From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1754785AbbGYGpQ (ORCPT <rfc822;w@1wt.eu>);
	Sat, 25 Jul 2015 02:45:16 -0400
Received: from mail-lb0-f171.google.com ([209.85.217.171]:36401 "EHLO
	mail-lb0-f171.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1751513AbbGYGpO (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Sat, 25 Jul 2015 02:45:14 -0400
MIME-Version: 1.0
In-Reply-To: <20150725062343.GA3902@1wt.eu>
References: <cover.1437802102.git.luto@kernel.org> <7286d77aa81abc38dc40362e2439861427064f6f.1437802102.git.luto@kernel.org>
 <20150725062343.GA3902@1wt.eu>
From: Andy Lutomirski <luto@amacapital.net>
Date: Fri, 24 Jul 2015 23:44:52 -0700
Message-ID: <CALCETrX0ExTFXVdNthwBRheg4vsffPThVuyn7uAcj_TGwpXgiA@mail.gmail.com>
Subject: Re: [PATCH v4 2/3] x86/ldt: Make modify_ldt optional
To: Willy Tarreau <w@1wt.eu>
Cc: Andy Lutomirski <luto@kernel.org>, Peter Zijlstra <peterz@infradead.org>,
        Steven Rostedt <rostedt@goodmis.org>,
        "security@kernel.org" <security@kernel.org>, X86 ML <x86@kernel.org>,
        Borislav Petkov <bp@alien8.de>, Sasha Levin <sasha.levin@oracle.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>,
        Boris Ostrovsky <boris.ostrovsky@oracle.com>,
        Andrew Cooper <andrew.cooper3@citrix.com>,
        Jan Beulich <jbeulich@suse.com>, xen-devel <xen-devel@lists.xen.org>
Content-Type: text/plain; charset=UTF-8
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri, Jul 24, 2015 at 11:23 PM, Willy Tarreau <w@1wt.eu> wrote:
> On Fri, Jul 24, 2015 at 10:36:45PM -0700, Andy Lutomirski wrote:
>> The modify_ldt syscall exposes a large attack surface and is
>> unnecessary for modern userspace.  Make it optional.
>
> Andy, you didn't respond whether you think it wouldn't be better to make
> it runtime-configurable instead. The goal here is to ensure distros
> ship with modify_ldt disabled by default. But if it means breaking
> compatibility with (rare) existing applications, I'm seeing a risk
> that they'll ship with it enabled instead, which would make the config
> option useless. The CONFIG_DEFAULT_MMAP_ADDR was a good example of
> successful deployment of a hardening measure that has been widely
> adopted despite its (low) risk of breakage in field because it was
> adjustable in field.

I'm all for it, but I think it should be hard-disablable in config,
too, for the -tiny people.  If we add a runtime disable, let's do a
separate patch, and you and Kees can fight over how general it should
be.

>
> That's why here I think we should do the same, and possibly even
> emit a warning once to report the first user of modify_ldt if that
> can help.
>
> What do you think ?

I'm generally in favor.

On the other hand, the current series is already written, might even
be compatible with Xen, and patch 1 at least fixes a real bug.  Maybe
several real bugs.

--Andy