From patchwork Fri Oct 4 16:31:55 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Jeff Xu X-Patchwork-Id: 13822722 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id C1FF7CF8840 for ; Fri, 4 Oct 2024 16:32:08 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 2A5438D0001; Fri, 4 Oct 2024 12:32:08 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 206D86B00AF; Fri, 4 Oct 2024 12:32:08 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 00AFF8D0001; Fri, 4 Oct 2024 12:32:07 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id D25F66B0374 for ; Fri, 4 Oct 2024 12:32:07 -0400 (EDT) Received: from smtpin21.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id 7D58F121726 for ; Fri, 4 Oct 2024 16:32:07 +0000 (UTC) X-FDA: 82636461894.21.B55EC07 Received: from mail-pj1-f44.google.com (mail-pj1-f44.google.com [209.85.216.44]) by imf21.hostedemail.com (Postfix) with ESMTP id 80C9A1C001A for ; Fri, 4 Oct 2024 16:32:05 +0000 (UTC) Authentication-Results: imf21.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=kOjPbem9; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf21.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.216.44 as permitted sender) smtp.mailfrom=jeffxu@chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1728059419; a=rsa-sha256; cv=none; b=12Fl0QQR0bjQSNhw3nRCuDcQ2GmH27w8pibj5uVsNNrwZtFQwW7/dlpyo3n1I/JB5k+TDA h+crGO/6SGMDp9MQxR8t6rNpbUA5kT3huDfq9D/WbpiqkYi2H6D1TOFTdCqhXwaAEGku5n FBqkOYPYpStFo9VcDtJI2Ua6TSCUGKQ= ARC-Authentication-Results: i=1; imf21.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=kOjPbem9; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf21.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.216.44 as permitted sender) smtp.mailfrom=jeffxu@chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1728059419; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=rQOMelg8du2jqJR/l5fp+h+gbDSex9spvxivV4Wc4GE=; b=sNdmymqI8FtP4ilWS0Q4KlO3DXiKNi2EtDiFsHdR8zpbaywdX0QKqR5o1qB3bE34YXWacR 0vU4kXteZIey8ERdWdbDG7H54BPzLfI7/8jX1hFrzND6AOV2P1+eXLdGDkUn7N5RCp3vCt rrKHjKPjNRwFtbH3d5ZvzibridyUVFo= Received: by mail-pj1-f44.google.com with SMTP id 98e67ed59e1d1-2e07d87adc2so329385a91.3 for ; Fri, 04 Oct 2024 09:32:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1728059524; x=1728664324; darn=kvack.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=rQOMelg8du2jqJR/l5fp+h+gbDSex9spvxivV4Wc4GE=; b=kOjPbem9j9UdIqeKC05GlwnKXtl78Yp3SPp7bULZD7qhkzljaRIPHGEiQPV+FU2uwa D+V++oT+eMvKG9H28Re+nj8ChdymPI2Bivlq0hbVdxgUf00UH1sC22sQY40fzR4Pg7dj k8nZF1M3Hv1zgnrnhlDL1PbPwWPri1aLqptDk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1728059524; x=1728664324; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=rQOMelg8du2jqJR/l5fp+h+gbDSex9spvxivV4Wc4GE=; b=eTSW+cpxQEqJaTdEPSzuxvoCccSZnEzIeubxAZaeoMwDmcVpSTKU/XEgoZfrAsJ1jP hT7JOLPOcwYYU6cAm+NUtGOvXgVPnVEND4r+YXF446bzpj7/K6uKbIdwNqi6HDTC72tu 5uzpzrqPciNKXulxxPqwUYJOi/jy3JE4WrEbEsTRmMbDqcFm/hsI5yDbmi4wOOQ8Wjim b8oKeFnAKR6de69L5lnmmq76YykqXsYWLZUiLUzPAwJ+JsK0y0WaNYDfFzRMLty5Xpo0 r7nPnTDZ+qSej4kVKnkFgk8ihLJ7uXUvKrfunilm0e5t/7I3sqV7qnDyN6+tBgerlWdl 9J2Q== X-Forwarded-Encrypted: i=1; AJvYcCWZGr03Mj6gs002W6KDadYIeypzkHLKLR85fMRQEGoo+COfa32zz/ZV6NHLyKud5PqoXRpgOeE/YA==@kvack.org X-Gm-Message-State: AOJu0YwLLHiB6nac27UxzCjzfCXohh44jtyo7rinauavW224qPd21h1E lo7qZzvF226eu9EoT2vDFL4hbKoHe50dod+nVnCUIRHiaiBWS8T7W9etVPr1OQ== X-Google-Smtp-Source: AGHT+IHlRjKCM5IdGCgmApKjlpZTmU7xptRaY1QXl4V8jzbeG1/tYay9E/D80BRI0OhBkb9/UUDt1A== X-Received: by 2002:a17:90a:c7cb:b0:2db:60b:eec with SMTP id 98e67ed59e1d1-2e1e63ae8a0mr1687786a91.7.1728059523995; Fri, 04 Oct 2024 09:32:03 -0700 (PDT) Received: from localhost (99.34.197.35.bc.googleusercontent.com. [35.197.34.99]) by smtp.gmail.com with UTF8SMTPSA id 98e67ed59e1d1-2e1e866583esm1837061a91.37.2024.10.04.09.32.03 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 04 Oct 2024 09:32:03 -0700 (PDT) From: jeffxu@chromium.org To: akpm@linux-foundation.org, keescook@chromium.org, jannh@google.com, torvalds@linux-foundation.org, adhemerval.zanella@linaro.org, oleg@redhat.com Cc: linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org, linux-mm@kvack.org, jorgelo@chromium.org, sroettger@google.com, ojeda@kernel.org, adobriyan@gmail.com, anna-maria@linutronix.de, mark.rutland@arm.com, linus.walleij@linaro.org, mike.kravetz@oracle.com, Jason@zx2c4.com, deller@gmx.de, rdunlap@infradead.org, davem@davemloft.net, hch@lst.de, peterx@redhat.com, hca@linux.ibm.com, f.fainelli@gmail.com, gerg@kernel.org, dave.hansen@linux.intel.com, mingo@kernel.org, ardb@kernel.org, nathan_lynch@mentor.com, dsafonov@virtuozzo.com, Liam.Howlett@Oracle.com, mhocko@suse.com, 42.hyeyoo@gmail.com, peterz@infradead.org, ardb@google.com, enh@google.com, rientjes@google.com, groeck@chromium.org, lorenzo.stoakes@oracle.com, Jeff Xu Subject: [RFC PATCH v1 1/1] exec: seal system mappings Date: Fri, 4 Oct 2024 16:31:55 +0000 Message-ID: <20241004163155.3493183-2-jeffxu@google.com> X-Mailer: git-send-email 2.47.0.rc0.187.ge670bccf7e-goog In-Reply-To: <20241004163155.3493183-1-jeffxu@google.com> References: <20241004163155.3493183-1-jeffxu@google.com> MIME-Version: 1.0 X-Rspamd-Server: rspam12 X-Rspamd-Queue-Id: 80C9A1C001A X-Stat-Signature: rsqbq99o67der9zpofwa81knfj88urkb X-Rspam-User: X-HE-Tag: 1728059525-965195 X-HE-Meta: U2FsdGVkX19ttpJ7/6mYjRbpO3oVH/PdEqhoIjhBq+wYhIhBioe8wFmqoctzCTnTZY7cIFWXgJ+0/UEteDFb+1m+3TL/TN5DSw8RIID4adGl7KmAlmCJqbwQXLddtepDwpfbv1tBoHNNszKCkPpwxdADIf+sHpri1Hk6Gj/klfgYTy0HPzqkHhcN+bwKIsAiG6mQ0uC54SNvCB6dQy+Pdbzm9PBkmj3kw7GPPyx4hetPwCp39IS52nOsPFbas1vW7Gcqs1NLX7EbwGfT5QByJf0sHFJdIpIHMnqu/D8WkfTzssok8nJcuPkCK+sPCRMYixbHaCaBJDK3Qsr033vDctUO82Vg56yp2kq7PCe83LoUNsMSmDgenwx5mba3XJIg2rNIVx8oDAEc0Dm81oTDQiysdl0vgHJ2qbwo6LLwAeXQfegsJVAtkBMJbJOQQUsrAtgBq8aGNkhqochYAwro8H4LdGtVNFJrImWZgr6zXIK2Fk5TXACcdYeZ6DpS2hJ9IRGfQLyNPOdn1eg+GsD8lGSIwSJNl1gKBUrsZNdhfpSilVH0tYGuuftvGb+gk0Lj2t29tBeYNEXMS3II4CQe3zNqBnpzVspOQ2Y/cJ+Jh9liD6g7NusXqd2U4eaGbRnQ9vgznSQsFMy2drHyCjUyKiFHHNNsdsqCYz575SpuBCht/3G4Jb3Qwq0QCQse7eEvPDM290t1FhoQsd9QfkIxdOcuGEjzgY2Ch9g28sJVElLYC8p+bFjbb/LBy7CIx1Bysso1w4cJ7Y5eMvaImO/WRPTnZVmGWDEd5uDHMfvaXSz9cpa/elJMdFcZl2sFzGglmY7B2YOAq2fqTDGd1XMgZ1EBio9t2Dl5cNwe1xdumOuTlB/ZbDm6bvJzQykNuOOUZMUYaPr0HOcFUMqqAODRlNn86xPraAcANTtMQmSbkF2ZqhZ4L6ookcq04m58N3EU79l1Q7sojlOyf3glcwu C2d9pDHE vtHsRQ3znt+poWHsK2rtIFM4MJUes38AfRt2iMxXc2x6demkRXqtZ9Hl/gjQDjg7i1teRoP2QNweEsjuvlBut2loY5osaTEz62OQ6apynEzZ6FK6QDuy4yGCaGSRLP0BIDwTt8wsq8FmwSHygYmNzSsIACBIq98vM5LJE8rjjn0snQAdSyyq6bjWWK0w4qyXzFx27zVI00OdOWhFlBEH8BIx8cvvuGetwd4SxtSi+kIt3DYUGI92eV3RyIy4RifUJnWvS/+doEXufOfvkOIu2WIscTZzYQFb/DiHKrKOu42o8TEACPpStkAv9P46uYF7zYKerzvQCE6YcQFyIrDLzaM8FCcQ44TgiGQBH0txFmHP1BgjCiBPhLqMDD9ynBX7rA+4OFDBZZPZRACkM9e5PFAwTGg== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Jeff Xu Seal vdso, vvar, sigpage, uprobes and vsyscall. Those mappings are readonly or executable only, sealing can protect them from ever changing during the life time of the process. System mappings such as vdso, vvar, and sigpage (for arm) are generated by the kernel during program initialization. These mappings are designated as non-writable, and sealing them will prevent them from ever becoming writeable. Unlike the aforementioned mappings, the uprobe mapping is not established during program startup. However, its lifetime is the same as the process's lifetime [1], thus sealable. The vdso, vvar, sigpage, and uprobe mappings all invoke the _install_special_mapping() function. As no other mappings utilize this function, it is logical to incorporate sealing logic within _install_special_mapping(). This approach avoids the necessity of modifying code across various architecture-specific implementations. The vsyscall mapping, which has its own initialization function, is sealed in the XONLY case, it seems to be the most common and secure case of using vsyscall. It is important to note that the CHECKPOINT_RESTORE feature (CRIU) may alter the mapping of vdso, vvar, and sigpage during restore operations. Consequently, this feature cannot be universally enabled across all systems. To address this, a kernel configuration option has been introduced to enable or disable this functionality. I tested CONFIG_SEAL_SYSTEM_MAPPINGS_ALWAYS with ChromeOS, which doesn’t use CHECKPOINT_RESTORE, to verify the sealing works. [1] https://lore.kernel.org/all/CABi2SkU9BRUnqf70-nksuMCQ+yyiWjo3fM4XkRkL-NrCZxYAyg@mail.gmail.com/ Signed-off-by: Jeff Xu --- .../admin-guide/kernel-parameters.txt | 9 ++++ arch/x86/entry/vsyscall/vsyscall_64.c | 9 +++- fs/exec.c | 53 +++++++++++++++++++ include/linux/fs.h | 1 + mm/mmap.c | 1 + security/Kconfig | 26 +++++++++ 6 files changed, 97 insertions(+), 2 deletions(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index 8dcec6d1cdb8..871ba308bb04 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -1535,6 +1535,15 @@ Permit 'security.evm' to be updated regardless of current integrity status. + exec.seal_system_mappings = [KNL] + Format: { never | always } + Seal system mappings: vdso, vvar, sigpage, uprobes, + vsyscall. + This overwrites KCONFIG CONFIG_SEAL_SYSTEM_MAPPINGS_* + - 'never': never seal system mappings. + - 'always': always seal system mappings. + If not specified or invalid, default is the KCONFIG value. + early_page_ext [KNL,EARLY] Enforces page_ext initialization to earlier stages so cover more early boot allocations. Please note that as side effect some optimizations diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c index 2fb7d53cf333..20a3000550d2 100644 --- a/arch/x86/entry/vsyscall/vsyscall_64.c +++ b/arch/x86/entry/vsyscall/vsyscall_64.c @@ -32,6 +32,7 @@ #include #include #include +#include #include #include @@ -366,8 +367,12 @@ void __init map_vsyscall(void) set_vsyscall_pgtable_user_bits(swapper_pg_dir); } - if (vsyscall_mode == XONLY) - vm_flags_init(&gate_vma, VM_EXEC); + if (vsyscall_mode == XONLY) { + unsigned long vm_flags = VM_EXEC; + + update_seal_exec_system_mappings(&vm_flags); + vm_flags_init(&gate_vma, vm_flags); + } BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_PAGE) != (unsigned long)VSYSCALL_ADDR); diff --git a/fs/exec.c b/fs/exec.c index 6c53920795c2..bd4d687c37b1 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -68,6 +68,7 @@ #include #include #include +#include #include #include @@ -2169,3 +2170,55 @@ fs_initcall(init_fs_exec_sysctls); #ifdef CONFIG_EXEC_KUNIT_TEST #include "tests/exec_kunit.c" #endif + +#ifdef CONFIG_64BIT +/* + * Kernel cmdline overwrite for CONFIG_SEAL_SYSTEM_MAPPINGS_X + */ +enum seal_system_mappings_type { + SEAL_SYSTEM_MAPPINGS_NEVER, + SEAL_SYSTEM_MAPPINGS_ALWAYS +}; + +static enum seal_system_mappings_type seal_system_mappings __ro_after_init = + IS_ENABLED(CONFIG_SEAL_SYSTEM_MAPPINGS_ALWAYS) ? SEAL_SYSTEM_MAPPINGS_ALWAYS : + SEAL_SYSTEM_MAPPINGS_NEVER; + +static const struct constant_table value_table_sys_mapping[] __initconst = { + { "never", SEAL_SYSTEM_MAPPINGS_NEVER}, + { "always", SEAL_SYSTEM_MAPPINGS_ALWAYS}, + { } +}; + +static int __init early_seal_system_mappings_override(char *buf) +{ + if (!buf) + return -EINVAL; + + seal_system_mappings = lookup_constant(value_table_sys_mapping, + buf, seal_system_mappings); + + return 0; +} + +early_param("exec.seal_system_mappings", early_seal_system_mappings_override); + +static bool seal_system_mappings_enabled(void) +{ + if (seal_system_mappings == SEAL_SYSTEM_MAPPINGS_ALWAYS) + return true; + + return false; +} + +void update_seal_exec_system_mappings(unsigned long *vm_flags) +{ + if (seal_system_mappings_enabled()) + *vm_flags |= VM_SEALED; + +} +#else +void update_seal_exec_system_mappings(unsigned long *vm_flags) +{ +} +#endif /* CONFIG_64BIT */ diff --git a/include/linux/fs.h b/include/linux/fs.h index 1e25267e2e48..7539e89ccd03 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -3075,6 +3075,7 @@ ssize_t __kernel_read(struct file *file, void *buf, size_t count, loff_t *pos); extern ssize_t kernel_write(struct file *, const void *, size_t, loff_t *); extern ssize_t __kernel_write(struct file *, const void *, size_t, loff_t *); extern struct file * open_exec(const char *); +extern void update_seal_exec_system_mappings(unsigned long *vm_flags); /* fs/dcache.c -- generic fs support functions */ extern bool is_subdir(struct dentry *, struct dentry *); diff --git a/mm/mmap.c b/mm/mmap.c index ee8f91eaadb9..eb158e39ce0d 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2115,6 +2115,7 @@ struct vm_area_struct *_install_special_mapping( unsigned long addr, unsigned long len, unsigned long vm_flags, const struct vm_special_mapping *spec) { + update_seal_exec_system_mappings(&vm_flags); return __install_special_mapping(mm, addr, len, vm_flags, (void *)spec, &special_mapping_vmops); } diff --git a/security/Kconfig b/security/Kconfig index 28e685f53bd1..e289fbb5d676 100644 --- a/security/Kconfig +++ b/security/Kconfig @@ -51,6 +51,32 @@ config PROC_MEM_NO_FORCE endchoice +choice + prompt "Seal system mappings" + default SEAL_SYSTEM_MAPPINGS_NEVER + help + Seal system mappings such as vdso, vvar, sigpage, uprobes and + vsyscall. + Note: kernel command line exec.seal_system_mappings overwrite this. + +config SEAL_SYSTEM_MAPPINGS_NEVER + bool "Traditional behavior - not sealed" + help + Do not seal system mappings. + This is default. + +config SEAL_SYSTEM_MAPPINGS_ALWAYS + bool "Always seal system mappings" + depends on 64BIT + depends on !CHECKPOINT_RESTORE + help + Seal system mappings such as vdso, vvar, sigpage, uprobes and + vsyscall. + Note: CHECKPOINT_RESTORE might relocate vdso mapping during restore, + and remap will fail if the mapping is sealed, therefore + !CHECKPOINT_RESTORE is added as dependency. +endchoice + config SECURITY bool "Enable different security models" depends on SYSFS