Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Content-Type: text/plain;
        charset=utf-8
Mime-Version: 1.0 (1.0)
Subject: Re: [RFC PATCH 2/7] x86/sci: add core implementation for system call isolation
From:   Andy Lutomirski <luto@amacapital.net>
In-Reply-To: <1556290658.2833.28.camel@HansenPartnership.com>
Date:   Fri, 26 Apr 2019 08:07:27 -0700
Cc:     Dave Hansen <dave.hansen@intel.com>,
        Mike Rapoport <rppt@linux.ibm.com>,
        linux-kernel@vger.kernel.org,
        Alexandre Chartre <alexandre.chartre@oracle.com>,
        Andy Lutomirski <luto@kernel.org>,
        Borislav Petkov <bp@alien8.de>,
        Dave Hansen <dave.hansen@linux.intel.com>,
        "H. Peter Anvin" <hpa@zytor.com>, Ingo Molnar <mingo@redhat.com>,
        Jonathan Adams <jwadams@google.com>,
        Kees Cook <keescook@chromium.org>,
        Paul Turner <pjt@google.com>,
        Peter Zijlstra <peterz@infradead.org>,
        Thomas Gleixner <tglx@linutronix.de>, linux-mm@kvack.org,
        linux-security-module@vger.kernel.org, x86@kernel.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <54090243-E4C7-4C66-8025-AFE0DF5DF337@amacapital.net>
References: <1556228754-12996-1-git-send-email-rppt@linux.ibm.com> <1556228754-12996-3-git-send-email-rppt@linux.ibm.com> <627d9321-466f-c4ed-c658-6b8567648dc6@intel.com> <1556290658.2833.28.camel@HansenPartnership.com>
To:     James Bottomley <James.Bottomley@hansenpartnership.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


> On Apr 26, 2019, at 7:57 AM, James Bottomley <James.Bottomley@hansenpartne=
rship.com> wrote:
>=20
>> On Fri, 2019-04-26 at 07:46 -0700, Dave Hansen wrote:
>>> On 4/25/19 2:45 PM, Mike Rapoport wrote:
>>> After the isolated system call finishes, the mappings created
>>> during its execution are cleared.
>>=20
>> Yikes.  I guess that stops someone from calling write() a bunch of
>> times on every filesystem using every block device driver and all the
>> DM code to get a lot of code/data faulted in.  But, it also means not
>> even long-running processes will ever have a chance of behaving
>> anything close to normally.
>>=20
>> Is this something you think can be rectified or is there something
>> fundamental that would keep SCI page tables from being cached across
>> different invocations of the same syscall?
>=20
> There is some work being done to look at pre-populating the isolated
> address space with the expected execution footprint of the system call,
> yes.  It lessens the ROP gadget protection slightly because you might
> find a gadget in the pre-populated code, but it solves a lot of the
> overhead problem.
>=20

I=E2=80=99m not even remotely a ROP expert, but: what stops a ROP payload fr=
om using all the =E2=80=9Cfault-in=E2=80=9D gadgets that exist =E2=80=94 any=
 function that can return on an error without doing to much will fault in th=
e whole page containing the function.

To improve this, we would want some thing that would try to check whether th=
e caller is actually supposed to call the callee, which is more or less the h=
ard part of CFI.  So can=E2=80=99t we just do CFI and call it a day?

On top of that, a robust, maintainable implementation of this thing seems ve=
ry complicated =E2=80=94 for example, what happens if vfree() gets called?