On Tue, May 31, 2022 at 04:25:13PM +0000, Edgecombe, Rick P wrote: > Mike, > > Thanks for doing this. Glad to hear this is solvable with the current > paradigm. > > On Tue, 2022-05-31 at 14:59 +0300, Mike Rapoport wrote: > > * add ability to unlock shadow stack features using ptrace. This is > > required because the current glibc (or at least in the version I used > > for > > tests) locks shadow stack state when it loads a program. This locking > > means > > that a process will either have shadow stack disabled without an > > ability to > > enable it or it will have shadow stack enabled with WRSS disabled and > > again, there is no way to re-enable WRSS. With that, ptrace looked > > like the > > most sensible interface to interfere with the shadow stack locking. > > So whatever glibc you have lock's features even if it doesn't enable > shadow stack? Hmm, I've not encountered this. Which glibc is it? I use glibc from here: https://gitlab.com/x86-glibc/glibc/, commit b6f9a22a00c1f8ae8c0991886f0a714f2f5da002 AFAIU, it's H.J cet work. > WRSS is a feature where you would usually want to lock it as disabled, > but WRSS cannot be enabled if shadow stack is not enabled. Locking > shadow stack and WRSS off together doesn't have any security benefits > in theory. so I'm thinking glibc doesn't need to do this. The kernel > could even refuse to lock WRSS without shadow stack being enabled. > Could we avoid the extra ptrace functionality then? What I see for is that a program can support shadow stack, glibc enables shadow stack, does not enable WRSS and than calls arch_prctl(ARCH_X86_FEATURE_LOCK, LINUX_X86_FEATURE_SHSTK | LINUX_X86_FEATURE_WRSS); so that WRSS cannot be re-enabled. For the programs that do not support shadow stack, both SHSTK and WRSS are disabled, but still there is the same call to arch_prctl(ARCH_X86_FEATURE_LOCK, ...) and then neither shadow stack nor WRSS can be enabled. My original plan was to run CRIU with no shadow stack, enable shadow stack and WRSS in the restored tasks using arch_prct() and after the shadow stack contents is restored disable WRSS. Obviously, this didn't work with glibc I have :) On the bright side, having a ptrace call to unlock shadow stack and wrss allows running CRIU itself with shadow stack. > Rick -- Sincerely yours, Mike.
