On Thu, Mar 09, 2023 at 04:56:37PM +0000, Edgecombe, Rick P wrote:
> There is a proc that shows if shadow stack is enabled in a thread. It
> does indeed come later in the series.
Not good enough:
1. buried somewhere in proc where no one knows about it
2. it is per thread so user needs to grep *all*
> ... We previously tried to add some batch operations to improve the
> performance, but tglx had suggested to start with something simple.
> So we end up with this simple composable API.
I agree with starting simple and thanks for explaining this in detail.
TBH, though, it already sounds like a mess to me. I guess a mess we'll
have to deal with because there will always be this case of some
shared object/lib not being enabled for shstk because of raisins.
And TBH #2, I would've done it even simpler: if some shared object can't
do shadow stack, we disable it for the whole process. I mean, what's the
point? Only some of the stack is shadowed so an attacker could find
a way to keep the process perhaps run this shstk-unsupporting shared
object more/longer and ROP its way around the system.
But I tend to oversimplify things sometimes so...
What I'd like to have, though, is a kernel cmdline param which disables
permissive mode and userspace can't do anything about it. So that once
you boot your kernel, you can know that everything that runs on the
machine has shstk and is properly protected.
Also, it'll allow for faster fixing of all those shared objects to use
shstk by way of political pressure.
Thx.
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
