From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A052EC04EBB for ; Wed, 21 Nov 2018 00:33:32 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E712D2147D for ; Wed, 21 Nov 2018 00:33:32 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org E712D2147D Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.intel.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727420AbeKULF0 (ORCPT ); Wed, 21 Nov 2018 06:05:26 -0500 Received: from mga14.intel.com ([192.55.52.115]:30250 "EHLO mga14.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727239AbeKULFY (ORCPT ); Wed, 21 Nov 2018 06:05:24 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga008.jf.intel.com ([10.7.209.65]) by fmsmga103.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 20 Nov 2018 16:33:29 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.56,259,1539673200"; d="scan'208";a="93650236" Received: from skl-02.jf.intel.com ([10.54.74.62]) by orsmga008.jf.intel.com with ESMTP; 20 Nov 2018 16:33:29 -0800 From: Tim Chen To: Jiri Kosina , Thomas Gleixner Cc: Tim Chen , Linus Torvalds , Tom Lendacky , Ingo Molnar , Peter Zijlstra , Josh Poimboeuf , Andrea Arcangeli , David Woodhouse , Andi Kleen , Dave Hansen , Casey Schaufler , Asit Mallick , Arjan van de Ven , Jon Masters , Waiman Long , Greg KH , Dave Stewart , linux-kernel@vger.kernel.org, x86@kernel.org, stable@vger.kernel.org Subject: [Patch v6 13/16] security: Update speculation restriction of a process when modifying its dumpability Date: Tue, 20 Nov 2018 16:00:05 -0800 Message-Id: X-Mailer: git-send-email 2.9.4 In-Reply-To: References: In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When a task is made non-dumpable, a higher level of security is implied implicitly as its memory is imposed with access restriction. Many daemons touching sensitive data (e.g. sshd) make theselves non-dumpable. Such tasks should have speculative execution restricted to protect them from attacks taking advantage of CPU speculation side channels. Add calls to arch_update_spec_restiction() to put speculative restriction on a task when changing its dumpability. Restrict speculative execution on a non-dumpable task and relax the restrictions on a dumpable task. A change to dumpability occurs via setgid, setuid, or prctl(SUID_SET_DUMPABLE) syscalls. The user should expect associated change in speculative restriction occurs only on the task that issued such syscall. Speculative restriction changes are not extended to other threads in the same process. This should not be a problem as such changes should be made before spawning additional threads. Signed-off-by: Tim Chen --- fs/exec.c | 3 +++ include/linux/cpu.h | 3 +++ kernel/cpu.c | 5 +++++ kernel/cred.c | 5 ++++- kernel/sys.c | 7 +++++++ 5 files changed, 22 insertions(+), 1 deletion(-) diff --git a/fs/exec.c b/fs/exec.c index fc281b7..d72e20d 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -62,6 +62,7 @@ #include #include #include +#include #include #include @@ -1366,6 +1367,8 @@ void setup_new_exec(struct linux_binprm * bprm) else set_dumpable(current->mm, SUID_DUMP_USER); + arch_update_spec_restriction(current); + arch_setup_new_exec(); perf_event_exec(); __set_task_comm(current, kbasename(bprm->filename), true); diff --git a/include/linux/cpu.h b/include/linux/cpu.h index 6f43024..4fef90a 100644 --- a/include/linux/cpu.h +++ b/include/linux/cpu.h @@ -187,4 +187,7 @@ static inline void cpu_smt_check_topology(void) { } DECLARE_STATIC_KEY_TRUE(cpu_smt_enabled); #endif +/* Update CPU's speculation restrictions on a task based on task's properties */ +extern int arch_update_spec_restriction(struct task_struct *task); + #endif /* _LINUX_CPU_H_ */ diff --git a/kernel/cpu.c b/kernel/cpu.c index f846416..fe93a8a 100644 --- a/kernel/cpu.c +++ b/kernel/cpu.c @@ -2291,6 +2291,11 @@ void init_cpu_online(const struct cpumask *src) cpumask_copy(&__cpu_online_mask, src); } +int __weak arch_update_spec_restriction(struct task_struct *task) +{ + return 0; +} + /* * Activate the first processor. */ diff --git a/kernel/cred.c b/kernel/cred.c index ecf0365..bc47653 100644 --- a/kernel/cred.c +++ b/kernel/cred.c @@ -19,6 +19,7 @@ #include #include #include +#include #if 0 #define kdebug(FMT, ...) \ @@ -445,8 +446,10 @@ int commit_creds(struct cred *new) !uid_eq(old->fsuid, new->fsuid) || !gid_eq(old->fsgid, new->fsgid) || !cred_cap_issubset(old, new)) { - if (task->mm) + if (task->mm) { set_dumpable(task->mm, suid_dumpable); + arch_update_spec_restriction(task); + } task->pdeath_signal = 0; smp_wmb(); } diff --git a/kernel/sys.c b/kernel/sys.c index 123bd73..621ea94 100644 --- a/kernel/sys.c +++ b/kernel/sys.c @@ -2290,6 +2290,13 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3, break; } set_dumpable(me->mm, arg2); + /* + * Any speculative execution restriction updates + * associated with change in dumpability + * applies only to the current task that issues + * the request. + */ + arch_update_spec_restriction(me); break; case PR_SET_UNALIGN: -- 2.9.4