From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756965AbdCXPZE (ORCPT ); Fri, 24 Mar 2017 11:25:04 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:47282 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S936366AbdCXPYo (ORCPT ); Fri, 24 Mar 2017 11:24:44 -0400 Subject: Re: [PATCH] lkdtm: add bad USER_DS test To: Thomas Garnier , Heiko Carstens References: <20170323203419.GA62859@beast> <20170324081450.GA5891@osiris> Cc: Kees Cook , Martin Schwidefsky , David Howells , Arnd Bergmann , Dave Hansen , Al Viro , Thomas Gleixner , =?UTF-8?Q?Ren=c3=a9_Nyffenegger?= , Andrew Morton , "Paul E . McKenney" , Ingo Molnar , Oleg Nesterov , Pavel Tikhomirov , Stephen Smalley , Ingo Molnar , "H . Peter Anvin" , Andy Lutomirski , Paolo Bonzini , Rik van Riel , Josh Poimboeuf , Borislav Petkov , Brian Gerst , "Kirill A . Shutemov" , Russell King , Will Deacon , Catalin Marinas , Mark Rutland , James Morse , "linux-s390@vger.kernel.org" , LKML , Linux API , "x86@kernel.org" , "linux-arm-kernel@lists.infradead.org" , "kernel-hardening@lists.openwall.com" From: Christian Borntraeger Date: Fri, 24 Mar 2017 16:24:28 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-TM-AS-GCONF: 00 x-cbid: 17032415-0052-0000-0000-000001B7617A X-IBM-SpamModules-Scores: X-IBM-SpamModules-Versions: BY=3.00006841; HX=3.00000240; KW=3.00000007; PH=3.00000004; SC=3.00000206; SDB=6.00838300; UDB=6.00412211; IPR=6.00616063; BA=6.00005234; NDR=6.00000001; ZLA=6.00000005; ZF=6.00000009; ZB=6.00000000; ZP=6.00000000; ZH=6.00000000; ZU=6.00000002; MB=3.00014795; XFM=3.00000013; UTC=2017-03-24 15:24:41 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17032415-0053-0000-0000-00004F674E91 Message-Id: X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-03-24_14:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703240133 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 03/24/2017 04:17 PM, Thomas Garnier wrote: > On Fri, Mar 24, 2017 at 1:14 AM, Heiko Carstens > wrote: >> On Thu, Mar 23, 2017 at 01:34:19PM -0700, Kees Cook wrote: >>> This adds CORRUPT_USER_DS to check that the get_fs() test on syscall return >>> still sees USER_DS during the new VERIFY_PRE_USERMODE_STATE checks. >>> >>> Signed-off-by: Kees Cook >> >> ... >> >>> +void lkdtm_CORRUPT_USER_DS(void) >>> +{ >>> + /* >>> + * Test that USER_DS has been set correctly on exiting a syscall. >>> + * Since setting this higher than USER_DS (TASK_SIZE) would introduce >>> + * an exploitable condition, we lower it instead, since that should >>> + * not create as large a problem on an unprotected system. >>> + */ >>> + mm_segment_t lowfs; >>> +#ifdef MAKE_MM_SEG >>> + lowfs = MAKE_MM_SEG(TASK_SIZE - PAGE_SIZE); >>> +#else >>> + lowfs = TASK_SIZE - PAGE_SIZE; >>> +#endif >>> + >>> + pr_info("setting bad task size limit\n"); >>> + set_fs(lowfs); >>> +} >> >> This won't work on architectures where the set_fs() argument does not >> contain an address but an address space identifier. This is true e.g. for >> s390 and as far as I know also for sparc. >> On s390 we have complete distinct address spaces for kernel and user space >> that each start at address zero. >> > > The patch that enforce USER_DS is disabled on s390 anyway. I guess, we > can just do a set_fs(KERNEL_DS) for the others. that would enable the test, but it would also mean that lkdtm can be used by a program to escalate its rights. I think that is the reason why Kees did this lowfs things.