On 4.11.2020 11.29, Florian Weimer wrote:
* Will Deacon:
Is there real value in this seccomp filter if it only looks at mprotect(),
or was it just implemented because it's easy to do and sounds like a good
idea?
It seems bogus to me. Everyone will just create alias mappings instead,
just like they did for the similar SELinux feature. See “Example code
to avoid execmem violations” in:
<https://www.akkadia.org/drepper/selinux-mem.html>
Also note "But this is very dangerous: programs should never use memory
regions which are writable and executable at the same time. Assuming
that it is really necessary to generate executable code while the
program runs the method employed should be reconsidered."
As you can see, this reference implementation creates a PROT_WRITE
mapping aliased to a PROT_EXEC mapping, so it actually reduces security
compared to something that generates the code in an anonymous mapping
and calls mprotect to make it executable.
Drepper's methods to avoid SELinux protections are indeed the two ways
(which I'm aware) to also avoid the seccomp filter: by using
memfd_create() and using a file system which writable and executable to
the process to create a new executable file. Both methods can be
eliminated for many system services, memfd_create() with seccomp and
filesystem W&X with mount namespaces.
If a service legitimately needs executable and writable mappings (due to
JIT, trampolines etc), it's easy to disable the filter whenever really
needed with "MemoryDenyWriteExecute=no" (which is the default) in case
of systemd or a TE rule like "allow type_t self:process { execmem };"
for SELinux. But this shouldn't be the default case, since there are
many services which don't need W&X.
I'd also question what is the value of BTI if it can be easily
circumvented by removing PROT_BTI with mprotect()?
-Topi
