Re: [PATCH 0/4] aarch64: avoid mprotect(PROT_BTI|PROT_EXEC) [BZ #26831]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 4.11.2020 11.29, Florian Weimer wrote:
* Will Deacon:

Is there real value in this seccomp filter if it only looks at mprotect(),
or was it just implemented because it's easy to do and sounds like a good
idea?

It seems bogus to me.  Everyone will just create alias mappings instead,
just like they did for the similar SELinux feature.  See “Example code
to avoid execmem violations” in:

   <https://www.akkadia.org/drepper/selinux-mem.html>

Also note "But this is very dangerous: programs should never use memory regions which are writable and executable at the same time. Assuming that it is really necessary to generate executable code while the program runs the method employed should be reconsidered."

As you can see, this reference implementation creates a PROT_WRITE
mapping aliased to a PROT_EXEC mapping, so it actually reduces security
compared to something that generates the code in an anonymous mapping
and calls mprotect to make it executable.

Drepper's methods to avoid SELinux protections are indeed the two ways (which I'm aware) to also avoid the seccomp filter: by using memfd_create() and using a file system which writable and executable to the process to create a new executable file. Both methods can be eliminated for many system services, memfd_create() with seccomp and filesystem W&X with mount namespaces.

If a service legitimately needs executable and writable mappings (due to JIT, trampolines etc), it's easy to disable the filter whenever really needed with "MemoryDenyWriteExecute=no" (which is the default) in case of systemd or a TE rule like "allow type_t self:process { execmem };" for SELinux. But this shouldn't be the default case, since there are many services which don't need W&X.

I'd also question what is the value of BTI if it can be easily circumvented by removing PROT_BTI with mprotect()?

-Topi



[Index of Archives]     [Linux Samsung SoC]     [Linux Rockchip SoC]     [Linux Actions SoC]     [Linux for Synopsys ARC Processors]     [Linux NFS]     [Linux NILFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]


  Powered by Linux