Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754124AbbGXHs5 (ORCPT ); Fri, 24 Jul 2015 03:48:57 -0400 Received: from wtarreau.pck.nerim.net ([62.212.114.60]:8143 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753459AbbGXHsw (ORCPT ); Fri, 24 Jul 2015 03:48:52 -0400 Date: Fri, 24 Jul 2015 09:48:01 +0200 From: Willy Tarreau To: Kees Cook Cc: Andy Lutomirski , Andy Lutomirski , Peter Zijlstra , Steven Rostedt , "security@kernel.org" , X86 ML , Borislav Petkov , Sasha Levin , LKML , Konrad Rzeszutek Wilk , Boris Ostrovsky , Andrew Cooper , Jan Beulich , xen-devel Subject: Re: [PATCH v3 2/3] x86/ldt: Make modify_ldt optional Message-ID: <20150724074801.GA3396@1wt.eu> References: <7bfde005b84a90a83bf668a320c7d4ad1b940065.1437592883.git.luto@kernel.org> <20150723102434.GA2929@1wt.eu> <20150723235805.GA3191@1wt.eu> <20150724072451.GB3293@1wt.eu> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20150724072451.GB3293@1wt.eu> User-Agent: Mutt/1.4.2.3i Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2432 Lines: 46 On Fri, Jul 24, 2015 at 09:24:51AM +0200, Willy Tarreau wrote: > On Thu, Jul 23, 2015 at 05:09:21PM -0700, Kees Cook wrote: > > > All this to say that probably only a handful of tricky syscalls would > > > need an on/off switch but clearly not all of them at all, so I'd rather > > > add a few entries just for the relevant ones, mainly to fix compatibility > > > issues and nothing more. Eg: what's the point of disabling exit(), wait(), > > > kill(), fork() or getpid()... It would only increase the difficulty to > > > sort out bug reports. > > > > > > Just my opinion, > > > > Well, I would really like to have something like this around so that I > > can trivially globally disable syscalls when they have security risks. > > I understand, but while maybe it could make sense to have the option on > any linux-specific syscall, having it on the standard, portable ones > will be useless as disabling them will break most applications. > > > My hack[1] to disable kexec_load, for example, was terrible while I > > waited for a kernel that supported the disable_kexec_load sysctl. > > This typically is one linux-specific syscall which no regular application > would rely on and which can come with side effects. I think there are not > *that* many, none of them is performance-critical, and they'd rather be > dealt with one at a time. Looking at syscall_64.tbl, I'm seeing that the first ~133 syscalls have no reason for being disabled if we don't want to break portable applications, with the exception of ptrace I guess. Past this, things like uselib, personality, sysfs, prctl etc... could be disabled. There are still some exceptions in this area but I don't see them as critical if someone would accidently disable them (eg: getpriority, mlock, ...). Others like chroot, setrlimit, adjtimex, settimeofday, mount, umount, time need to be kept. And a few ones like sync or sethostname would be nice to have optional in order to lock down a system at boot. Many of the other ones are ns-specific versions of the first ones (*at) and would rather not being made optional either. I think maybe we can find between 10 and 30 that would make sense to optionally disable. Willy -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/