From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756108AbbCLWfg (ORCPT ); Thu, 12 Mar 2015 18:35:36 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:45036 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752845AbbCLWfe (ORCPT ); Thu, 12 Mar 2015 18:35:34 -0400 Date: Thu, 12 Mar 2015 15:35:33 -0700 From: Andrew Morton To: Dave Hansen Cc: "Eric W. Biederman" , Kees Cook , tytso@mit.edu, Oleg Nesterov , linux-kernel@vger.kernel.org, dave.hansen@linux.intel.com Subject: Re: [RFC][PATCH 1/2] fs proc: make pagemap a privileged interface Message-Id: <20150312153533.d1c6083e4a9e7825b1a4bc64@linux-foundation.org> In-Reply-To: <20150309204321.AAF412E0@viggo.jf.intel.com> References: <20150309204321.AAF412E0@viggo.jf.intel.com> X-Mailer: Sylpheed 3.4.1 (GTK+ 2.24.23; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 09 Mar 2015 13:43:21 -0700 Dave Hansen wrote: > > From: Dave Hansen > > Physical addresses are sensitive information. There are > existing, known exploits that are made easier if physical > information is available. Here is one example: > > http://www.cs.columbia.edu/~vpk/papers/ret2dir.sec14.pdf > > If you know the physical address of something you also know at > which kernel virtual address you can find something (modulo > highmem). It means that things that keep the kernel from > accessing user mappings (like SMAP/SMEP) can be worked around > because the _kernel_ mapping can get used instead. > > But, /proc/$pid/pagemap exposes the physical addresses of all > pages accessible to userspace. This works against all of the > efforts to keep kernel addresses out of places where unprivileged > apps can find them. > > This patch introduces a "paranoid" option for /proc. It can be > enabled like this: > > mount -o remount,paranoid /proc > > Or when /proc is mounted initially. When 'paranoid' mode is > active, opens to /proc/$pid/pagemap will return -EPERM for users > without CAP_SYS_RAWIO. It can be disabled like this: > > mount -o remount,notparanoid /proc > > The option is applied to the pid namespace, so an app that wanted > a separate policy from the rest of the system could get run in > its own pid namespace. > > I'm not really that stuck on the name. I'm not opposed to making > it apply only to pagemap or to giving it a pagemap-specific > name. Do we really need to disable pagemap entirely? What happens if we just obscure the addresses (ie: zero them)? > pagemap is also the kind of feature that could be used to escalate > privileged from root in to the kernel. It probably needs to be > protected in the same way that /dev/mem or module loading is in > cases where the kernel needs to be protected from root, thus the > choice to use CAP_SYS_RAWIO. Confused. If you have root, you can do mount -o notparanoid.