mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-14 12:37:32 +00:00
b507808ebc
Patch series "mm: In-kernel support for memory-deny-write-execute (MDWE)", v2. The background to this is that systemd has a configuration option called MemoryDenyWriteExecute [2], implemented as a SECCOMP BPF filter. Its aim is to prevent a user task from inadvertently creating an executable mapping that is (or was) writeable. Since such BPF filter is stateless, it cannot detect mappings that were previously writeable but subsequently changed to read-only. Therefore the filter simply rejects any mprotect(PROT_EXEC). The side-effect is that on arm64 with BTI support (Branch Target Identification), the dynamic loader cannot change an ELF section from PROT_EXEC to PROT_EXEC|PROT_BTI using mprotect(). For libraries, it can resort to unmapping and re-mapping but for the main executable it does not have a file descriptor. The original bug report in the Red Hat bugzilla - [3] - and subsequent glibc workaround for libraries - [4]. This series adds in-kernel support for this feature as a prctl PR_SET_MDWE, that is inherited on fork(). The prctl denies PROT_WRITE | PROT_EXEC mappings. Like the systemd BPF filter it also denies adding PROT_EXEC to mappings. However unlike the BPF filter it only denies it if the mapping didn't previous have PROT_EXEC. This allows to PROT_EXEC -> PROT_EXEC | PROT_BTI with mprotect(), which is a problem with the BPF filter. This patch (of 2): The aim of such policy is to prevent a user task from creating an executable mapping that is also writeable. An example of mmap() returning -EACCESS if the policy is enabled: mmap(0, size, PROT_READ | PROT_WRITE | PROT_EXEC, flags, 0, 0); Similarly, mprotect() would return -EACCESS below: addr = mmap(0, size, PROT_READ | PROT_EXEC, flags, 0, 0); mprotect(addr, size, PROT_READ | PROT_WRITE | PROT_EXEC); The BPF filter that systemd MDWE uses is stateless, and disallows mprotect() with PROT_EXEC completely. This new prctl allows PROT_EXEC to be enabled if it was already PROT_EXEC, which allows the following case: addr = mmap(0, size, PROT_READ | PROT_EXEC, flags, 0, 0); mprotect(addr, size, PROT_READ | PROT_EXEC | PROT_BTI); where PROT_BTI enables branch tracking identification on arm64. Link: https://lkml.kernel.org/r/20230119160344.54358-1-joey.gouly@arm.com Link: https://lkml.kernel.org/r/20230119160344.54358-2-joey.gouly@arm.com Signed-off-by: Joey Gouly <joey.gouly@arm.com> Co-developed-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Cc: Jeremy Linton <jeremy.linton@arm.com> Cc: Kees Cook <keescook@chromium.org> Cc: Lennart Poettering <lennart@poettering.net> Cc: Mark Brown <broonie@kernel.org> Cc: nd <nd@arm.com> Cc: Shuah Khan <shuah@kernel.org> Cc: Szabolcs Nagy <szabolcs.nagy@arm.com> Cc: Topi Miettinen <toiwoton@gmail.com> Cc: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> Cc: David Hildenbrand <david@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
93 lines
3.2 KiB
C
93 lines
3.2 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef _LINUX_SCHED_COREDUMP_H
|
|
#define _LINUX_SCHED_COREDUMP_H
|
|
|
|
#include <linux/mm_types.h>
|
|
|
|
#define SUID_DUMP_DISABLE 0 /* No setuid dumping */
|
|
#define SUID_DUMP_USER 1 /* Dump as user of process */
|
|
#define SUID_DUMP_ROOT 2 /* Dump as root */
|
|
|
|
/* mm flags */
|
|
|
|
/* for SUID_DUMP_* above */
|
|
#define MMF_DUMPABLE_BITS 2
|
|
#define MMF_DUMPABLE_MASK ((1 << MMF_DUMPABLE_BITS) - 1)
|
|
|
|
extern void set_dumpable(struct mm_struct *mm, int value);
|
|
/*
|
|
* This returns the actual value of the suid_dumpable flag. For things
|
|
* that are using this for checking for privilege transitions, it must
|
|
* test against SUID_DUMP_USER rather than treating it as a boolean
|
|
* value.
|
|
*/
|
|
static inline int __get_dumpable(unsigned long mm_flags)
|
|
{
|
|
return mm_flags & MMF_DUMPABLE_MASK;
|
|
}
|
|
|
|
static inline int get_dumpable(struct mm_struct *mm)
|
|
{
|
|
return __get_dumpable(mm->flags);
|
|
}
|
|
|
|
/* coredump filter bits */
|
|
#define MMF_DUMP_ANON_PRIVATE 2
|
|
#define MMF_DUMP_ANON_SHARED 3
|
|
#define MMF_DUMP_MAPPED_PRIVATE 4
|
|
#define MMF_DUMP_MAPPED_SHARED 5
|
|
#define MMF_DUMP_ELF_HEADERS 6
|
|
#define MMF_DUMP_HUGETLB_PRIVATE 7
|
|
#define MMF_DUMP_HUGETLB_SHARED 8
|
|
#define MMF_DUMP_DAX_PRIVATE 9
|
|
#define MMF_DUMP_DAX_SHARED 10
|
|
|
|
#define MMF_DUMP_FILTER_SHIFT MMF_DUMPABLE_BITS
|
|
#define MMF_DUMP_FILTER_BITS 9
|
|
#define MMF_DUMP_FILTER_MASK \
|
|
(((1 << MMF_DUMP_FILTER_BITS) - 1) << MMF_DUMP_FILTER_SHIFT)
|
|
#define MMF_DUMP_FILTER_DEFAULT \
|
|
((1 << MMF_DUMP_ANON_PRIVATE) | (1 << MMF_DUMP_ANON_SHARED) |\
|
|
(1 << MMF_DUMP_HUGETLB_PRIVATE) | MMF_DUMP_MASK_DEFAULT_ELF)
|
|
|
|
#ifdef CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS
|
|
# define MMF_DUMP_MASK_DEFAULT_ELF (1 << MMF_DUMP_ELF_HEADERS)
|
|
#else
|
|
# define MMF_DUMP_MASK_DEFAULT_ELF 0
|
|
#endif
|
|
/* leave room for more dump flags */
|
|
#define MMF_VM_MERGEABLE 16 /* KSM may merge identical pages */
|
|
#define MMF_VM_HUGEPAGE 17 /* set when mm is available for
|
|
khugepaged */
|
|
/*
|
|
* This one-shot flag is dropped due to necessity of changing exe once again
|
|
* on NFS restore
|
|
*/
|
|
//#define MMF_EXE_FILE_CHANGED 18 /* see prctl_set_mm_exe_file() */
|
|
|
|
#define MMF_HAS_UPROBES 19 /* has uprobes */
|
|
#define MMF_RECALC_UPROBES 20 /* MMF_HAS_UPROBES can be wrong */
|
|
#define MMF_OOM_SKIP 21 /* mm is of no interest for the OOM killer */
|
|
#define MMF_UNSTABLE 22 /* mm is unstable for copy_from_user */
|
|
#define MMF_HUGE_ZERO_PAGE 23 /* mm has ever used the global huge zero page */
|
|
#define MMF_DISABLE_THP 24 /* disable THP for all VMAs */
|
|
#define MMF_OOM_REAP_QUEUED 25 /* mm was queued for oom_reaper */
|
|
#define MMF_MULTIPROCESS 26 /* mm is shared between processes */
|
|
/*
|
|
* MMF_HAS_PINNED: Whether this mm has pinned any pages. This can be either
|
|
* replaced in the future by mm.pinned_vm when it becomes stable, or grow into
|
|
* a counter on its own. We're aggresive on this bit for now: even if the
|
|
* pinned pages were unpinned later on, we'll still keep this bit set for the
|
|
* lifecycle of this mm, just for simplicity.
|
|
*/
|
|
#define MMF_HAS_PINNED 27 /* FOLL_PIN has run, never cleared */
|
|
|
|
#define MMF_HAS_MDWE 28
|
|
#define MMF_HAS_MDWE_MASK (1 << MMF_HAS_MDWE)
|
|
|
|
#define MMF_DISABLE_THP_MASK (1 << MMF_DISABLE_THP)
|
|
|
|
#define MMF_INIT_MASK (MMF_DUMPABLE_MASK | MMF_DUMP_FILTER_MASK |\
|
|
MMF_DISABLE_THP_MASK | MMF_HAS_MDWE_MASK)
|
|
|
|
#endif /* _LINUX_SCHED_COREDUMP_H */
|