lkml.org 
[lkml]   [2018]   [Jan]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [RFC PATCH v2 6/6] x86/entry/pti: don't switch PGD on when pti_disable is set
    On Wed, Jan 10, 2018 at 11:39 AM, Willy Tarreau <w@1wt.eu> wrote:
    > Hi Andy,
    >
    > On Wed, Jan 10, 2018 at 11:21:15AM -0800, Andy Lutomirski wrote:
    >> > If we agree on this, I'd like to propose to have two flags :
    >> >
    >> > - TIF_DISABLE_PTI_NOW : disable PTI for the current task, reset by execve()
    >> > - TIF_DISABLE_PTI_NEXT : disable PTI after execve(), reset by execve()
    >>
    >> I really dislike state that isn't cleared on execve(). I'm assuming
    >> that this is so you can run time pwn_me_without_pti whatever?
    >
    > Yes exactly. I've just sent a 3rd series with an example code for this.
    > In fact it's not that the state is not cleared by execve(), it's that
    > it's set for the next execve() which then resets it.
    >
    >> Surely LD_PRELOAD can do this, too?
    >
    > That was one of my other proposals. I really don't know if LD_PRELOAD
    > fits anyone's usage for such things (static/setuid binaries, complication
    > to pass variables maybe).
    >
    > Please take a look and tell me if you still dislike it or not.
    >

    Adding flags that persist across execve() of setuid stuff is IMO even
    worse. It just makes reasoning about the system's security model
    really nasty.

    \
     
     \ /
      Last update: 2018-01-14 23:22    [W:4.869 / U:0.088 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site