Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH] MIPS: Prevent READ_IMPLIES_EXEC propagation
To:     "Maciej W. Rozycki" <macro@wdc.com>
References: <1594114741-26852-1-git-send-email-yangtiezhu@loongson.cn>
 <alpine.LFD.2.21.2007072043250.31807@redsun52.ssa.fujisawa.hgst.com>
Cc:     Thomas Bogendoerfer <tsbogend@alpha.franken.de>,
        linux-mips@vger.kernel.org, linux-kernel@vger.kernel.org,
        Kees Cook <keescook@chromium.org>,
        Xuefeng Li <lixuefeng@loongson.cn>,
        Juxin Gao <gaojuxin@loongson.cn>,
        "Maciej W. Rozycki" <macro@linux-mips.org>
From:   Tiezhu Yang <yangtiezhu@loongson.cn>
Message-ID: <b62c76c5-3548-c3d5-ad3e-5664c463a52f@loongson.cn>
Date:   Wed, 8 Jul 2020 15:51:24 +0800
User-Agent: Mozilla/5.0 (X11; Linux mips64; rv:45.0) Gecko/20100101
 Thunderbird/45.4.0
MIME-Version: 1.0
In-Reply-To: <alpine.LFD.2.21.2007072043250.31807@redsun52.ssa.fujisawa.hgst.com>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 07/08/2020 03:45 AM, Maciej W. Rozycki wrote:
> On Tue, 7 Jul 2020, Tiezhu Yang wrote:
>
>> In the MIPS architecture, we should clear the security-relevant
>> flag READ_IMPLIES_EXEC in the function SET_PERSONALITY2() of the
>> file arch/mips/include/asm/elf.h.
>>
>> Otherwise, with this flag set, PROT_READ implies PROT_EXEC for
>> mmap to make memory executable that is not safe, because this
>> condition allows an attacker to simply jump to and execute bytes
>> that are considered to be just data [1].
>   Why isn't the arrangement made with `mips_elf_read_implies_exec'
> sufficient?

We inherit the READ_IMPLIES_EXEC personality flag across fork().
If we do not explicitly clear this flag in SET_PERSONALITY2(),
PROT_READ implies PROT_EXEC for mmap to make memory executable
even if used with the GCC option "-z noexecstack" when compile.

By the way, we can see some other reasons in the following commit:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=48f99c8ec0b2

>
>    Maciej