Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753735AbcKIBJN (ORCPT ); Tue, 8 Nov 2016 20:09:13 -0500 Received: from relay3-d.mail.gandi.net ([217.70.183.195]:33741 "EHLO relay3-d.mail.gandi.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751176AbcKIBJL (ORCPT ); Tue, 8 Nov 2016 20:09:11 -0500 User-Agent: K-9 Mail for Android In-Reply-To: References: <20161109004757.lpbpsdgyzvld7ute@x> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Subject: Re: [PATCH 2/2] kernel: Support compiling out the prctl syscall From: Josh Triplett Date: Tue, 08 Nov 2016 17:08:54 -0800 To: Kees Cook CC: Andrew Morton , Johannes Weiner , Arnd Bergmann , Ingo Molnar , Andy Lutomirski , Petr Mladek , Thomas Garnier , Ard Biesheuvel , Nicolas Pitre , Zefan Li , Li Bin , "Eric W. Biederman" , Dmitry Vyukov , Ralf Baechle , Alex Thorlton , Michal Hocko , Mateusz Guzik , Cyrill Gorcunov , John Stultz , Al Viro , Zach Brown , Anna Schumaker , Dave Hansen , LKML , Linux API Message-ID: <30B99B06-5CA3-4139-B092-76158A8E7A5A@joshtriplett.org> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2455 Lines: 61 On November 8, 2016 4:56:54 PM PST, Kees Cook wrote: >On Tue, Nov 8, 2016 at 4:47 PM, Josh Triplett >wrote: >> On Tue, Nov 08, 2016 at 04:40:02PM -0800, Kees Cook wrote: >>> On Tue, Nov 8, 2016 at 4:18 PM, Josh Triplett > wrote: >>> > Some embedded systems can do without the prctl syscall, saving >some >>> > space. >>> > >>> > This also avoids regular increases in tinyconfig size as people >add more >>> > non-optional functionality to prctl (observed via the 0-day kernel >>> > infrastructure). >>> > >>> > bloat-o-meter results: >>> > >>> > add/remove: 0/3 grow/shrink: 0/1 up/down: 0/-2143 (-2143) >>> > function old new delta >>> > offsets 23 12 -11 >>> > prctl_set_auxv 97 - -97 >>> > sys_prctl 794 - -794 >>> > prctl_set_mm 1241 - -1241 >>> > Total: Before=1902583, After=1900440, chg -0.11% >>> > >>> > Signed-off-by: Josh Triplett >>> >>> I'm absolutely a fan of doing this, but I wonder how this interacts >>> with the LSMs that define prctl hooks, etc. I wouldn't expect a >system >>> that didn't want prctl to want an LSM, but maybe the LSMs all need >to >>> depend on CONFIG_PRCTL now? >> >> I did think about that (as well as SECCOMP), but I did confirm that >the >> kernel builds fine with allyesconfig minus CONFIG_PRCTL. An LSM that >> wants to restrict access to some prctls should be fine with no >process >> having any access to prctl. :) Beyond that, anything wanting >> configuration via LSM (such as SECCOMP) still exists and functions, >even >> if you can't access it from outside the kernel. > >Okay, testing that is good, thanks. > >Seccomp can use the seccomp() syscall, so missing prctl isn't a big >deal there. > >Things like Yama, though, are almost useless in the !PRCTL case. I >think a "depends on PRCTL" should be added at least to Yama. All the >other LSMs are configured in other ways, and they'll just have some >dead code around their prctl hooks; no big deal. OK, I'll add that dependency to Yama in v2. >This does also beg the question about how to configure some process >behaviors by default if PRCTL is disabled, but if people want those >things, they can write patches, I would think. :) Agreed.