elB39opsPwCJ3+7Z7m7EEoJ RbgBSAKow==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1kadVK-0001Mn-Az; Thu, 05 Nov 2020 11:32:34 +0000 Received: from mail-db8eur05on2084.outbound.protection.outlook.com ([40.107.20.84] helo=EUR05-DB8-obe.outbound.protection.outlook.com) by merlin.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1kadV7-0001ID-UV for linux-arm-kernel@lists.infradead.org; Thu, 05 Nov 2020 11:32:24 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GVIIhf6JmC5niIMJMRh747lTJvTdhx8XlS5YiT+IuLw=; b=62WlQt/gl5l2Gv5Oicj9UrDc2juvD4oKamTqVKKnF2WiEbVC5gxY5AgPpVZP6+/AoxKz+5szoZD4Bxsl6N+okFjKxSHxHkESICWUie40i50jNOYkVM+CxHIMWVCZVGPeLc/zsHuDBmoiKWnpHatPmJmCZDPBoB5A5rDB42K94hE= Received: from AM4PR0101CA0059.eurprd01.prod.exchangelabs.com (2603:10a6:200:41::27) by AM6PR08MB3032.eurprd08.prod.outlook.com (2603:10a6:209:43::31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3499.18; Thu, 5 Nov 2020 11:32:18 +0000 Received: from AM5EUR03FT010.eop-EUR03.prod.protection.outlook.com (2603:10a6:200:41:cafe::cc) by AM4PR0101CA0059.outlook.office365.com (2603:10a6:200:41::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3499.22 via Frontend Transport; Thu, 5 Nov 2020 11:32:18 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; lists.infradead.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;lists.infradead.org; dmarc=pass action=none header.from=arm.com; Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com; Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by AM5EUR03FT010.mail.protection.outlook.com (10.152.16.134) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3520.15 via Frontend Transport; Thu, 5 Nov 2020 11:32:18 +0000 Received: ("Tessian outbound ba2270a55485:v64"); Thu, 05 Nov 2020 11:32:17 +0000 X-CheckRecipientChecked: true X-CR-MTA-CID: d910f8f3d14945d4 X-CR-MTA-TID: 64aa7808 Received: from 2c488d8d934f.2 by 64aa7808-outbound-1.mta.getcheckrecipient.com id B89372CD-1106-43BB-8CD6-B97FB87E762E.1; Thu, 05 Nov 2020 11:32:11 +0000 Received: from EUR04-VI1-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id 2c488d8d934f.2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Thu, 05 Nov 2020 11:32:11 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=G18mkZAXkt/XwOq0+b9TGBP1N5hskGIXRFaS6LFuct75ppnPx8uWwBu4le3VTCiYDNdD2pRNdqXCUqooZH0U5iGBgKL+tJjrxr30YeLIEaBVlVlZJSKFOZf77ktHVwjpv0jCVEoYbFru21WrlupA2EKVX6rEfoVSZwianqCwqsIpxGVjxXexRsMduRQIWfD52iQQmQbIBZkWrXCOkWazzpsJDe1NjyGiTvXrqEUE4moocVp5+1apkXXCXSCg9cxe+UJfFPOskeei/urjcaUfI6l88x0vdin1VmriXzkWtJt/hqTleEmMcwEBFrq0vxbf9+1gYrmsIzkNwYcjxSCgFw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GVIIhf6JmC5niIMJMRh747lTJvTdhx8XlS5YiT+IuLw=; b=OHaXHy3BYcA8VqoSTvEQ0FP8f6UBkqSiSFTK7WfRAq/kFIDml6gFHevGAdWDQ5vysbyaHwvtACmW/sOdwHXZByx/mAIE62TAmocRS2Nvy98r0bCYeJoZzEZ9sFfw2mfserrPzsV6eVdrWR3FiWBoAJ8y5iwRAeh06QlyUSdCA8yDCDlTepQEN7VkzFggnHeIQSuLBcY+r+0ip9n+VIsbnBL8TAqcuUedIZw0FVOjxIBEpVsAlkbL9i+MHm6ExvEjM0kSXDYWGjM2gj04i/K4wAisPkR7TY3YBK1KGZRb7Oes+co+6bSmFWoaBddDkUsmBMpL+isgsCLQ3e6FmCgvVQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GVIIhf6JmC5niIMJMRh747lTJvTdhx8XlS5YiT+IuLw=; b=62WlQt/gl5l2Gv5Oicj9UrDc2juvD4oKamTqVKKnF2WiEbVC5gxY5AgPpVZP6+/AoxKz+5szoZD4Bxsl6N+okFjKxSHxHkESICWUie40i50jNOYkVM+CxHIMWVCZVGPeLc/zsHuDBmoiKWnpHatPmJmCZDPBoB5A5rDB42K94hE= Authentication-Results-Original: kernel.org; dkim=none (message not signed) header.d=none;kernel.org; dmarc=none action=none header.from=arm.com; Received: from VE1PR08MB5566.eurprd08.prod.outlook.com (2603:10a6:800:1a9::7) by VI1PR08MB3056.eurprd08.prod.outlook.com (2603:10a6:803:3d::28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3499.27; Thu, 5 Nov 2020 11:32:08 +0000 Received: from VE1PR08MB5566.eurprd08.prod.outlook.com ([fe80::479:8cf9:caa1:5477]) by VE1PR08MB5566.eurprd08.prod.outlook.com ([fe80::479:8cf9:caa1:5477%6]) with mapi id 15.20.3499.032; Thu, 5 Nov 2020 11:32:02 +0000 Date: Thu, 5 Nov 2020 11:31:51 +0000 From: Szabolcs Nagy To: Will Deacon Subject: Re: [PATCH 0/4] aarch64: avoid mprotect(PROT_BTI|PROT_EXEC) [BZ #26831] Message-ID: <20201105113150.GE24704@arm.com> References: <20201103173438.GD5545@sirena.org.uk> <20201104092012.GA6439@willie-the-truck> Content-Disposition: inline In-Reply-To: <20201104092012.GA6439@willie-the-truck> User-Agent: Mutt/1.9.4 (2018-02-28) X-Originating-IP: [217.140.106.54] X-ClientProxiedBy: DM5PR16CA0017.namprd16.prod.outlook.com (2603:10b6:3:c0::27) To VE1PR08MB5566.eurprd08.prod.outlook.com (2603:10a6:800:1a9::7) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from arm.com (217.140.106.54) by DM5PR16CA0017.namprd16.prod.outlook.com (2603:10b6:3:c0::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3541.21 via Frontend Transport; Thu, 5 Nov 2020 11:31:57 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: 59b925b2-2782-44d5-6601-08d8817e73f0 X-MS-TrafficTypeDiagnostic: VI1PR08MB3056:|AM6PR08MB3032: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true NoDisclaimer: true X-MS-Oob-TLC-OOBClassifiers: OLM:9508;OLM:9508; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Untrusted: BCL:0; X-Microsoft-Antispam-Message-Info-Original: pxzTHn2kbh+qlbsS0m5ePVO/jQvxlvZFEJOxdMRuG4lV4IKWMBAo7wRO3km3jTOz7fn+zxaQZZ5g0Tw0cXd4AvogtnzP/PAFe6ylQKlLydywnVmSapw1bammfQ10vKf82pNT2ZQ3KHNipcotD8yR5wRPhjoAf4eNFvdxqmSwI23XJAxG+thn9aRZU6NOwSYlndwu+0ThKE1dOykPyoYk/gY1WbwwO7tUhmuLis5OdI4PbyhdQB8+INl0UrloQolDB5wjJiArN2p3pz2MT49wmY0iLN7nMp9RQHxi9guxZ3Xf5yiBrFqFSh2sn2pB/FdswIc+boEKz1rwgvkxbunOWoQQrky2g7VXRX9tzUJtLcoC1Au8qu5IEXHgtujDh/t4 X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:VE1PR08MB5566.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(396003)(366004)(346002)(39860400002)(376002)(136003)(86362001)(83380400001)(1076003)(26005)(316002)(5660300002)(478600001)(33656002)(8936002)(44832011)(54906003)(4326008)(6916009)(7416002)(8886007)(55016002)(66556008)(66476007)(66946007)(7696005)(52116002)(8676002)(956004)(2906002)(2616005)(36756003)(6666004)(186003)(16526019)(83133001); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData: 1RrrocvhDNsYqP2IDn+ljauMdZ5n1/KwXyA5qZKnk/jGjXDclR5mp+VEIwZdXEjSDqHxXB8RstLVl5vqv5g4N/yRyspRi5EPRXKMu/kGpCZX9Ti/0rB+B7kAoQFilOX/AAOuApgYv03sKWv32j+OslkOSBkmqipEzM5HYBq8zXAlMVSbxf7HeKlKt/84jqeNupHE9OPDVn0cmsNL4nWua0id230BQCL27wBTgder7+4YVD0eQU7vvOThmcWQsTAl12V0ns7Py9+TSKP1qRybgs4zju++yDM6MaLPXj6AfnirrJM2diUTJOWwZHYBcXTsBk4PJSed8HIdnvCcp9bJRI+fi7oPizCVUDzj7+wU1XcXqQ+S3sJcV2tKu0sN7T2dQ/T7HvCJ4Lh8dDiCh1ykcy5Zxsf6EDCVvLk2E/sTBDLLMFqe/1E+YTxOQFOxa5OYAOYpigSaMsL+0x2P9IWBKLeEsehFoJr6hXQL2xL3Dm0OctdVPu/Jq92A02evnAwZh2tOu279kQsljby7Dzeie9p43yGefYmMK1Vn6g4KpgzCpUwCMF5sLLjfxYOqu+R81YlwRuEthhsYIX3qnvIVqbl9V+ce5tvTytuKc16dLFEunH72i2OZ7K/pYJ8nXcmwYfmALT70Y+SjSEcbmdeI5g== X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR08MB3056 Original-Authentication-Results: kernel.org; dkim=none (message not signed) header.d=none;kernel.org; dmarc=none action=none header.from=arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: AM5EUR03FT010.eop-EUR03.prod.protection.outlook.com X-MS-Office365-Filtering-Correlation-Id-Prvs: f01b762b-43f7-4358-158f-08d8817e6a22 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: yIjpdc3Y6UobTFAKhpgSY2kKbCYzZLCUANyTiDNgLln6wdZB3TGLkX02tdAj3SGfgtjirpfPXcOCa/UgCjVB+gAZlH9AaUx8FiLNMBcyanfyTvLXrrTc7EXVJ3YM98iQmJ6Ap9HL+ENtmWJFY7X5R7XS42vU+ADFWYW9aKPcUEIWsiQ0U08JOQzU64BDbz0Hzis6yksJZtqI4ulV3RdBthceLw/HAZCe0xuhIsmOHM4Oqtu90vVCspFNwqp4NLD9lHmSoowiqgnV6x8Kz2nJGMASYGeBptnTOuVxvMWYDG4ozVsHpTZEdfxPYFy6V8WHevpO4AO+UGlFMAfB2aZMqOMhj7ytAuVD3tuhxLL0ym0Hfa6mZGo4Bc+5uJqE0hHJGuUmMjzRxeuCmd1SutZVGhydJq5ryOQwFzHP/D90pTs= X-Forefront-Antispam-Report: CIP:63.35.35.123; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:64aa7808-outbound-1.mta.getcheckrecipient.com; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; CAT:NONE; SFS:(4636009)(376002)(346002)(396003)(39860400002)(136003)(46966005)(4326008)(5660300002)(6666004)(1076003)(336012)(70586007)(956004)(2906002)(86362001)(70206006)(186003)(2616005)(55016002)(16526019)(83380400001)(54906003)(36756003)(26005)(82310400003)(107886003)(6862004)(356005)(7696005)(44832011)(8886007)(47076004)(81166007)(316002)(8676002)(478600001)(33656002)(8936002)(82740400003)(83133001); DIR:OUT; SFP:1101; X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Nov 2020 11:32:18.3342 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 59b925b2-2782-44d5-6601-08d8817e73f0 X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-AuthSource: AM5EUR03FT010.eop-EUR03.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM6PR08MB3032 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20201105_063222_085187_CF09DEE6 X-CRM114-Status: GOOD ( 34.01 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Mark Rutland , Florian Weimer , libc-alpha@sourceware.org, Kees Cook , kernel-hardening@lists.openwall.com, Salvatore Mesoraca , Catalin Marinas , linux-kernel@vger.kernel.org, Jeremy Linton , Mark Brown , Lennart Poettering , linux-hardening@vger.kernel.org, Topi Miettinen , linux-arm-kernel@lists.infradead.org Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The 11/04/2020 09:20, Will Deacon wrote: > On Tue, Nov 03, 2020 at 05:34:38PM +0000, Mark Brown wrote: > > On Tue, Nov 03, 2020 at 10:25:37AM +0000, Szabolcs Nagy wrote: > > > > > Re-mmap executable segments instead of mprotecting them in > > > case mprotect is seccomp filtered. > > > > > For the kernel mapped main executable we don't have the fd > > > for re-mmap so linux needs to be updated to add BTI. (In the > > > presence of seccomp filters for mprotect(PROT_EXEC) the libc > > > cannot change BTI protection at runtime based on user space > > > policy so it is better if the kernel maps BTI compatible > > > binaries with PROT_BTI by default.) > > > > Given that there were still some ongoing discussions on a more robust > > kernel interface here and there seem to be a few concerns with this > > series should we perhaps just take a step back and disable this seccomp > > filter in systemd on arm64, at least for the time being? That seems > > safer than rolling out things that set ABI quickly, a big part of the > > reason we went with having the dynamic linker enable PROT_BTI in the > > first place was to give us more flexibility to handle any unforseen > > consequences of enabling BTI that we run into. We are going to have > > similar issues with other features like MTE so we need to make sure that > > whatever we're doing works with them too. > > > > Also updated to Will's current e-mail address - Will, do you have > > thoughts on what we should do here? > > Changing the kernel to map the main executable with PROT_BTI by default is a > user-visible change in behaviour and not without risk, so if we're going to > do that then it needs to be opt-in because the current behaviour has been > there since 5.8. I suppose we could shoe-horn in a cmdline option for 5.10 > (which will be the first LTS with BTI) but it would be better to put up with > the current ABI if possible. it's not clear to me how adding PROT_BTI in the kernel would be observable in practice. adding PROT_BTI to marked elf modules should only have effect in cases when the process does invalid operations and then there is no compat requirement. if this is not the case then adding PROT_BTI on static exe is already problematic. if there is some issue with bti that makes users want to turn it off, then they should do it system wide or may be we can have a no-bti option in userspace which uses mprotect to turn it off (but since that has to be an explicit opt-out i don't mind if the user also has to disable the seccomp sandbox). > Is there real value in this seccomp filter if it only looks at mprotect(), > or was it just implemented because it's easy to do and sounds like a good > idea? i'm fine with just using mprotect and telling users to remove the seccomp filter. but that makes bti less attractive for deployment. _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel