From patchwork Thu Jul 13 14:33:45 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Aleksa Sarai X-Patchwork-Id: 12003 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:a6b2:0:b0:3e4:2afc:c1 with SMTP id c18csp1885869vqm; Thu, 13 Jul 2023 08:04:17 -0700 (PDT) X-Google-Smtp-Source: APBJJlEadlc3sdNL33vUq1eY9dSk1lGwJ+wBY5bYxtQpgLkr2zK9Fh+McWtIHeLBRxrM7izUEbXE X-Received: by 2002:a17:903:22c5:b0:1b8:870c:4ce8 with SMTP id y5-20020a17090322c500b001b8870c4ce8mr3289696plg.18.1689260657298; Thu, 13 Jul 2023 08:04:17 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1689260657; cv=none; d=google.com; s=arc-20160816; b=tg21UNJ9Sh0i1kRPMvN3kE4SuY0oYm1EheP6a5Y5PA/pioc/TjTtchFRiuC6VscS/3 gKXzsSIsFDcokOjgTOE6F2fY87N0JwvNPxMl1bUAbFddomwVgYRRssc1dMNJRMCmFugo w1YD4eR3Ois9iaLT0IyqrIfz8V4P/PqbP+gaNnZ3JHPE969ftIIL87QIVsZUGHtCYHO1 37ldHrunkaS9pVkKHiBzY55gAE9FpYlu1wREB5llbyYirscv6vUEapI7FudTAEA3BJC/ Oyv7tsoTk5pyRn/vgKYceAS1zO4GOwW+UINOjubsDsVvRtHA0sGFu2E7x7zSQUTzw7sZ QMCg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=lAa7dqvmH+q9XR/GIeI3noqFo+Lf1ym1g3+Ai+iNMRQ=; fh=PN2PZ78DfHAW0tOZlk6NorY9Tvqcw2CFUw//4RCO4Yk=; b=aZ6Q560K7SX/iWovPVp6sEZelEdex0CGFbpziBc70k5iF1NPmzgKcYAKHpA5MrF5vG zmHHxrOPziY1tPQUBPeq8pYWNIa9gIbetKqMcSxHCYJzdYLY9bSZDjBLDprDMU3Whgc/ rU0cI5wfX0/IEA8/2oE68yvxKYwNkRaEDRG7fwLLsOXbdX9VdrtovU5jmIZpKpM+rJUS 0aZiLp8cvppihaJvhNkMzZGsMoonzwiEoW5L4dcACK9txlBsMUvS+AydpN8ecXn/bjqr RRe9GmW0b0s3GMRGt3ZH4U3ANRtqFF8KbNdDKsynK814rp6f//WbUswnvhIo15uYdEj/ 61HQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@cyphar.com header.s=MBO0001 header.b=qUOa4YG3; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=cyphar.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id g6-20020a1709026b4600b001b3414a1fa9si5288585plt.175.2023.07.13.08.04.03; Thu, 13 Jul 2023 08:04:17 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@cyphar.com header.s=MBO0001 header.b=qUOa4YG3; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=cyphar.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231292AbjGMOej (ORCPT + 99 others); Thu, 13 Jul 2023 10:34:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47810 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231225AbjGMOef (ORCPT ); Thu, 13 Jul 2023 10:34:35 -0400 Received: from mout-p-102.mailbox.org (mout-p-102.mailbox.org [80.241.56.152]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0484826AF; Thu, 13 Jul 2023 07:34:32 -0700 (PDT) Received: from smtp2.mailbox.org (smtp2.mailbox.org [IPv6:2001:67c:2050:b231:465::2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-p-102.mailbox.org (Postfix) with ESMTPS id 4R1xvT1mlmz9sTq; Thu, 13 Jul 2023 16:34:29 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cyphar.com; s=MBO0001; t=1689258869; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=lAa7dqvmH+q9XR/GIeI3noqFo+Lf1ym1g3+Ai+iNMRQ=; b=qUOa4YG376HPdtUX9J+UbKWx9u11F5Z+gXjdV/pSgA3GrtUNyKbuBsGccuriE0RNBmfVr+ GGOwyythmmKSi+L/FK9I5Xfwh+tZbGylpGRJ/1cm5pERnc6LMAeEPpwpR6KLaC0OhbZSv2 6rJ1jlIq3X/d812rYImFbjE2RDymOwNm7QF88DLJdMNYMuk/2J4cLmQsdhgX02yxqAOt1c ijb7fHSC4E1HLhOcAVnFqttvDhPqcQJ24eo2dt4A3ylYV5aKQjeVdRVPW+oG7VtYUJnFu6 C5F3iL4cZcSmSItYWfGBI4d4eP3wCC2JJhzSbBLQPUXrV09d206nmsfo9aygdA== From: Aleksa Sarai To: Andrew Morton , Shuah Khan , Jeff Xu , Kees Cook , Aleksa Sarai , Daniel Verkamp , Luis Chamberlain , YueHaibing Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: [RFC PATCH 0/3] memfd: cleanups for vm.memfd_noexec Date: Fri, 14 Jul 2023 00:33:45 +1000 Message-ID: <20230713143406.14342-1-cyphar@cyphar.com> MIME-Version: 1.0 X-Rspamd-Queue-Id: 4R1xvT1mlmz9sTq X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE, SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1771318183134147276 X-GMAIL-MSGID: 1771318183134147276 It seems that the most critical issue with vm.memfd_noexec=2 (the fact that passing MFD_EXEC would bypass it entirely[1]) has been fixed in Andrew's tree[2], but there are still some outstanding issues that need to be addressed: * The dmesg warnings are pr_warn_once, which on most systems means that they will be used up by systemd or some other boot process and userspace developers will never see it. The original patch posted to the ML used pr_warn_ratelimited but the merged patch had it changed (with a comment about it being "per review"), but given that the current warnings are useless, pr_warn_ratelimited makes far more sense. * vm.memfd_noexec=2 shouldn't reject old-style memfd_create(2) syscalls because it will make it far to difficult to ever migrate. Instead it should imply MFD_EXEC. * The racheting mechanism for vm.memfd_noexec doesn't make sense as a security mechanism because a CAP_SYS_ADMIN capable user can create executable binaries in a hidden tmpfs very easily, not to mention the many other things they can do. * The memfd selftests would not exit with a non-zero error code when certain tests that ran in a forked process (specifically the ones related to MFD_EXEC and MFD_NOEXEC_SEAL) failed. (This patchset is based on top of Jeff Xu's patches[2] fixing the MFD_EXEC bug in vm.memfd_noexec=2.) [1]: https://lore.kernel.org/all/ZJwcsU0vI-nzgOB_@codewreck.org/ [2]: https://lore.kernel.org/all/20230705063315.3680666-1-jeffxu@google.com/ Aleksa Sarai (3): memfd: cleanups for vm.memfd_noexec handling memfd: remove racheting feature from vm.memfd_noexec selftests: memfd: error out test process when child test fails include/linux/pid_namespace.h | 16 +++------ kernel/pid_sysctl.h | 7 ---- mm/memfd.c | 32 +++++++---------- tools/testing/selftests/memfd/memfd_test.c | 41 ++++++++++++++++++---- 4 files changed, 51 insertions(+), 45 deletions(-)