From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756707AbbCMP4U (ORCPT ); Fri, 13 Mar 2015 11:56:20 -0400 Received: from www.sr71.net ([198.145.64.142]:37865 "EHLO blackbird.sr71.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756593AbbCMP4R (ORCPT ); Fri, 13 Mar 2015 11:56:17 -0400 Message-ID: <5503089F.9000405@sr71.net> Date: Fri, 13 Mar 2015 08:56:15 -0700 From: Dave Hansen User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.5.0 MIME-Version: 1.0 To: Andrew Morton CC: "Eric W. Biederman" , Kees Cook , tytso@mit.edu, Oleg Nesterov , linux-kernel@vger.kernel.org Subject: Re: [RFC][PATCH 1/2] fs proc: make pagemap a privileged interface References: <20150309204321.AAF412E0@viggo.jf.intel.com> <20150312153533.d1c6083e4a9e7825b1a4bc64@linux-foundation.org> In-Reply-To: <20150312153533.d1c6083e4a9e7825b1a4bc64@linux-foundation.org> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 03/12/2015 03:35 PM, Andrew Morton wrote: > On Mon, 09 Mar 2015 13:43:21 -0700 Dave Hansen wrote: >> From: Dave Hansen >> >> Physical addresses are sensitive information. There are >> existing, known exploits that are made easier if physical >> information is available. Here is one example: >> >> http://www.cs.columbia.edu/~vpk/papers/ret2dir.sec14.pdf > Do we really need to disable pagemap entirely? What happens if we just > obscure the addresses (ie: zero them)? I think we have 3 basic options: 1. Disable it entirely (-EPERM or whatever). Apps using it break quickly and fairly obviously (diagnosable with an strace) 2. Zero it, or return some nonsensical thing for the physical address portion, but maintain exporting the PTE flags. Apps only caring about PTE flags work, but anything trying to do lookups in /proc/kpageflags break. If we zero it, apps pay get confused thinking they have the _actual_ pfn=0. 3. Scramble it in some way obscuring the physical address. Unscramble it upon access to /proc/kpageflags. I think you're suggesting (2). Doesn't that risk silently breaking apps? >> pagemap is also the kind of feature that could be used to escalate >> privileged from root in to the kernel. It probably needs to be >> protected in the same way that /dev/mem or module loading is in >> cases where the kernel needs to be protected from root, thus the >> choice to use CAP_SYS_RAWIO. > > Confused. If you have root, you can do mount -o notparanoid. Good point. I guess it doesn't protect us much here unless we also restrict the ability to remount.