From: Kees Cook <keescook@chromium.org>
To: Ben Hutchings <ben@decadent.org.uk>
Cc: Dan Carpenter <dan.carpenter@oracle.com>,
Christian Kujau <lists@nerdbynature.de>,
Alexey Dobriyan <adobriyan@gmail.com>,
Andrew Morton <akpm@linux-foundation.org>,
Willy Tarreau <w@1wt.eu>,
linux-kernel@vger.kernel.org, klibc@lists.zytor.com,
"H. Peter Anvin" <hpa@zytor.com>
Subject: Re: process '/usr/bin/rsync' started with executable stack
Date: Sat, 25 Jul 2020 19:07:37 -0700 [thread overview]
Message-ID: <202007251907.DC4D4C6C15@keescook> (raw)
In-Reply-To: <6898a5af75e165fb9524558804fca9f46f98b633.camel@decadent.org.uk>
On Sat, Jul 25, 2020 at 10:27:56PM +0100, Ben Hutchings wrote:
> On Thu, 2020-06-25 at 13:20 -0700, Kees Cook wrote:
> > On Thu, Jun 25, 2020 at 01:04:29PM +0300, Dan Carpenter wrote:
> > > On Wed, Jun 24, 2020 at 12:39:24PM -0700, Kees Cook wrote:
> > > > On Wed, Jun 24, 2020 at 07:51:48PM +0300, Dan Carpenter wrote:
> > > > > In Debian testing the initrd triggers the warning.
> > > > >
> > > > > [ 34.529809] process '/usr/bin/fstype' started with executable stack
> > > >
> > > > Where does fstype come from there? I am going to guess it is either
> > > > busybox or linked against klibc?
> > > >
> > > > klibc has known problems with executable stacks due to its trampoline
> > > > implementation:
> > > > https://wiki.ubuntu.com/SecurityTeam/Roadmap/ExecutableStacks
> > >
> > > Yeah. It comes from klibc-utils.
> >
> > This is exactly what I was worried about back in Feb:
> > https://lore.kernel.org/lkml/202002251341.48BC06E@keescook/
> >
> > This warning, combined with klibc-based initrds, makes the whole thing
> > pointless because it will always warn once on boot for the klibc stack,
> > and then not warn about anything else after that.
> >
> > It looks like upstream klibc hasn't been touched in about 4 years, and
> > it's been up to Ben to keep it alive in Debian.
> >
> > A couple ideas, in order of my preference:
> >
> > 1) stop using klibc-utils[1]. initramfs-tools-core is the only thing with a
> > dependency on klibc-utils. Only a few things are missing from busybox.
> >
> > 2) make the warning rate-limited instead?
> >
> > 3) fix the use of trampolines in klibc
>
> It only uses trampolines on alpha, m68k, parisc, s390, and sparc32. As
> of today, the master branch should correctly enable executable stacks
> on these and only these architecture.
>
> I have a development branch that sets sa_restorer and disables
> executable stacks on alpha, s390, and sparc32:
>
> https://git.kernel.org/pub/scm/libs/klibc/klibc.git/log/?h=execstack-fixes
Awesome! Thanks for tackling this. :)
--
Kees Cook
prev parent reply other threads:[~2020-07-26 2:07 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-23 17:39 process '/usr/bin/rsync' started with executable stack Christian Kujau
2020-06-23 18:32 ` Kees Cook
2020-06-23 21:33 ` Christian Kujau
2020-06-23 21:41 ` Alexey Dobriyan
2020-06-23 21:45 ` Alexey Dobriyan
2020-06-23 21:50 ` Alexey Dobriyan
2020-06-23 22:02 ` Christian Kujau
2020-06-23 21:12 ` Alexey Dobriyan
2020-06-23 21:22 ` Alexey Dobriyan
2020-06-23 21:51 ` Christian Kujau
2020-06-23 23:20 ` Kees Cook
2020-06-24 5:34 ` Christian Kujau
2020-06-24 16:51 ` Dan Carpenter
2020-06-24 19:39 ` Kees Cook
2020-06-25 10:04 ` Dan Carpenter
2020-06-25 20:20 ` Kees Cook
2020-06-25 21:16 ` [klibc] " Thorsten Glaser
2020-06-25 22:01 ` Kees Cook
2020-06-26 4:42 ` Christophe Leroy
2020-07-25 21:27 ` Ben Hutchings
2020-07-26 2:07 ` Kees Cook [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202007251907.DC4D4C6C15@keescook \
--to=keescook@chromium.org \
--cc=adobriyan@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=ben@decadent.org.uk \
--cc=dan.carpenter@oracle.com \
--cc=hpa@zytor.com \
--cc=klibc@lists.zytor.com \
--cc=linux-kernel@vger.kernel.org \
--cc=lists@nerdbynature.de \
--cc=w@1wt.eu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox