From patchwork Wed Apr 13 13:49:42 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Catalin Marinas X-Patchwork-Id: 12812050 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id A1FE0C433FE for ; Wed, 13 Apr 2022 13:51:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:Cc :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=EOHyUUs9XCSGQQRCvJAkOFIxdnr5f1BBpy4blHg7MdM=; b=aGDnQNCSxBf84x 7/uQ77sHFX/sxS2KU4LqgVlckr1M2JFFIQ7bYavW+3UozaFDXerVQYCQfTKZr0pcoECxgz+1I9tTU +CCpcI4KguHzqbRNdnCyMahWMbWrasTDszFKGt06AHiQNnUTSqnFhsreXOs5gGO98zsNeQ6+0k9Mg N9lCX/t2ZYOIcQ/GX5mEmU4D7HSq7jM23v7NSZ7wl0TdFWINgFN0k2pQHObdXvknZV1ob4QzWsTRd BtbcrtlEKwUcPE4GU1vuyS1ReAqekt8Q8Emylw0O4VRRO5UYJbpWap/rl2Hgicc1wT1gxvzu+NExT fq1SBM6EmMxA7K645r2w==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1nedNf-001GNg-VG; Wed, 13 Apr 2022 13:50:00 +0000 Received: from ams.source.kernel.org ([2604:1380:4601:e00::1]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1nedNa-001GKl-MS for linux-arm-kernel@lists.infradead.org; Wed, 13 Apr 2022 13:49:57 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id ECA9EB824C9; Wed, 13 Apr 2022 13:49:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C09E9C385A3; Wed, 13 Apr 2022 13:49:48 +0000 (UTC) From: Catalin Marinas To: Andrew Morton , Christoph Hellwig , Lennart Poettering , =?utf-8?q?Zbigniew_J=C4=99drze?= =?utf-8?q?jewski-Szmek?= Cc: Will Deacon , Alexander Viro , Eric Biederman , Kees Cook , Szabolcs Nagy , Mark Brown , Jeremy Linton , Topi Miettinen , linux-mm@kvack.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-abi-devel@lists.sourceforge.net Subject: [PATCH RFC 0/4] mm, arm64: In-kernel support for memory-deny-write-execute (MDWE) Date: Wed, 13 Apr 2022 14:49:42 +0100 Message-Id: <20220413134946.2732468-1-catalin.marinas@arm.com> X-Mailer: git-send-email 2.30.2 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220413_064955_070798_C6D3F1DD X-CRM114-Status: GOOD ( 20.10 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Hi, The background to this is that systemd has a configuration option called MemoryDenyWriteExecute [1], implemented as a SECCOMP BPF filter. Its aim is to prevent a user task from inadvertently creating an executable mapping that is (or was) writeable. Since such BPF filter is stateless, it cannot detect mappings that were previously writeable but subsequently changed to read-only. Therefore the filter simply rejects any mprotect(PROT_EXEC). The side-effect is that on arm64 with BTI support (Branch Target Identification), the dynamic loader cannot change an ELF section from PROT_EXEC to PROT_EXEC|PROT_BTI using mprotect(). For libraries, it can resort to unmapping and re-mapping but for the main executable it does not have a file descriptor. The original bug report in the Red Hat bugzilla - [2] - and subsequent glibc workaround for libraries - [3]. Add in-kernel support for such feature as a DENY_WRITE_EXEC personality flag, inherited on fork() and execve(). The kernel tracks a previously writeable mapping via a new VM_WAS_WRITE flag (64-bit only architectures). I went for a personality flag by analogy with the READ_IMPLIES_EXEC one. However, I'm happy to change it to a prctl() if we don't want more personality flags. A minor downside with the personality flag is that there is no way for the user to query which flags are supported, so in patch 3 I added an AT_FLAGS bit to advertise this. Posting this as an RFC to start a discussion and cc'ing some of the systemd guys and those involved in the earlier thread around the glibc workaround for dynamic libraries [4]. Before thinking of upstreaming this we'd need the systemd folk to buy into replacing the MDWE SECCOMP BPF filter with the in-kernel one. Thanks, Catalin [1] https://www.freedesktop.org/software/systemd/man/systemd.exec.html#MemoryDenyWriteExecute= [2] https://bugzilla.redhat.com/show_bug.cgi?id=1888842 [3] https://sourceware.org/bugzilla/show_bug.cgi?id=26831 [3] https://lore.kernel.org/r/cover.1604393169.git.szabolcs.nagy@arm.com Catalin Marinas (4): mm: Track previously writeable vma permission mm, personality: Implement memory-deny-write-execute as a personality flag fs/binfmt_elf: Tell user-space about the DENY_WRITE_EXEC personality flag arm64: Select ARCH_ENABLE_DENY_WRITE_EXEC arch/arm64/Kconfig | 1 + fs/binfmt_elf.c | 2 ++ include/linux/mm.h | 6 ++++++ include/linux/mman.h | 18 +++++++++++++++++- include/uapi/linux/binfmts.h | 4 ++++ include/uapi/linux/personality.h | 1 + mm/Kconfig | 4 ++++ mm/mmap.c | 3 +++ mm/mprotect.c | 5 +++++ 9 files changed, 43 insertions(+), 1 deletion(-)