From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1755912AbbCRLlJ (ORCPT <rfc822;w@1wt.eu>);
	Wed, 18 Mar 2015 07:41:09 -0400
Received: from forward-corp1f.mail.yandex.net ([95.108.130.40]:49532 "EHLO
	forward-corp1f.mail.yandex.net" rhost-flags-OK-OK-OK-OK)
	by vger.kernel.org with ESMTP id S1754471AbbCRLlG (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Wed, 18 Mar 2015 07:41:06 -0400
Authentication-Results: smtpcorp1m.mail.yandex.net; dkim=pass header.i=@yandex-team.ru
Message-ID: <5509644C.40502@yandex-team.ru>
Date: Wed, 18 Mar 2015 14:41:00 +0300
From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.5.0
MIME-Version: 1.0
To: "Kirill A. Shutemov" <kirill@shutemov.name>,
        Konstantin Khlebnikov <koct9i@gmail.com>
CC: linux-mm@kvack.org, linux-kernel@vger.kernel.org,
        "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
        Andrew Morton <akpm@linux-foundation.org>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Andy Lutomirski <luto@amacapital.net>
Subject: Re: [PATCH RFC] mm: protect suid binaries against rowhammer with
 copy-on-read mappings
References: <20150318083040.7838.76933.stgit@zurg> <20150318095702.GA2479@node.dhcp.inet.fi>
In-Reply-To: <20150318095702.GA2479@node.dhcp.inet.fi>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 18.03.2015 12:57, Kirill A. Shutemov wrote:
> On Wed, Mar 18, 2015 at 11:30:40AM +0300, Konstantin Khlebnikov wrote:
>> From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
>>
>> Each user gets private copy of the code thus nobody will be able to exploit
>> pages in the page cache. This works for statically-linked binaries. Shared
>> libraries are still vulnerable, but setting suid bit will protect them too.
>
> Hm. Do we have suid/sgid semantic defiend for non-executables?
>
> To me we should do this for all file private mappings of the suid process
> or don't do it at all.

Yeah, this patch doesn't provide full protection.
That's just a proof-of-concept.

>
> And what about forked suid process which dropped privilages. We still have
> code pages shared.

User can get access to that private copy later but new suid
applications will get their own copy at exec.
Original page-cache pages are never exposed in pte.

>
> I don't think it worth it. The only right way to fix the problem is ECC
> memory.
>

ECC seems good protection until somebody figure out how to break it too.