| Message ID | 20200518055457.12302-2-keescook@chromium.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Relocate execve() sanity checks | expand |
On Sun, May 17, 2020 at 10:54:54PM -0700, Kees Cook wrote: > Change uselib(2)' S_ISREG() error return to EACCES instead of EINVAL so > the behavior matches execve(2), and the seemingly documented value. > The "not a regular file" failure mode of execve(2) is explicitly > documented[1], but it is not mentioned in uselib(2)[2] which does, > however, say that open(2) and mmap(2) errors may apply. The documentation > for open(2) does not include a "not a regular file" error[3], but mmap(2) > does[4], and it is EACCES. > > [1] http://man7.org/linux/man-pages/man2/execve.2.html#ERRORS > [2] http://man7.org/linux/man-pages/man2/uselib.2.html#ERRORS > [3] http://man7.org/linux/man-pages/man2/open.2.html#ERRORS > [4] http://man7.org/linux/man-pages/man2/mmap.2.html#ERRORS > > Signed-off-by: Kees Cook <keescook@chromium.org> This is all extremely weird. uselib has been deprected since forever basically which makes me doubt this matters much but: Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Also - gulp (puts on flame proof suit) - may I suggest we check if there are any distros out there that still set CONFIG_USELIB=y and if not do what we did with the sysctl syscall and remove it? If someone yells we can always backpaddle... Christian
On Mon, May 18, 2020 at 3:03 PM Christian Brauner <christian.brauner@ubuntu.com> wrote: > Also - gulp (puts on flame proof suit) - may I suggest we check if there > are any distros out there that still set CONFIG_USELIB=y Debian seems to have it enabled on x86... https://salsa.debian.org/kernel-team/linux/-/blob/master/debian/config/kernelarch-x86/config#L1896 A random Ubuntu 19.10 VM I have here has it enabled, too.
On Mon, May 18, 2020 at 04:43:20PM +0200, Jann Horn wrote: > On Mon, May 18, 2020 at 3:03 PM Christian Brauner > <christian.brauner@ubuntu.com> wrote: > > Also - gulp (puts on flame proof suit) - may I suggest we check if there > > are any distros out there that still set CONFIG_USELIB=y > > Debian seems to have it enabled on x86... > > https://salsa.debian.org/kernel-team/linux/-/blob/master/debian/config/kernelarch-x86/config#L1896 > > A random Ubuntu 19.10 VM I have here has it enabled, too. I wonder if there's any program - apart from _ancient_ glibc out there that actually use it... I looked at uselib in codsearch but the results were quite unspecific but I didn't look too close. Christian
Christian Brauner <christian.brauner@ubuntu.com> writes: > On Mon, May 18, 2020 at 04:43:20PM +0200, Jann Horn wrote: >> On Mon, May 18, 2020 at 3:03 PM Christian Brauner >> <christian.brauner@ubuntu.com> wrote: >> > Also - gulp (puts on flame proof suit) - may I suggest we check if there >> > are any distros out there that still set CONFIG_USELIB=y >> >> Debian seems to have it enabled on x86... >> >> https://salsa.debian.org/kernel-team/linux/-/blob/master/debian/config/kernelarch-x86/config#L1896 >> >> A random Ubuntu 19.10 VM I have here has it enabled, too. > > I wonder if there's any program - apart from _ancient_ glibc out there > that actually use it... > I looked at uselib in codsearch but the results were quite unspecific > but I didn't look too close. So the thing to do is to have a polite word with people who build Ubuntu and Debian kernels and get them to disable the kernel .config. A quick look suggets it is already disabled in RHEL8. It cannot be disabled in RHEL7. Then in a few years we can come back and discuss removing the uselib system call, base on no distributions having it enabled. If it was only libc4 and libc5 that used the uselib system call then it can probably be removed after enough time. We can probably reorganize the code before the point it is clearly safe to drop support for USELIB to keep it off to the side so USELIB does not have any ongoing mainteance costs. For this patchset I think we need to assume uselib will need to be maintained for a bit longer. Eric
On Mon, May 18, 2020 at 06:57:15PM -0500, Eric W. Biederman wrote: > Christian Brauner <christian.brauner@ubuntu.com> writes: > > > On Mon, May 18, 2020 at 04:43:20PM +0200, Jann Horn wrote: > >> On Mon, May 18, 2020 at 3:03 PM Christian Brauner > >> <christian.brauner@ubuntu.com> wrote: > >> > Also - gulp (puts on flame proof suit) - may I suggest we check if there > >> > are any distros out there that still set CONFIG_USELIB=y > >> > >> Debian seems to have it enabled on x86... > >> > >> https://salsa.debian.org/kernel-team/linux/-/blob/master/debian/config/kernelarch-x86/config#L1896 > >> > >> A random Ubuntu 19.10 VM I have here has it enabled, too. > > > > I wonder if there's any program - apart from _ancient_ glibc out there > > that actually use it... > > I looked at uselib in codsearch but the results were quite unspecific > > but I didn't look too close. > > So the thing to do is to have a polite word with people who build Ubuntu > and Debian kernels and get them to disable the kernel .config. Yeah, I think that's a sane thing to do. I filed a bug for Ubuntu to start a discussion. I can't see an obvious reason why not. > > A quick look suggets it is already disabled in RHEL8. It cannot be > disabled in RHEL7. > > Then in a few years we can come back and discuss removing the uselib > system call, base on no distributions having it enabled. > > If it was only libc4 and libc5 that used the uselib system call then it > can probably be removed after enough time. > > We can probably reorganize the code before the point it is clearly safe > to drop support for USELIB to keep it off to the side so USELIB does not > have any ongoing mainteance costs. > > For this patchset I think we need to assume uselib will need to be > maintained for a bit longer. Yeah, agreed. It doesn't matter as long as we have a plan for the future to remove it. I don't think keeping this cruft around forever should be the only outlook. Christian
On Mai 18 2020, Eric W. Biederman wrote: > If it was only libc4 and libc5 that used the uselib system call then it > can probably be removed after enough time. Only libc4 used it, libc5 was already ELF. Andreas.
Andreas Schwab <schwab@linux-m68k.org> writes: > On Mai 18 2020, Eric W. Biederman wrote: > >> If it was only libc4 and libc5 that used the uselib system call then it >> can probably be removed after enough time. > > Only libc4 used it, libc5 was already ELF. binfmt_elf.c supports uselib. In a very a.out ish way. Do you know if that support was ever used? If we are truly talking a.out only we should be able to make uselib conditional on a.out support in the kernel which is strongly mostly disabled at this point. I am wondering if there are source trees for libc4 or libc5 around anywhere that we can look at to see how usage of uselib evolved. Eric
On Mai 19 2020, Eric W. Biederman wrote: > I am wondering if there are source trees for libc4 or libc5 around > anywhere that we can look at to see how usage of uselib evolved. libc5 is available from archive.debian.org. http://archive.debian.org/debian-archive/debian/pool/main/libc/libc/libc_5.4.46.orig.tar.gz Andreas.
Andreas Schwab <schwab@linux-m68k.org> writes: > On Mai 19 2020, Eric W. Biederman wrote: > >> I am wondering if there are source trees for libc4 or libc5 around >> anywhere that we can look at to see how usage of uselib evolved. > > libc5 is available from archive.debian.org. > > http://archive.debian.org/debian-archive/debian/pool/main/libc/libc/libc_5.4.46.orig.tar.gz Interesting. It appears that the old a.out code to make use of uselib remained in the libc5 sources but it was all conditional on the being compiled not to use ELF. libc5 did provide a wrapper for the uselib system call. It appears glibc also provides a wrapper for the uselib system call named: uselib@GLIBC_2.2.5. I don't see a glibc header file that provides a declaration for uselib though. So the question becomes did anyone use those glibc wrappers. Eric
On Tue, May 19, 2020 at 06:56:36AM -0500, Eric W. Biederman wrote: > Andreas Schwab <schwab@linux-m68k.org> writes: > > > On Mai 18 2020, Eric W. Biederman wrote: > > > >> If it was only libc4 and libc5 that used the uselib system call then it > >> can probably be removed after enough time. > > > > Only libc4 used it, libc5 was already ELF. > > binfmt_elf.c supports uselib. In a very a.out ish way. Do you know if > that support was ever used? > > If we are truly talking a.out only we should be able to make uselib > conditional on a.out support in the kernel which is strongly mostly > disabled at this point. The only ones that even allow setting AOUT: arch/alpha/Kconfig: select HAVE_AOUT arch/m68k/Kconfig: select HAVE_AOUT if MMU and x86 deprecated it March 2019: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=eac616557050737a8d6ef6fe0322d0980ff0ffde Christian
On Tue, May 19, 2020 at 07:28:46AM -0500, Eric W. Biederman wrote: > Andreas Schwab <schwab@linux-m68k.org> writes: > > > On Mai 19 2020, Eric W. Biederman wrote: > > > >> I am wondering if there are source trees for libc4 or libc5 around > >> anywhere that we can look at to see how usage of uselib evolved. > > > > libc5 is available from archive.debian.org. > > > > http://archive.debian.org/debian-archive/debian/pool/main/libc/libc/libc_5.4.46.orig.tar.gz > > Interesting. > > It appears that the old a.out code to make use of uselib remained in > the libc5 sources but it was all conditional on the being compiled not > to use ELF. > > libc5 did provide a wrapper for the uselib system call. > > It appears glibc also provides a wrapper for the uselib system call > named: uselib@GLIBC_2.2.5. > > I don't see a glibc header file that provides a declaration for uselib > though. > > So the question becomes did anyone use those glibc wrappers. The only software I could find was ski, the ia64 instruction set emulator, which apparently used to make use of this and when glibc removed they did: #define uselib(libname) syscall(__NR_uselib, libname) but they only define it for the sake of the internal syscall list they maintain so not actively using it. I just checked, ski is available on Fedora 31 and Fedora has USELIB disabled. Codesearch on Debian yields no users that actively use the syscall for anything. Christian
Hi Christian, On Tue, May 19, 2020 at 3:15 PM Christian Brauner <christian.brauner@ubuntu.com> wrote: > On Tue, May 19, 2020 at 06:56:36AM -0500, Eric W. Biederman wrote: > > Andreas Schwab <schwab@linux-m68k.org> writes: > > > On Mai 18 2020, Eric W. Biederman wrote: > > >> If it was only libc4 and libc5 that used the uselib system call then it > > >> can probably be removed after enough time. > > > > > > Only libc4 used it, libc5 was already ELF. > > > > binfmt_elf.c supports uselib. In a very a.out ish way. Do you know if > > that support was ever used? > > > > If we are truly talking a.out only we should be able to make uselib > > conditional on a.out support in the kernel which is strongly mostly > > disabled at this point. > > The only ones that even allow setting AOUT: > > arch/alpha/Kconfig: select HAVE_AOUT > arch/m68k/Kconfig: select HAVE_AOUT if MMU > > and x86 deprecated it March 2019: > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=eac616557050737a8d6ef6fe0322d0980ff0ffde Quoting myself (for the second time this month): "I think it's safe to assume no one still runs a.out binaries on m68k." http://lore.kernel.org/r/CAMuHMdW+m0Q+j3rsQdMXnrEPm+XB5Y2AQrxW5sD1mZAKgmEqoA@mail.gmail.com Gr{oetje,eeting}s, Geert -- Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org In personal conversations with technical people, I call myself a hacker. But when I'm talking to journalists I just say "programmer" or something like that. -- Linus Torvalds
On Tue, May 19, 2020 at 04:32:38PM +0200, Geert Uytterhoeven wrote: > Hi Christian, > > On Tue, May 19, 2020 at 3:15 PM Christian Brauner > <christian.brauner@ubuntu.com> wrote: > > On Tue, May 19, 2020 at 06:56:36AM -0500, Eric W. Biederman wrote: > > > Andreas Schwab <schwab@linux-m68k.org> writes: > > > > On Mai 18 2020, Eric W. Biederman wrote: > > > >> If it was only libc4 and libc5 that used the uselib system call then it > > > >> can probably be removed after enough time. > > > > > > > > Only libc4 used it, libc5 was already ELF. > > > > > > binfmt_elf.c supports uselib. In a very a.out ish way. Do you know if > > > that support was ever used? > > > > > > If we are truly talking a.out only we should be able to make uselib > > > conditional on a.out support in the kernel which is strongly mostly > > > disabled at this point. > > > > The only ones that even allow setting AOUT: > > > > arch/alpha/Kconfig: select HAVE_AOUT > > arch/m68k/Kconfig: select HAVE_AOUT if MMU > > > > and x86 deprecated it March 2019: > > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=eac616557050737a8d6ef6fe0322d0980ff0ffde > > Quoting myself (for the second time this month): > "I think it's safe to assume no one still runs a.out binaries on m68k." > http://lore.kernel.org/r/CAMuHMdW+m0Q+j3rsQdMXnrEPm+XB5Y2AQrxW5sD1mZAKgmEqoA@mail.gmail.com Well, it's just a great thing to hear. :) Fyi, I once tried to give a demo with a Slackware version in a container which pre-dated ELF on a x86 kernel with AOUT. It didn't go well... Christian
Christian Brauner <christian.brauner@ubuntu.com> writes: > On Tue, May 19, 2020 at 07:28:46AM -0500, Eric W. Biederman wrote: >> Andreas Schwab <schwab@linux-m68k.org> writes: >> >> > On Mai 19 2020, Eric W. Biederman wrote: >> > >> >> I am wondering if there are source trees for libc4 or libc5 around >> >> anywhere that we can look at to see how usage of uselib evolved. >> > >> > libc5 is available from archive.debian.org. >> > >> > http://archive.debian.org/debian-archive/debian/pool/main/libc/libc/libc_5.4.46.orig.tar.gz >> >> Interesting. >> >> It appears that the old a.out code to make use of uselib remained in >> the libc5 sources but it was all conditional on the being compiled not >> to use ELF. >> >> libc5 did provide a wrapper for the uselib system call. >> >> It appears glibc also provides a wrapper for the uselib system call >> named: uselib@GLIBC_2.2.5. >> >> I don't see a glibc header file that provides a declaration for uselib >> though. >> >> So the question becomes did anyone use those glibc wrappers. > > The only software I could find was ski, the ia64 instruction set > emulator, which apparently used to make use of this and when glibc > removed they did: > > #define uselib(libname) syscall(__NR_uselib, libname) > > but they only define it for the sake of the internal syscall list they > maintain so not actively using it. I just checked, ski is available on > Fedora 31 and Fedora has USELIB disabled. > Codesearch on Debian yields no users that actively use the syscall for > anything. I think there is a very good argument that no one builds libraries usable with uselib anymore. The ELF version requires a ET_EXEC binary with one PT_LOAD segment that is loaded at a fixed virtual address. This is a format that does not allow for relocation processing, the loading executable has to ``know'' where the symbols are in the loaded binary, and they have to be build to run at distinct virtual addresses. I think I could conjure up some linker scripts to do that with no more linker support than we use to build the kernel, but it is not easy to maintain binaries and libraries like that as code changes. Which is why we switched to ELF in the first place. I think the tooling challenges plus not being able to find anything using uselib anymore make a solid argument for going to a distribution and asking them to stop enabling CONFIG_USELIB in their kernels. Eric
diff --git a/fs/exec.c b/fs/exec.c index 06b4c550af5d..30735ce1dc0e 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -139,11 +139,10 @@ SYSCALL_DEFINE1(uselib, const char __user *, library) if (IS_ERR(file)) goto out; - error = -EINVAL; + error = -EACCES; if (!S_ISREG(file_inode(file)->i_mode)) goto exit; - error = -EACCES; if (path_noexec(&file->f_path)) goto exit;
Change uselib(2)' S_ISREG() error return to EACCES instead of EINVAL so the behavior matches execve(2), and the seemingly documented value. The "not a regular file" failure mode of execve(2) is explicitly documented[1], but it is not mentioned in uselib(2)[2] which does, however, say that open(2) and mmap(2) errors may apply. The documentation for open(2) does not include a "not a regular file" error[3], but mmap(2) does[4], and it is EACCES. [1] http://man7.org/linux/man-pages/man2/execve.2.html#ERRORS [2] http://man7.org/linux/man-pages/man2/uselib.2.html#ERRORS [3] http://man7.org/linux/man-pages/man2/open.2.html#ERRORS [4] http://man7.org/linux/man-pages/man2/mmap.2.html#ERRORS Signed-off-by: Kees Cook <keescook@chromium.org> --- fs/exec.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)