Date: Sun, 25 Oct 2020 13:42:57 +0000 From: Jordan Glover <Golden_Miller83@...tonmail.ch> To: Salvatore Mesoraca <s.mesoraca16@...il.com> Cc: Topi Miettinen <toiwoton@...il.com>, Kees Cook <keescook@...omium.org>, Szabolcs Nagy <szabolcs.nagy@....com>, Jeremy Linton <jeremy.linton@....com>, "linux-arm-kernel@...ts.infradead.org" <linux-arm-kernel@...ts.infradead.org>, "libc-alpha@...rceware.org" <libc-alpha@...rceware.org>, "systemd-devel@...ts.freedesktop.org" <systemd-devel@...ts.freedesktop.org>, "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, Mark Rutland <mark.rutland@....com>, Mark Brown <broonie@...nel.org>, Dave Martin <dave.martin@....com>, Catalin Marinas <Catalin.Marinas@....com>, Will Deacon <will.deacon@....com>, Kernel Hardening <kernel-hardening@...ts.openwall.com>, "linux-hardening@...r.kernel.org" <linux-hardening@...r.kernel.org> Subject: Re: BTI interaction between seccomp filters in systemd and glibc mprotect calls, causing service failures On Saturday, October 24, 2020 2:12 PM, Salvatore Mesoraca <s.mesoraca16@...il.com> wrote: > On Sat, 24 Oct 2020 at 12:34, Topi Miettinen toiwoton@...il.com wrote: > > > On 23.10.2020 20.52, Salvatore Mesoraca wrote: > > > > > Hi, > > > On Thu, 22 Oct 2020 at 23:24, Topi Miettinen toiwoton@...il.com wrote: > > > > > > > SARA looks interesting. What is missing is a prctl() to enable all W^X > > > > protections irrevocably for the current process, then systemd could > > > > enable it for services with MemoryDenyWriteExecute=yes. > > > > > > SARA actually has a procattr interface to do just that. > > > There is also a library to help using it. > > > > That means that /proc has to be available and writable at that point, so > > setting up procattrs has to be done before mount namespaces are set up. > > In general, it would be nice for sandboxing facilities in kernel if > > there would be a way to start enforcing restrictions only at next > > execve(), like setexeccon() for SELinux and aa_change_onexec() for > > AppArmor. Otherwise the exact order of setting up various sandboxing > > options can be very tricky to arrange correctly, since each option may > > have a subtle effect to the sandboxing features enabled later. In case > > of SARA, the operations done between shuffling the mount namespace and > > before execve() shouldn't be affected so it isn't important. Even if it > > did (a new sandboxing feature in the future would need trampolines or > > JIT code generation), maybe the procattr file could be opened early but > > it could be written closer to execve(). > > A new "apply on exec" procattr file seems reasonable and relatively easy to add. > As Kees pointed out, the main obstacle here is the fact that SARA is > not upstream :( > > Salvatore Is there a chance we will see new SARA iteration soon on lkml? :) Jordan
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.