From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.1 required=3.0 tests=BAYES_00,DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED,DKIM_VALID,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id ABF21C4363A for ; Sat, 24 Oct 2020 11:03:55 +0000 (UTC) Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 4CF2424641 for ; Sat, 24 Oct 2020 11:03:55 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="yT87vPNv"; dkim=fail reason="signature verification failed" (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="RB4Ifw11" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 4CF2424641 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Type: Content-Transfer-Encoding:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:Date:Message-ID:From: References:To:Subject:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=998sMe7zWCt93X3VsMNEDRFCNiJgg219Zd04jnwv5mQ=; b=yT87vPNvpIu8voJvpmIBSpO2G 6PfO+cPdVXz1VdosS/D8/FweRZUc3B//35ouykZIKKujfni1mvMFOA2GP51jyvhCG//tLb2dV8L/T YtAiTNqqKoC2cib9yIR/4+8bIWWDnu3Oq1HwDny8vwY2rx3G9/EeThRzadTJVlr9SMKd/CIvIuidl 1rMk3u/VAlS9RLz2/6dNTTmj/aW2hMpP6L+QtDniuiktAiLzJHMYz3nHsUgFHgQjBdY4llcuGNJZ7 TapqSZTWPGp7N2axxWa+G2n3Jw0c/xapVzVtikDFgs1quW1h07ZzgMfBvjDrkGqDZjnT14j9BPnYc JdcsAMkwg==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1kWHJ7-00019k-Or; Sat, 24 Oct 2020 11:01:57 +0000 Received: from mail-lj1-x243.google.com ([2a00:1450:4864:20::243]) by merlin.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1kWHJ4-000199-0o for linux-arm-kernel@lists.infradead.org; Sat, 24 Oct 2020 11:01:55 +0000 Received: by mail-lj1-x243.google.com with SMTP id a4so4311298lji.12 for ; Sat, 24 Oct 2020 04:01:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=J7AXGwZjHBo0cvQ8nOxRhJ0Ve52DSlFqmlnOi+p9Ml4=; b=RB4Ifw11Et8ewDdQ71Y1JyrVaP+QLMh5l+oakjdrwQqGAl+nHe8uPPEeSLuG61NzR1 sNlfoKNM/zeyich0IQ1x7luJpp1P6jMpoTUVVoSPsU2FWKW0VjThcIA/BY+ubptMqYcP 3TX7OTFWPFRQe36AXd0enGK0j7/iTZ0RkxsX4jm9C4QkD6paQFYN5MRRUIcmOvvXluLO aJBFFdJLrm9qiUoerblrXizM7ULYrs0ROpLNN1rvpc2qY2j+u0jYs0g9nhxBGIYcPuLh RlMyDCwNUtdirjqOiqSuOweLQ7UgzXjflCcohOUD/148FRKfYGfxCgeHAR6lJU/HzaV8 Ampg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=J7AXGwZjHBo0cvQ8nOxRhJ0Ve52DSlFqmlnOi+p9Ml4=; b=nuLdhQJaeDnoE5KPtMgCYBXAmmFpfq5aXwPPIiT2DoNPe1PyiaLLU9lgjNtKaiIBIk 20ZaTfVXVXyq2dWEx1hbSBqLgH0RVj5RYWqEWDwHkI+LJ9EkftM4hrVgm3haX5PiXYYW +bbzICb8H7TCdu6SpltAK9oIfU8llpyW6jGLmW0+hfL6thVnx5O4KdfBOnp75d/be5Kd ACtqGKZ5zAhHkZcX5Qm9Ieqa2D/nxdOjbI62jE4TxjlRIqohnf2we+UOupAQwrAuqIvf Ae+keiE86uTsBZEHzqWmAW8uA7qVj0g0FIlomz0Z69NE6Mqy8vrDzkk1wTL/1ifxuWMY uNlw== X-Gm-Message-State: AOAM532ohIXHzRxHHrJ6TECHqi6zOG/iEAUhvJURiS5wsq8rYUuAW70d KCTD0Wo6Ddm709UeZmgp/S0= X-Google-Smtp-Source: ABdhPJziG/fPpVvjAmCunEwpSNa2+UJyviag/t3AiZqI88dIphjawUEOM+KFCId+O3zeCfP2ehG6zg== X-Received: by 2002:a2e:8997:: with SMTP id c23mr2256835lji.132.1603537311739; Sat, 24 Oct 2020 04:01:51 -0700 (PDT) Received: from [192.168.1.112] (88-114-211-119.elisa-laajakaista.fi. [88.114.211.119]) by smtp.gmail.com with ESMTPSA id v20sm483354lji.90.2020.10.24.04.01.49 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sat, 24 Oct 2020 04:01:51 -0700 (PDT) Subject: Re: BTI interaction between seccomp filters in systemd and glibc mprotect calls, causing service failures To: Catalin Marinas , Kees Cook References: <8584c14f-5c28-9d70-c054-7c78127d84ea@arm.com> <20201022075447.GO3819@arm.com> <78464155-f459-773f-d0ee-c5bdbeb39e5d@gmail.com> <202010221256.A4F95FD11@keescook> <20201023090232.GA25736@gaia> From: Topi Miettinen Message-ID: Date: Sat, 24 Oct 2020 14:01:30 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.12.0 MIME-Version: 1.0 In-Reply-To: <20201023090232.GA25736@gaia> Content-Language: en-US X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20201024_070154_132245_D53FB32A X-CRM114-Status: GOOD ( 19.60 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Mark Rutland , Salvatore Mesoraca , systemd-devel@lists.freedesktop.org, kernel-hardening@lists.openwall.com, Szabolcs Nagy , Will Deacon , "linux-kernel@vger.kernel.org" , Jeremy Linton , Mark Brown , linux-hardening@vger.kernel.org, libc-alpha@sourceware.org, Dave Martin , "linux-arm-kernel@lists.infradead.org" Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On 23.10.2020 12.02, Catalin Marinas wrote: > On Thu, Oct 22, 2020 at 01:02:18PM -0700, Kees Cook wrote: >> Regardless, it makes sense to me to have the kernel load the executable >> itself with BTI enabled by default. I prefer gaining Catalin's suggested >> patch[2]. :) > [...] >> [2] https://lore.kernel.org/linux-arm-kernel/20201022093104.GB1229@gaia/ > > I think I first heard the idea at Mark R ;). > > It still needs glibc changes to avoid the mprotect(), or at least ignore > the error. Since this is an ABI change and we don't know which kernels > would have it backported, maybe better to still issue the mprotect() but > ignore the failure. What about kernel adding an auxiliary vector as a flag to indicate that BTI is supported and recommended by the kernel? Then dynamic loader could use that to detect that a) the main executable is BTI protected and there's no need to mprotect() it and b) PROT_BTI flag should be added to all PROT_EXEC pages. In absence of the vector, the dynamic loader might choose to skip doing PROT_BTI at all (since the main executable isn't protected anyway either, or maybe even the kernel is up-to-date but it knows that it's not recommended for some reason, or maybe the kernel is so ancient that it doesn't know about BTI). Optionally it could still read the flag from ELF later (for compatibility with old kernels) and then do the mprotect() dance, which may trip seccomp filters, possibly fatally. -Topi _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel