[1/3] x86: Introduce ia32_disabled boot parameter
Commit Message
Distributions would like to reduce their attack surface as much as
possible but at the same time they have to cater to a wide variety of
legacy software. One such avenue where distros have to strike a balance
is the support for 32bit syscalls on a 64bit kernel. Ideally we'd have
the ability to disable the the compat support at boot time. This would
allow the decision whether it should be disabled/enabled can be
delegated to system administrators.
This patch simply introduces ia32_disable boot parameter which aims at
disabling 32 bit process support even if CONFIG_IA32_EMULATION has been
selected at build time.
Signed-off-by: Nikolay Borisov <nik.borisov@suse.com>
---
arch/x86/entry/common.c | 12 ++++++++++++
arch/x86/include/asm/traps.h | 4 ++++
2 files changed, 16 insertions(+)
Comments
On Wed, Jun 07 2023 at 10:29, Nikolay Borisov wrote:
> Distributions would like to reduce their attack surface as much as
> possible but at the same time they have to cater to a wide variety of
> legacy software. One such avenue where distros have to strike a balance
> is the support for 32bit syscalls on a 64bit kernel. Ideally we'd have
> the ability to disable the the compat support at boot time. This would
> allow the decision whether it should be disabled/enabled can be
> delegated to system administrators.
>
> This patch simply introduces ia32_disable boot parameter which aims at
https://www.kernel.org/doc/html/latest/process/maintainer-tip.html
> disabling 32 bit process support even if CONFIG_IA32_EMULATION has been
> selected at build time.
>
> Signed-off-by: Nikolay Borisov <nik.borisov@suse.com>
> ---
> arch/x86/entry/common.c | 12 ++++++++++++
> arch/x86/include/asm/traps.h | 4 ++++
New command line parameters require documentation.
https://www.kernel.org/doc/html/latest/process/
Thanks,
tglx
@@ -19,6 +19,7 @@
#include <linux/nospec.h>
#include <linux/syscalls.h>
#include <linux/uaccess.h>
+#include <linux/init.h>
#ifdef CONFIG_XEN_PV
#include <xen/xen-ops.h>
@@ -96,6 +97,17 @@ static __always_inline int syscall_32_enter(struct pt_regs *regs)
return (int)regs->orig_ax;
}
+#ifdef CONFIG_IA32_EMULATION
+bool ia32_disabled = false;
+
+static int ia32_disabled_cmdline(char *arg)
+{
+ ia32_disabled = true;
+ return 1;
+}
+__setup("ia32_disabled", ia32_disabled_cmdline);
+#endif
+
/*
* Invoke a 32-bit syscall. Called with IRQs on in CONTEXT_KERNEL.
*/
@@ -20,6 +20,10 @@ asmlinkage __visible noinstr struct pt_regs *vc_switch_off_ist(struct pt_regs *e
extern bool ibt_selftest(void);
+#ifdef CONFIG_IA32_EMULATION
+extern bool ia32_disabled;
+#endif
+
#ifdef CONFIG_X86_F00F_BUG
/* For handling the FOOF bug */
void handle_invalid_op(struct pt_regs *regs);