lkml.org 
[lkml]   [2015]   [Mar]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [RFC][PATCH 1/2] fs proc: make pagemap a privileged interface
On 03/12/2015 03:35 PM, Andrew Morton wrote:
> On Mon, 09 Mar 2015 13:43:21 -0700 Dave Hansen <dave@sr71.net> wrote:
>> From: Dave Hansen <dave.hansen@linux.intel.com>
>>
>> Physical addresses are sensitive information. There are
>> existing, known exploits that are made easier if physical
>> information is available. Here is one example:
>>
>> http://www.cs.columbia.edu/~vpk/papers/ret2dir.sec14.pdf
> Do we really need to disable pagemap entirely? What happens if we just
> obscure the addresses (ie: zero them)?

I think we have 3 basic options:

1. Disable it entirely (-EPERM or whatever). Apps using it break
quickly and fairly obviously (diagnosable with an strace)
2. Zero it, or return some nonsensical thing for the physical address
portion, but maintain exporting the PTE flags. Apps only caring
about PTE flags work, but anything trying to do lookups in
/proc/kpageflags break. If we zero it, apps pay get confused
thinking they have the _actual_ pfn=0.
3. Scramble it in some way obscuring the physical address. Unscramble
it upon access to /proc/kpageflags.

I think you're suggesting (2). Doesn't that risk silently breaking apps?

>> pagemap is also the kind of feature that could be used to escalate
>> privileged from root in to the kernel. It probably needs to be
>> protected in the same way that /dev/mem or module loading is in
>> cases where the kernel needs to be protected from root, thus the
>> choice to use CAP_SYS_RAWIO.
>
> Confused. If you have root, you can do mount -o notparanoid.

Good point. I guess it doesn't protect us much here unless we also
restrict the ability to remount.


\
 
 \ /
  Last update: 2015-03-13 17:21    [W:0.032 / U:0.492 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site