From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp-8fa9.mail.infomaniak.ch (smtp-8fa9.mail.infomaniak.ch [83.166.143.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A18D618C17A for ; Tue, 9 Jul 2024 20:42:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=83.166.143.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720557780; cv=none; b=Fi+W6zWc+PMoII8iUwAcsrSeRjOtLf5Iw3bF3g2bu7LhKy7ExKOtQM4Epb1g4nsUgIMTei1deaqhsFfYJ+pvsBVhOtjQHTcelxGL85G2g8wuKoal0TvWT7BXpIXDdd2OZxCfGj9cru+EuN+bZ/epSb1s8o4VPgvgDjlTJbcDij0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720557780; c=relaxed/simple; bh=IoWefWbaQQ+V91YTtjdF0anlb0ViXVpXd1IFsTvTs/w=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=j1gnkLVFyQddyzpBe9Xvw50tlBc8Cd4lsLV7RfUdrU8xf0QOUh6mO7r50qnoOPw5nyBbgu9VSOIU8AaRDDukn5Ov8cNsZMMSWVYcj/ue0DpPwWFu9tXve9BoOW6Glauu1g4vjCeLk7M8fZFSiIg1dQY3FbOuLVovP0YjWNcvjsE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=digikod.net; spf=pass smtp.mailfrom=digikod.net; dkim=pass (1024-bit key) header.d=digikod.net header.i=@digikod.net header.b=1FMlMQ54; arc=none smtp.client-ip=83.166.143.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=digikod.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=digikod.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=digikod.net header.i=@digikod.net header.b="1FMlMQ54" Received: from smtp-3-0000.mail.infomaniak.ch (smtp-3-0000.mail.infomaniak.ch [10.4.36.107]) by smtp-4-3000.mail.infomaniak.ch (Postfix) with ESMTPS id 4WJXxP73CTzttm; Tue, 9 Jul 2024 22:42:49 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digikod.net; s=20191114; t=1720557769; bh=nDu9N6iZS4Lyv2hlEEUB0oUIC/M/y2uYLqX0goXo3sc=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=1FMlMQ54mh76md4zMT3d84xYnJsItu6is9Hwa+GWCVdZd10AKJNNKloZ4aD2LRmHd 0IQG9slNgks/siDVdV7BybKWU9uNwJoe3tpWWxv7l0COEL+eblgknoRpVzWrJ3voPi FaYe8+CubLSlDuo6ztOcihY/B53HBeoCu2doqr5w= Received: from unknown by smtp-3-0000.mail.infomaniak.ch (Postfix) with ESMTPA id 4WJXxP1tkXzT9r; Tue, 9 Jul 2024 22:42:49 +0200 (CEST) Date: Tue, 9 Jul 2024 22:42:45 +0200 From: =?utf-8?Q?Micka=C3=ABl_Sala=C3=BCn?= To: Mimi Zohar Cc: Al Viro , Christian Brauner , Kees Cook , Linus Torvalds , Paul Moore , Theodore Ts'o , Alejandro Colomar , Aleksa Sarai , Andrew Morton , Andy Lutomirski , Arnd Bergmann , Casey Schaufler , Christian Heimes , Dmitry Vyukov , Eric Biggers , Eric Chiang , Fan Wu , Florian Weimer , Geert Uytterhoeven , James Morris , Jan Kara , Jann Horn , Jeff Xu , Jonathan Corbet , Jordan R Abrahams , Lakshmi Ramasubramanian , Luca Boccassi , Luis Chamberlain , "Madhavan T . Venkataraman" , Matt Bobrowski , Matthew Garrett , Matthew Wilcox , Miklos Szeredi , Nicolas Bouchinet , Scott Shell , Shuah Khan , Stephen Rothwell , Steve Dower , Steve Grubb , Thibaut Sautereau , Vincent Strubel , Xiaoming Ni , Yin Fengwei , kernel-hardening@lists.openwall.com, linux-api@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org Subject: Re: [RFC PATCH v19 5/5] samples/should-exec: Add set-should-exec Message-ID: <20240709.chait2ahKeos@digikod.net> References: <20240704190137.696169-1-mic@digikod.net> <20240704190137.696169-6-mic@digikod.net> <968619d912ee5a57aed6c73218221ef445a0766e.camel@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <968619d912ee5a57aed6c73218221ef445a0766e.camel@linux.ibm.com> X-Infomaniak-Routing: alpha On Mon, Jul 08, 2024 at 03:40:42PM -0400, Mimi Zohar wrote: > Hi Mickaël, > > On Thu, 2024-07-04 at 21:01 +0200, Mickaël Salaün wrote: > > Add a simple tool to set SECBIT_SHOULD_EXEC_CHECK, > > SECBIT_SHOULD_EXEC_RESTRICT, and their lock counterparts before > > executing a command. This should be useful to easily test against > > script interpreters. > > The print_usage() provides the calling syntax. Could you provide an example of > how to use it and what to expect? To set SECBIT_SHOULD_EXEC_CHECK, SECBIT_SHOULD_EXEC_RESTRICT, and lock them on a new shell (session) we can use this: ./set-should-exec -crl -- bash -i This would have no impact unless Bash, ld.so, or one of its child code is patched to restrict execution (e.g. with execveat+AT_CHECK check). Script interpreters and dynamic linkers need to be patch on a secure sysetm. Steve is enlightening Python, and we'll need more similar changes for common user space code. This can be an incremental work and only enforced on some user sessions or containers for instance. > > thanks, > > Mimi > >