Re: [PATCH] security: CONFIG_HARDENED_USERCOPY does not need to select BUG
Hi Kamal, On Mon, Jul 2, 2018 at 1:14 PM, Kamal Mostafa wrote: > On Fri, Jun 29, 2018 at 01:27:08PM -0700, Kees Cook wrote: >> Do the lkdtm tests for usercopy correctly halt the kernel thread if >> CONFIG_BUG is removed? > > Yes, they do... Perfect, thanks for double-checking! I'll apply this to my tree. -Kees -- Kees Cook Pixel Security
Re: [PATCH] security: CONFIG_HARDENED_USERCOPY does not need to select BUG
Hi Kamal, On Mon, Jul 2, 2018 at 1:14 PM, Kamal Mostafa wrote: > On Fri, Jun 29, 2018 at 01:27:08PM -0700, Kees Cook wrote: >> Do the lkdtm tests for usercopy correctly halt the kernel thread if >> CONFIG_BUG is removed? > > Yes, they do... Perfect, thanks for double-checking! I'll apply this to my tree. -Kees -- Kees Cook Pixel Security
Re: [PATCH] security: CONFIG_HARDENED_USERCOPY does not need to select BUG
On Fri, Jun 29, 2018 at 01:27:08PM -0700, Kees Cook wrote: > On Fri, Jun 29, 2018 at 1:04 PM, Kamal Mostafa wrote: > > Allows for CONFIG_HARDENED_USERCOPY without CONFIG_BUG. > > > > Signed-off-by: Kamal Mostafa > > --- > > security/Kconfig | 1 - > > 1 file changed, 1 deletion(-) > > > > diff --git a/security/Kconfig b/security/Kconfig > > index c430206..7667774 100644 > > --- a/security/Kconfig > > +++ b/security/Kconfig > > @@ -153,7 +153,6 @@ config HAVE_HARDENED_USERCOPY_ALLOCATOR > > config HARDENED_USERCOPY > > bool "Harden memory copies between kernel and userspace" > > depends on HAVE_HARDENED_USERCOPY_ALLOCATOR > > - select BUG > > imply STRICT_DEVMEM > > help > > This option checks for obviously wrong memory regions when > > Do the lkdtm tests for usercopy correctly halt the kernel thread if > CONFIG_BUG is removed? > Yes, they do... With this config (specifically disabling 'FALLBACK'): CONFIG_HARDENED_USERCOPY=y # CONFIG_HARDENED_USERCOPY_FALLBACK is not set # CONFIG_BUG is not set I ran the usercopy tests as follows: modprobe lkdtm cd /sys/kernel/debug/provoke-crash cat DIRECT | grep USERCOPY | while read x ; do echo $x | tee DIRECT || echo $?; done Resulting in this command line output: USERCOPY_HEAP_SIZE_TO 139 USERCOPY_HEAP_SIZE_FROM 139 USERCOPY_HEAP_WHITELIST_TO 139 USERCOPY_HEAP_WHITELIST_FROM 139 USERCOPY_STACK_FRAME_TO 139 USERCOPY_STACK_FRAME_FROM 139 USERCOPY_STACK_BEYOND 139 USERCOPY_KERNEL 139 Each test case yields kernel log output like: lkdtm: Performing direct entry USERCOPY_HEAP_SIZE_TO lkdtm: attempting good copy_to_user of correct size lkdtm: attempting bad copy_to_user of too large size usercopy: Kernel memory exposure attempt detected from SLUB object 'kmalloc-1024' (offset 16, size 1024)! invalid opcode: [#17] SMP PTI ... {panic dump} ... Each 'tee' gets terminated with SIGSEGV and no instances appear of the lkdtm/usercopy.c warning "copy_{to/from}_user failed, but lacked Oops". If I leave CONFIG_HARDENED_USERCOPY_FALLBACK=y then the pair of WHITELIST tests don't trigger a panic or SIGSEGV, as expected. -Kamal
Re: [PATCH] security: CONFIG_HARDENED_USERCOPY does not need to select BUG
On Fri, Jun 29, 2018 at 01:27:08PM -0700, Kees Cook wrote: > On Fri, Jun 29, 2018 at 1:04 PM, Kamal Mostafa wrote: > > Allows for CONFIG_HARDENED_USERCOPY without CONFIG_BUG. > > > > Signed-off-by: Kamal Mostafa > > --- > > security/Kconfig | 1 - > > 1 file changed, 1 deletion(-) > > > > diff --git a/security/Kconfig b/security/Kconfig > > index c430206..7667774 100644 > > --- a/security/Kconfig > > +++ b/security/Kconfig > > @@ -153,7 +153,6 @@ config HAVE_HARDENED_USERCOPY_ALLOCATOR > > config HARDENED_USERCOPY > > bool "Harden memory copies between kernel and userspace" > > depends on HAVE_HARDENED_USERCOPY_ALLOCATOR > > - select BUG > > imply STRICT_DEVMEM > > help > > This option checks for obviously wrong memory regions when > > Do the lkdtm tests for usercopy correctly halt the kernel thread if > CONFIG_BUG is removed? > Yes, they do... With this config (specifically disabling 'FALLBACK'): CONFIG_HARDENED_USERCOPY=y # CONFIG_HARDENED_USERCOPY_FALLBACK is not set # CONFIG_BUG is not set I ran the usercopy tests as follows: modprobe lkdtm cd /sys/kernel/debug/provoke-crash cat DIRECT | grep USERCOPY | while read x ; do echo $x | tee DIRECT || echo $?; done Resulting in this command line output: USERCOPY_HEAP_SIZE_TO 139 USERCOPY_HEAP_SIZE_FROM 139 USERCOPY_HEAP_WHITELIST_TO 139 USERCOPY_HEAP_WHITELIST_FROM 139 USERCOPY_STACK_FRAME_TO 139 USERCOPY_STACK_FRAME_FROM 139 USERCOPY_STACK_BEYOND 139 USERCOPY_KERNEL 139 Each test case yields kernel log output like: lkdtm: Performing direct entry USERCOPY_HEAP_SIZE_TO lkdtm: attempting good copy_to_user of correct size lkdtm: attempting bad copy_to_user of too large size usercopy: Kernel memory exposure attempt detected from SLUB object 'kmalloc-1024' (offset 16, size 1024)! invalid opcode: [#17] SMP PTI ... {panic dump} ... Each 'tee' gets terminated with SIGSEGV and no instances appear of the lkdtm/usercopy.c warning "copy_{to/from}_user failed, but lacked Oops". If I leave CONFIG_HARDENED_USERCOPY_FALLBACK=y then the pair of WHITELIST tests don't trigger a panic or SIGSEGV, as expected. -Kamal
Re: [PATCH] security: CONFIG_HARDENED_USERCOPY does not need to select BUG
On Fri, Jun 29, 2018 at 1:04 PM, Kamal Mostafa wrote: > Allows for CONFIG_HARDENED_USERCOPY without CONFIG_BUG. > > Signed-off-by: Kamal Mostafa > --- > security/Kconfig | 1 - > 1 file changed, 1 deletion(-) > > diff --git a/security/Kconfig b/security/Kconfig > index c430206..7667774 100644 > --- a/security/Kconfig > +++ b/security/Kconfig > @@ -153,7 +153,6 @@ config HAVE_HARDENED_USERCOPY_ALLOCATOR > config HARDENED_USERCOPY > bool "Harden memory copies between kernel and userspace" > depends on HAVE_HARDENED_USERCOPY_ALLOCATOR > - select BUG > imply STRICT_DEVMEM > help > This option checks for obviously wrong memory regions when Do the lkdtm tests for usercopy correctly halt the kernel thread if CONFIG_BUG is removed? -Kees -- Kees Cook Pixel Security
Re: [PATCH] security: CONFIG_HARDENED_USERCOPY does not need to select BUG
On Fri, Jun 29, 2018 at 1:04 PM, Kamal Mostafa wrote: > Allows for CONFIG_HARDENED_USERCOPY without CONFIG_BUG. > > Signed-off-by: Kamal Mostafa > --- > security/Kconfig | 1 - > 1 file changed, 1 deletion(-) > > diff --git a/security/Kconfig b/security/Kconfig > index c430206..7667774 100644 > --- a/security/Kconfig > +++ b/security/Kconfig > @@ -153,7 +153,6 @@ config HAVE_HARDENED_USERCOPY_ALLOCATOR > config HARDENED_USERCOPY > bool "Harden memory copies between kernel and userspace" > depends on HAVE_HARDENED_USERCOPY_ALLOCATOR > - select BUG > imply STRICT_DEVMEM > help > This option checks for obviously wrong memory regions when Do the lkdtm tests for usercopy correctly halt the kernel thread if CONFIG_BUG is removed? -Kees -- Kees Cook Pixel Security
[PATCH] security: CONFIG_HARDENED_USERCOPY does not need to select BUG
Allows for CONFIG_HARDENED_USERCOPY without CONFIG_BUG. Signed-off-by: Kamal Mostafa --- security/Kconfig | 1 - 1 file changed, 1 deletion(-) diff --git a/security/Kconfig b/security/Kconfig index c430206..7667774 100644 --- a/security/Kconfig +++ b/security/Kconfig @@ -153,7 +153,6 @@ config HAVE_HARDENED_USERCOPY_ALLOCATOR config HARDENED_USERCOPY bool "Harden memory copies between kernel and userspace" depends on HAVE_HARDENED_USERCOPY_ALLOCATOR - select BUG imply STRICT_DEVMEM help This option checks for obviously wrong memory regions when -- 2.7.4
[PATCH] security: CONFIG_HARDENED_USERCOPY does not need to select BUG
Allows for CONFIG_HARDENED_USERCOPY without CONFIG_BUG. Signed-off-by: Kamal Mostafa --- security/Kconfig | 1 - 1 file changed, 1 deletion(-) diff --git a/security/Kconfig b/security/Kconfig index c430206..7667774 100644 --- a/security/Kconfig +++ b/security/Kconfig @@ -153,7 +153,6 @@ config HAVE_HARDENED_USERCOPY_ALLOCATOR config HARDENED_USERCOPY bool "Harden memory copies between kernel and userspace" depends on HAVE_HARDENED_USERCOPY_ALLOCATOR - select BUG imply STRICT_DEVMEM help This option checks for obviously wrong memory regions when -- 2.7.4