From patchwork Fri Oct 4 16:31:54 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Jeff Xu X-Patchwork-Id: 13822721 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0F9A7CF884D for ; Fri, 4 Oct 2024 16:32:06 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 69C9E6B0373; Fri, 4 Oct 2024 12:32:06 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 625036B0374; Fri, 4 Oct 2024 12:32:06 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 49E336B0375; Fri, 4 Oct 2024 12:32:06 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id 2A0C16B0373 for ; Fri, 4 Oct 2024 12:32:06 -0400 (EDT) Received: from smtpin21.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay03.hostedemail.com (Postfix) with ESMTP id A2C31A0D1E for ; Fri, 4 Oct 2024 16:32:05 +0000 (UTC) X-FDA: 82636461810.21.34DA665 Received: from mail-pl1-f171.google.com (mail-pl1-f171.google.com [209.85.214.171]) by imf29.hostedemail.com (Postfix) with ESMTP id B9351120005 for ; Fri, 4 Oct 2024 16:32:02 +0000 (UTC) Authentication-Results: imf29.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=mBx6x9Fh; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf29.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.214.171 as permitted sender) smtp.mailfrom=jeffxu@chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1728059482; a=rsa-sha256; cv=none; b=L/fCVwvAfULOV3ZXBdOuwEIIX4zOckwYyPCSHiV0648pNfB7nTEFzqSw65VfbnwyQR/JjS YEAcJ5sSgjf8lgnaLcTH7+REQWZMrLKVgrj41ZsHksaZ6xPsm7jXc5l2PSGJYsOLT6sqIl SHXnb5DQ+4WAtUK09CPcI9Mi1eVVKTM= ARC-Authentication-Results: i=1; imf29.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=mBx6x9Fh; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf29.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.214.171 as permitted sender) smtp.mailfrom=jeffxu@chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1728059482; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references:dkim-signature; bh=K60b0HU9ftXyJtge8qd284Y8viY6O8DUlfpDN9STjVM=; b=Iw/gAnT4v8sFrNvBqj1FQzP8cOz9K39EBoocuWyl2ew4Z15n3XvuZm4LwtWnB5RCGjoYNh l2GDKXZzVyXqUHaEgNLu7eCwDZFQ+rXGNn7AoPVcmJk0sP1WJ1kpotdTuYvI6wKa3n4uuF 5dvDhA5Bigw7JzA5EEQ2EXJaNqQ23bQ= Received: by mail-pl1-f171.google.com with SMTP id d9443c01a7336-20b2ee7629fso2014535ad.3 for ; Fri, 04 Oct 2024 09:32:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1728059521; x=1728664321; darn=kvack.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=K60b0HU9ftXyJtge8qd284Y8viY6O8DUlfpDN9STjVM=; b=mBx6x9FhrbgoSWsc5ZgP1Se1cgSLxXXvyJebx+tPvJ3eguWT3TcxMdXi8RFyQecYM/ o9/zvKVbPjrKe+/AzUMFAllNsCqvsjHUDV9hwU73XZk3ohakuzDV/Me9KrhkQnqgIyD3 sFZ3z0t8v3RSX5BBK6AX856EZ9GEMnFL66Lsg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1728059521; x=1728664321; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=K60b0HU9ftXyJtge8qd284Y8viY6O8DUlfpDN9STjVM=; b=BiQrqoieb5mNAX0/QNmlFRV53U99WJoD2Q+GOj5Y37BnjxPTeeMVYntF3T+AmMVyJp 3b+My4v2QhpdqtT8GDi4BNXSVDzyhPacvor/mXYjO0ivr3jhiRMOU9tyfFeGIPTtvt+L keiNdzslsnDJPcKBoCJfjFD+FZVp4E1TabuEdLsZCJrdwxfvZPqFglyl56PduJCve7zk pwc0Tag54FbV0AKZ6yGid7eIoq1Kw4u5GfYXAQnbt9fj3m+fQLfzg1gWVmoQzfmlwPWL ZrXOZJ/d4GXwzW1rs/22hyRURBe3HfuVWaW4dG/H5z0Oa1hx2YgL1tp9nurOTiTbIKzJ 9J5Q== X-Forwarded-Encrypted: i=1; AJvYcCVAdrK5/5n5/yFUKOu8K4mBWc1vEbi9TdNEsVm8O1hGsfpaNwGjscHtHwcb8TCN8pQ3cZM+dm8OEQ==@kvack.org X-Gm-Message-State: AOJu0YzdczE6S3r5PF4nY4oAMHnsuSdD6sWEJK/4JS6lv9gjyVSYkWLa Zppkz0YAb8tyFjx+SV2ctHxQD8FQHD6BH46xXvyJKZygmDPkqr/U6RsFLdA3/w== X-Google-Smtp-Source: AGHT+IFSrVTmBEuZDVkZdKrrQvLg1DhltJ6h+f4mR5YU4xMyntpg8h23nyzBrsG074u46Uhkd92ffg== X-Received: by 2002:a17:903:32cc:b0:206:9f2e:1029 with SMTP id d9443c01a7336-20bfdf72cd1mr18918805ad.2.1728059521290; Fri, 04 Oct 2024 09:32:01 -0700 (PDT) Received: from localhost (99.34.197.35.bc.googleusercontent.com. [35.197.34.99]) by smtp.gmail.com with UTF8SMTPSA id 98e67ed59e1d1-2e20b0f6380sm100765a91.40.2024.10.04.09.32.00 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 04 Oct 2024 09:32:00 -0700 (PDT) From: jeffxu@chromium.org To: akpm@linux-foundation.org, keescook@chromium.org, jannh@google.com, torvalds@linux-foundation.org, adhemerval.zanella@linaro.org, oleg@redhat.com Cc: linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org, linux-mm@kvack.org, jorgelo@chromium.org, sroettger@google.com, ojeda@kernel.org, adobriyan@gmail.com, anna-maria@linutronix.de, mark.rutland@arm.com, linus.walleij@linaro.org, mike.kravetz@oracle.com, Jason@zx2c4.com, deller@gmx.de, rdunlap@infradead.org, davem@davemloft.net, hch@lst.de, peterx@redhat.com, hca@linux.ibm.com, f.fainelli@gmail.com, gerg@kernel.org, dave.hansen@linux.intel.com, mingo@kernel.org, ardb@kernel.org, nathan_lynch@mentor.com, dsafonov@virtuozzo.com, Liam.Howlett@Oracle.com, mhocko@suse.com, 42.hyeyoo@gmail.com, peterz@infradead.org, ardb@google.com, enh@google.com, rientjes@google.com, groeck@chromium.org, lorenzo.stoakes@oracle.com, Jeff Xu Subject: [RFC PATCH v1 0/1] seal system mappings Date: Fri, 4 Oct 2024 16:31:54 +0000 Message-ID: <20241004163155.3493183-1-jeffxu@google.com> X-Mailer: git-send-email 2.47.0.rc0.187.ge670bccf7e-goog MIME-Version: 1.0 X-Rspam-User: X-Rspamd-Queue-Id: B9351120005 X-Rspamd-Server: rspam01 X-Stat-Signature: imn8wdu8t4ko1ek4oq8pc7jts6druc11 X-HE-Tag: 1728059522-852072 X-HE-Meta: U2FsdGVkX1/JfNxMAMoJjGCKfAHoCGi8FbtWvBXBy35mnTX4mFRkA1AGBnL0p/5mHrBg2lKOc1CQ1WnmWvfUIS69xyl4FeNYvUxVTOobTUq5zDdFCo6JMYjEBrri3URxpRba0puH7R0JepjTQXJGyw9tRftOpb1/2s5LHdct4tgQ2wypjKj8J7orFkuP85J0rbBoyWM9DlHRFoiqewjLS7NyJU12mEPASvmbdK7NbLAy4U0btx1iqmKVk4YrmzcWFAlZi8t+y2LAVA2WCqWSsNhCcgErzk0G/4UNLvJhjgAup5dJu0vNAylz4wSvJcPkTXM/FoZD3w6j8eTn2A3xbczjbnzPjr8SqVUWp39iaYCKwagSI8o7dj4S6tQ3i9jrlRfdKw7Cylbwrgs8L/w8YYdIeYyjAtb5csKbiZxOYyDoiNeZZ1fULjj50kc6BD9k+zY0YRh/B8nWDWDkEKrIsmKR8Neo1lvrvCTtQEI1FDB7dL0WC/7zhHb06ZHeRMYefEiDus1biEx3tk2NMJ5y3u4aSxxCZHJ/nPFy7fUqn3zs+jQGjQVV5uyV+Ecv44e5zZtw9N7pDq23KxD6aplj1WFVHfgWYDeDpVtM4FXkJLhyu2MikDq0tQKseCUERrichOgezhJZfcPZ5FFbIa90v5/UoMppP2SLdes1MKqFmOY+W3j/elMwuI5kihVK2NU07lLBoHTAn0RUPFpDx1NBNWrCD+PxNc+YmHpmz5/nMKs0b7xdkJcd5HEctUN+jSQDWHbmGG74CD08buVm6COpBn6a2W/tS0+nk7/CtcOvl9fKKatmoEeXiN4Wc5dzlpIpd/Br/OC2TqMs0auSwH+2gQB2DUuqDlvTMQkdz0mPJHZtpZVgdwfLsukV5IMDfUqYE9zryg4kqyL5TBOltICv0zmuRPbdZAm8wGPNYlCwLRl7QS8127gXZvgXIBoXttPA39pSbiFIr5J1RmD99RU clQmkcgW q1NP+7wjAcp1SNDGtoYh4Th3CujxKk991F2A47uUPpecewkwL7QEQlr9WB6riwQuDe3AomzuzfT3YkgY96xX9qnu+2RbGtYVpxxdwGVgEs9dmj3rVgPohOxrPbuR30yWUKRGXqYu0fU0XeWGSLq8Ig3h1U5ie3bSs29LvmlcWCCd7JdldVt3vdMkQIXT9Ns0xchn2jJ+6vGjZRiBG58di0T54DieVUcl2/FYkQv4T4rhaYg6Mwr5ZLyYyOoiD9L2Bj4y4O/oToWe87XRHDwzLje5dh3rRI6s7sGmMA1jHwnWqPnKD6xtbkas9H9jk9me90+eBFe0Swa5SOB9+rnisCh/ZCCTLPuLP7N7Qv45HiOEEjYMGzceQj5T9wu8hqpPDBct2O978Plg8/mDD0ZM60K5wVA== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000006, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Jeff Xu Seal vdso, vvar, sigpage, uprobes and vsyscall. Those mappings are readonly or executable only, sealing can protect them from ever changing during the life time of the process. System mappings such as vdso, vvar, and sigpage (for arm) are generated by the kernel during program initialization. These mappings are designated as non-writable, and sealing them will prevent them from ever becoming writeable. Unlike the aforementioned mappings, the uprobe mapping is not established during program startup. However, its lifetime is the same as the process's lifetime [1], thus sealable. The vdso, vvar, sigpage, and uprobe mappings all invoke the _install_special_mapping() function. As no other mappings utilize this function, it is logical to incorporate sealing logic within _install_special_mapping(). This approach avoids the necessity of modifying code across various architecture-specific implementations. The vsyscall mapping, which has its own initialization function, is sealed in the XONLY case, it seems to be the most common and secure case of using vsyscall. It is important to note that the CHECKPOINT_RESTORE feature (CRIU) may alter the mapping of vdso, vvar, and sigpage during restore operations. Consequently, this feature cannot be universally enabled across all systems. To address this, a kernel configuration option has been introduced to enable or disable this functionality. I tested CONFIG_SEAL_SYSTEM_MAPPINGS_ALWAYS with ChromeOS, which doesn’t use CHECKPOINT_RESTORE, to verify the sealing works. [1] https://lore.kernel.org/all/CABi2SkU9BRUnqf70-nksuMCQ+yyiWjo3fM4XkRkL-NrCZxYAyg@mail.gmail.com/ Jeff Xu (1): exec: seal system mappings .../admin-guide/kernel-parameters.txt | 9 ++++ arch/x86/entry/vsyscall/vsyscall_64.c | 9 +++- fs/exec.c | 53 +++++++++++++++++++ include/linux/fs.h | 1 + mm/mmap.c | 1 + security/Kconfig | 26 +++++++++ 6 files changed, 97 insertions(+), 2 deletions(-)