I just noticed that trinity was freaking out in places when mmap was
returning zero. This surprised me, because I had the mmap_min_addr
sysctl set to 64k, so it wasn't a MAP_FIXED mapping that did it.
There's no mention of this return value in the man page, so I dug
into the kernel code, and it appears that we do..
sys_mmap
vm_mmap_pgoff
security_mmap_file
ima_file_mmap <- returns 0 if not PROT_EXEC
and then the 0 gets propagated up as a retval all the way to userspace.
It smells to me like we might be violating a standard or two here, and
instead of 0 ima should be returning -Esomething
thoughts?
Dave
On 06/05/2014 01:31 AM, Dave Jones wrote:
> I just noticed that trinity was freaking out in places when mmap was
> returning zero. This surprised me, because I had the mmap_min_addr
> sysctl set to 64k, so it wasn't a MAP_FIXED mapping that did it.
>
> There's no mention of this return value in the man page, so I dug
> into the kernel code, and it appears that we do..
>
> sys_mmap
> vm_mmap_pgoff
> security_mmap_file
> ima_file_mmap <- returns 0 if not PROT_EXEC
>
> and then the 0 gets propagated up as a retval all the way to userspace.
>
> It smells to me like we might be violating a standard or two here, and
> instead of 0 ima should be returning -Esomething
>
> thoughts?
Seems like either EACCESS or ENOTSUP is appropriate; here's the pieces
from POSIX:
EACCES The fildes argument is not open for read, regardless of
the protection specified, or fildes is not open for
write and PROT_WRITE was specified for a MAP_SHARED type
mapping.
ENOTSUP
The implementation does not support the combination
of accesses requested in the prot argument.
ENOTSUP seems to be more appropriate in my reading of the above, though
I'd somehow more have expected EACCES.
Cheers,
Michael
--
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/
On Thu, Jun 05, 2014 at 06:40:36AM +0200, Michael Kerrisk (man-pages) wrote:
> On 06/05/2014 01:31 AM, Dave Jones wrote:
> > I just noticed that trinity was freaking out in places when mmap was
> > returning zero. This surprised me, because I had the mmap_min_addr
> > sysctl set to 64k, so it wasn't a MAP_FIXED mapping that did it.
> >
> > There's no mention of this return value in the man page, so I dug
> > into the kernel code, and it appears that we do..
> >
> > sys_mmap
> > vm_mmap_pgoff
> > security_mmap_file
> > ima_file_mmap <- returns 0 if not PROT_EXEC
> >
> > and then the 0 gets propagated up as a retval all the way to userspace.
> >
> > It smells to me like we might be violating a standard or two here, and
> > instead of 0 ima should be returning -Esomething
> >
> > thoughts?
>
> Seems like either EACCESS or ENOTSUP is appropriate; here's the pieces
> from POSIX:
>
> EACCES The fildes argument is not open for read, regardless of
> the protection specified, or fildes is not open for
> write and PROT_WRITE was specified for a MAP_SHARED type
> mapping.
>
> ENOTSUP
> The implementation does not support the combination
> of accesses requested in the prot argument.
>
> ENOTSUP seems to be more appropriate in my reading of the above, though
> I'd somehow more have expected EACCES.
I just realised that this affects even kernels with CONFIG_IMA unset,
because there we just do 'return 0' unconditionally.
Also, it appears that kernels with CONFIG_SECURITY unset will also
return a zero for the same reason.
This is kind of a mess, and has been that way for a long time.
Fixing this will require user-visible breakage, but in this case
I think it's justified as there's no way an app can do the right thing
if it gets a 0 back. Linus ?
Dave
On Thu, Jun 05, 2014 at 11:56:58AM -0400, Dave Jones wrote:
> On Thu, Jun 05, 2014 at 06:40:36AM +0200, Michael Kerrisk (man-pages) wrote:
> > On 06/05/2014 01:31 AM, Dave Jones wrote:
> > > I just noticed that trinity was freaking out in places when mmap was
> > > returning zero. This surprised me, because I had the mmap_min_addr
> > > sysctl set to 64k, so it wasn't a MAP_FIXED mapping that did it.
> > >
> > > There's no mention of this return value in the man page, so I dug
> > > into the kernel code, and it appears that we do..
> > >
> > > sys_mmap
> > > vm_mmap_pgoff
> > > security_mmap_file
> > > ima_file_mmap <- returns 0 if not PROT_EXEC
> > >
> > > and then the 0 gets propagated up as a retval all the way to userspace.
>
> I just realised that this affects even kernels with CONFIG_IMA unset,
> because there we just do 'return 0' unconditionally.
>
> Also, it appears that kernels with CONFIG_SECURITY unset will also
> return a zero for the same reason.
Hang on, I was misreading that whole security_mmap_file ret handling code.
There's something else at work here. I'll dig and get a reproducer.
Dave
On Thu, 2014-06-05 at 12:20 -0400, Dave Jones wrote:
> On Thu, Jun 05, 2014 at 11:56:58AM -0400, Dave Jones wrote:
> > On Thu, Jun 05, 2014 at 06:40:36AM +0200, Michael Kerrisk (man-pages) wrote:
> > > On 06/05/2014 01:31 AM, Dave Jones wrote:
> > > > I just noticed that trinity was freaking out in places when mmap was
> > > > returning zero. This surprised me, because I had the mmap_min_addr
> > > > sysctl set to 64k, so it wasn't a MAP_FIXED mapping that did it.
> > > >
> > > > There's no mention of this return value in the man page, so I dug
> > > > into the kernel code, and it appears that we do..
> > > >
> > > > sys_mmap
> > > > vm_mmap_pgoff
> > > > security_mmap_file
> > > > ima_file_mmap <- returns 0 if not PROT_EXEC
> > > >
> > > > and then the 0 gets propagated up as a retval all the way to userspace.
> >
> > I just realised that this affects even kernels with CONFIG_IMA unset,
> > because there we just do 'return 0' unconditionally.
> >
> > Also, it appears that kernels with CONFIG_SECURITY unset will also
> > return a zero for the same reason.
>
> Hang on, I was misreading that whole security_mmap_file ret handling code.
> There's something else at work here. I'll dig and get a reproducer.
According to security.h, it should return 0 if permission is granted.
If IMA is not enabled, it should also return 0. What exactly is the
problem?
thanks,
Mimi
On Thu, Jun 05, 2014 at 09:49:29PM -0400, Mimi Zohar wrote:
> > > > > There's no mention of this return value in the man page, so I dug
> > > > > into the kernel code, and it appears that we do..
> > > > >
> > > > > sys_mmap
> > > > > vm_mmap_pgoff
> > > > > security_mmap_file
> > > > > ima_file_mmap <- returns 0 if not PROT_EXEC
> > > > >
> > > > > and then the 0 gets propagated up as a retval all the way to userspace.
> > >
> > > I just realised that this affects even kernels with CONFIG_IMA unset,
> > > because there we just do 'return 0' unconditionally.
> > >
> > > Also, it appears that kernels with CONFIG_SECURITY unset will also
> > > return a zero for the same reason.
> >
> > Hang on, I was misreading that whole security_mmap_file ret handling code.
> > There's something else at work here. I'll dig and get a reproducer.
>
> According to security.h, it should return 0 if permission is granted.
> If IMA is not enabled, it should also return 0. What exactly is the
> problem?
Still digging. I managed to get this to reproduce constantly last night,
but no luck today. From re-reading the code though, I think IMA/lsm isn't
the problem.
Dave