RE: [RFC PATCH] fs/compat_binfmt_elf: Introduce sysctl to disable compat ELF loader

[David Laight <David.Laight@ACULAB.COM>]

From: Will Deacon
> Sent: 16 September 2021 16:14
...
> > I'm not sure I understand the logic behind the sysctl. Are you worried
> > about exposing attack surface on devices that don't support 32-bit
> > instructions at all but might be tricked into loading a 32-bit binary that
> > exploits a bug in the elf loader, or do you want to remove compat support
> > on some but not all devices running the same kernel?
> 
> It's the latter case. With the GKI effort in Android, we want to run the
> same kernel binary across multiple devices. However, for some devices
> we may be able to determine that there is no need to support 32-bit
> applications even though the hardware may support them, and we would
> like to ensure that things like the compat syscall wrappers, compat vDSO,
> signal handling etc are not accessible to applications.

Interesting because there is the opposite requirement to run
32bit user code under emulation on a 64bit only cpu.
This largely requires the kernel to contain the 32bit
compatibility code - even though it can't execute the instructions.

I suspect you could even embed the instruction emulator inside the
elf interpreter.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)