From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp-42af.mail.infomaniak.ch (smtp-42af.mail.infomaniak.ch [84.16.66.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E10F5146D74 for ; Tue, 9 Jul 2024 20:42:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=84.16.66.175 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720557738; cv=none; b=pweoe3JrAjFQpMCvlxJXc9AjknOqKPpOtxS0HTchP/E/pzyWDfqX2fDpFAbtmXQ+CFIZ2CzTKxXDpF0q+zYp2tmG/EWVGlmv5d14O78EPuZys6VfK7Auzvi5OwL5wTLpgPF1wF4Tbt9BmeT0C6IikfGOkQfKOlr9++p1hsqfhV4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720557738; c=relaxed/simple; bh=aZw9C8tFPyShePfTza2iIJraUiRpHMpnuObC6NWgnsY=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=hoHCiSaErQKkcGJehH7xFqix+vDEUQriLfySwGkWMy0S7+gphcOayQ/oHs3znMn6szlz3V+Cwki5FJPv0LJMVJ6KfDMjN5HxEdMzYElFB6uIPQmeyUkTZhi394UHXqZC+fj4d9f/Co8IDD1Z7xYX/XXraIAEpKB0WWYep4dwAdw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=digikod.net; spf=pass smtp.mailfrom=digikod.net; dkim=pass (1024-bit key) header.d=digikod.net header.i=@digikod.net header.b=lcV5oubD; arc=none smtp.client-ip=84.16.66.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=digikod.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=digikod.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=digikod.net header.i=@digikod.net header.b="lcV5oubD" Received: from smtp-4-0000.mail.infomaniak.ch (smtp-4-0000.mail.infomaniak.ch [10.7.10.107]) by smtp-4-3000.mail.infomaniak.ch (Postfix) with ESMTPS id 4WJXwf5vhJzsJ2; Tue, 9 Jul 2024 22:42:10 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digikod.net; s=20191114; t=1720557730; bh=b/6BV4qENhC2jLKcP5I5zsdG+AAW0O4kWpLE4Pdgsx4=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=lcV5oubD1HhBRpEpPcxMKtGDQ9TqcBhGdXp79aW87IvdgoYtwICUbJiuLCQusIsIV zh8XujpWxWy+Q6jb/cLpy5yf5/lNSPPTQTakgJ4Fnp3uiHbRPiZzsRSnz0PcG6yhmS Xf0ItQwcE5vjbwKGxHDcSNrW5WjR6671nkei7WCU= Received: from unknown by smtp-4-0000.mail.infomaniak.ch (Postfix) with ESMTPA id 4WJXwP3TsTz1q7; Tue, 9 Jul 2024 22:41:57 +0200 (CEST) Date: Tue, 9 Jul 2024 22:41:54 +0200 From: =?utf-8?Q?Micka=C3=ABl_Sala=C3=BCn?= To: Jeff Xu Cc: Florian Weimer , Al Viro , Christian Brauner , Kees Cook , Linus Torvalds , Paul Moore , Theodore Ts'o , Alejandro Colomar , Aleksa Sarai , Andrew Morton , Andy Lutomirski , Arnd Bergmann , Casey Schaufler , Christian Heimes , Dmitry Vyukov , Eric Biggers , Eric Chiang , Fan Wu , Geert Uytterhoeven , James Morris , Jan Kara , Jann Horn , Jonathan Corbet , Jordan R Abrahams , Lakshmi Ramasubramanian , Luca Boccassi , Luis Chamberlain , "Madhavan T . Venkataraman" , Matt Bobrowski , Matthew Garrett , Matthew Wilcox , Miklos Szeredi , Mimi Zohar , Nicolas Bouchinet , Scott Shell , Shuah Khan , Stephen Rothwell , Steve Dower , Steve Grubb , Thibaut Sautereau , Vincent Strubel , Xiaoming Ni , Yin Fengwei , kernel-hardening@lists.openwall.com, linux-api@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org Subject: Re: [RFC PATCH v19 1/5] exec: Add a new AT_CHECK flag to execveat(2) Message-ID: <20240709.eud4ao8Kie6n@digikod.net> References: <20240704190137.696169-1-mic@digikod.net> <20240704190137.696169-2-mic@digikod.net> <87bk3bvhr1.fsf@oldenburg.str.redhat.com> <87ed83etpk.fsf@oldenburg.str.redhat.com> <87r0c3dc1c.fsf@oldenburg.str.redhat.com> <20240709.gae4cu4Aiv6s@digikod.net> Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: X-Infomaniak-Routing: alpha On Tue, Jul 09, 2024 at 11:57:27AM -0700, Jeff Xu wrote: > On Tue, Jul 9, 2024 at 2:18 AM Mickaël Salaün wrote: > > > > On Mon, Jul 08, 2024 at 10:52:36AM -0700, Jeff Xu wrote: > > > On Mon, Jul 8, 2024 at 10:33 AM Florian Weimer wrote: > > > > > > > > * Jeff Xu: > > > > > > > > > On Mon, Jul 8, 2024 at 9:26 AM Florian Weimer wrote: > > > > >> > > > > >> * Jeff Xu: > > > > >> > > > > >> > Will dynamic linkers use the execveat(AT_CHECK) to check shared > > > > >> > libraries too ? or just the main executable itself. > > > > >> > > > > >> I expect that dynamic linkers will have to do this for everything they > > > > >> map. > > > > > Then all the objects (.so, .sh, etc.) will go through the check from > > > > > execveat's main to security_bprm_creds_for_exec(), some of them might > > > > > be specific for the main executable ? > > > > Yes, we should check every executable code (including seccomp filters) > > to get a consistent policy. > > > > What do you mean by "specific for the main executable"? > > > I meant: > > The check is for the exe itself, not .so, etc. > > For example: /usr/bin/touch is checked. > not the shared objects: > ldd /usr/bin/touch > linux-vdso.so.1 (0x00007ffdc988f000) > libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f59b6757000) > /lib64/ld-linux-x86-64.so.2 (0x00007f59b6986000) ld.so should be patched to check shared-objects. > > Basically, I asked if the check can be extended to shared-objects, > seccomp filters, etc, without modifying existing LSMs. Yes, the check should be used against any piece of code such as shared-objects, seccomp filters... > you pointed out "LSM should not need to be updated with this patch > series.", which already answered my question. > > Thanks. > -Jeff > > -Jeff