lkml.org 
[lkml]   [2019]   [Feb]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subject[RFC PATCH 0/4] Allow tasks to have their user stack pointer sanity checked
Date
Hi all,

I attended an interesting talk at LCA last month that described some of the
security features deployed in OpenBSD [1]. One hardening feature that piqued
my interest was, on syscall entry and page faults from userspace, checking
that the user stack pointer for a task points at pages that were either
allocated by the kernel for the initial process stack of mapped with mmap()
using the MAP_STACK flag. This acts as a basic defense against stack
pivoting attacks.

The problem with this checking is that it is a retrospective tightening
of the ABI, but that hasn't stopped me hacking it together behind a couple
of prctl() options.

Anyway, it was fun to implement so I figured I'd post it as an RFC.

Will

[1] https://2019.linux.conf.au/schedule/presentation/164/

Cc: Kees Cook <keescook@chromium.org>
Cc: Jann Horn <jannh@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Peter Zijlstra <peterz@infradead.org>

--->8

Will Deacon (4):
mm: Check user stack pointer is mapped with MAP_STACK
mm: Expose user stack pointer checking via prctl()
mm: Add kconfig entries for user stack pointer checking
arm64: Check user stack pointer on syscall entry

arch/arm64/Kconfig | 1 +
arch/arm64/kernel/syscall.c | 4 +++
include/linux/mm.h | 15 +++++++++-
include/linux/mman.h | 3 +-
include/linux/sched.h | 4 +++
include/uapi/linux/prctl.h | 5 ++++
kernel/sys.c | 5 ++++
mm/Kconfig | 17 ++++++++++++
mm/memory.c | 67 +++++++++++++++++++++++++++++++++++++++++++++
9 files changed, 119 insertions(+), 2 deletions(-)

--
2.11.0

\
 
 \ /
  Last update: 2019-02-11 19:00    [W:0.074 / U:9.860 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site