Received: by 2002:a05:6a10:22f:0:0:0:0 with SMTP id 15csp1359429pxk; Thu, 10 Sep 2020 13:27:25 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxQGAfxO5cVeS3FZQckUS5mhXJ6Ol8pKWL0zhTrrE1inf2yGjw7NVmE+2oATxK83zNzDV90 X-Received: by 2002:a17:906:a101:: with SMTP id t1mr10436582ejy.203.1599769644902; Thu, 10 Sep 2020 13:27:24 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1599769644; cv=none; d=google.com; s=arc-20160816; b=mspgRYW67Wcrum0rJdkCcEcM+pE8A2ginrfwXDtTBBLyMZx7g/GQ45pnFZNM50VgHl cSRaI2VYIbKIdCclUHtbOB2RxTKRfbjiF8eY5dmnN0viBBsRJp0lUYHr4PqiCPPuhOh7 NNUnY3HARFb9bKbmAcD++skOsu9YM4tt8uD9PrFQEa+rNjMBDXRF/wjejAGjd+sP4IGJ 17+rlhNtAT/J3H/ml5mq303YnOYt4PJF1RcRfgsBR7EtbeP0FJDGKrH8OgA5h09wQP5U QRhdy9EFNzlksFD0hgtsG6d7WXLHBhfBTxXlpHmiSx1BCvKaWBm/YX8+H2MRSXZREPPw v6QQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=wJZHFZKfNNyC67jwisOmBZgnX1BFNcIrFx6Hk0CVZj0=; b=pCFs4o8LX7X4tUHmypQHfxjYf1dSlysP9PhM5SNgB88g/QleqI6hlMomW5v8D1FsBl 0I1Opfy5LhXQh5EZFFM1Guey71an3Ie/tCosKFWnjX16y1lA7/lGknfH/LMnEsFsZVGN m96h0e6JwXY1Xugx5qAljkHISP6is4IJDvNdglmit2OGM1JJbXZQUi+/y9/wkQrz6znj 8M1yN9BJSLKZUgnQWKXtn7JLdDDtpWxiEAbx6mWhMGqDKq4TN4Dq5A1GpF9Mr/yUUdE4 8XMg++4h1R8EY6LpfEyBWIL43sLgGX/BL54DGWV1U73X4NuX4wXeJE0K0/Fp1lNG8mwv 1WyA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=BA7gUYJD; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id z9si4326158edp.477.2020.09.10.13.27.01; Thu, 10 Sep 2020 13:27:24 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=BA7gUYJD; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726899AbgIJU0O (ORCPT + 99 others); Thu, 10 Sep 2020 16:26:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54842 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726979AbgIJUVu (ORCPT ); Thu, 10 Sep 2020 16:21:50 -0400 Received: from mail-pg1-x543.google.com (mail-pg1-x543.google.com [IPv6:2607:f8b0:4864:20::543]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7C93FC0617A4 for ; Thu, 10 Sep 2020 13:21:21 -0700 (PDT) Received: by mail-pg1-x543.google.com with SMTP id l191so4905164pgd.5 for ; Thu, 10 Sep 2020 13:21:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=wJZHFZKfNNyC67jwisOmBZgnX1BFNcIrFx6Hk0CVZj0=; b=BA7gUYJDUrV86/gK5hnjBVttT9NwmYMFnA1+ImWoiBLcN5oOXU8QthOaJfPt9gc2ug B5tOcCRa23Jdbs1ij+K+aQKZUmgVALJupA7J8lhiEDDLKiF7mOFMbBz14LJWznBzsC5z XqB2DX5w0vVnuDESFdM8sqC7YdTMb8v+p7xZM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=wJZHFZKfNNyC67jwisOmBZgnX1BFNcIrFx6Hk0CVZj0=; b=nMMtK2a4vh4WnxsmzNiOjwm6MyNj9Sp0BMZlRognUIvkvMSheObShMpRpb/SKNOowj Uo4exRB3JcXG8I9PQWhRnTWGKr8e+LYt4AJUShmthIQgauBiFSfY0hjN+cYaQ7pJp1Pb w0DFb239PWdCrMuV/k2kUZARgXzeI6E8UMON4lBBHTgAVEX5IhWi+IgwXfif2RC2wh8/ OWvKxZsSUC+ZqtN5+pqc7KzsdlRRNL2pzkS+fmi6KGtB3DNV88IMQofaceED4ktUE3Le mXb6i5V2UX06HjpQphPBqMb4lQa5sqwMEGm51/1UvMRsGFHpZkNNWJdXzYfw02x4Vu3z 2png== X-Gm-Message-State: AOAM530zKu11JnkrrujG6Wf6zBS/hKgcxyh4TurhhCbOY67L2g88AEaS zKteHHwKmxRXIvGWRLU3SSInCA== X-Received: by 2002:a17:902:b901:: with SMTP id bf1mr6995903plb.153.1599769280963; Thu, 10 Sep 2020 13:21:20 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id u27sm5698081pgm.60.2020.09.10.13.21.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 10 Sep 2020 13:21:16 -0700 (PDT) From: Kees Cook To: kernel-hardening@lists.openwall.com Cc: Kees Cook , John Wood , Matthew Wilcox , Jonathan Corbet , Alexander Viro , Ingo Molnar , Peter Zijlstra , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Steven Rostedt , Ben Segall , Mel Gorman , Luis Chamberlain , Iurii Zaikin , James Morris , "Serge E. Hallyn" , linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [RFC PATCH 2/6] security/fbfam: Add the api to manage statistics Date: Thu, 10 Sep 2020 13:21:03 -0700 Message-Id: <20200910202107.3799376-3-keescook@chromium.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200910202107.3799376-1-keescook@chromium.org> References: <20200910202107.3799376-1-keescook@chromium.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: John Wood Create a statistical data structure to hold all the necessary information involve in a fork brute force attack. This info is a timestamp for the first fork or execve and the number of crashes since then. Moreover, due to this statitistical data will be shared between different tasks, a reference counter it is necessary. For a correct management of an attack it is also necessary that all the tasks hold statistical data. The same statistical data needs to be shared between all the tasks that hold the same memory contents or in other words, between all the tasks that have been forked without any execve call. When a forked task calls the execve system call, the memory contents are set with new values. So, in this scenario the parent's statistical data no need to be share. Instead, a new statistical data structure must be allocated to start a new cycle. The statistical data that every task holds needs to be clear when a task exits. Due to this data is shared across multiples tasks, the reference counter is useful to free the previous allocated data only when there are not other pointers to the same data. Or in other words, when the reference counter reaches zero. So, based in all the previous information add the api to manage all the commented cases. Also, add to the struct task_struct a new field to point to the statitistical data related to an attack. This way, all the tasks will have access to this information. Signed-off-by: John Wood --- include/fbfam/fbfam.h | 18 +++++ include/linux/sched.h | 4 + security/Makefile | 4 + security/fbfam/Makefile | 2 + security/fbfam/fbfam.c | 163 ++++++++++++++++++++++++++++++++++++++++ 5 files changed, 191 insertions(+) create mode 100644 include/fbfam/fbfam.h create mode 100644 security/fbfam/Makefile create mode 100644 security/fbfam/fbfam.c diff --git a/include/fbfam/fbfam.h b/include/fbfam/fbfam.h new file mode 100644 index 000000000000..b5b7d1127a52 --- /dev/null +++ b/include/fbfam/fbfam.h @@ -0,0 +1,18 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _FBFAM_H_ +#define _FBFAM_H_ + +#include + +#ifdef CONFIG_FBFAM +int fbfam_fork(struct task_struct *child); +int fbfam_execve(void); +int fbfam_exit(void); +#else +static inline int fbfam_fork(struct task_struct *child) { return 0; } +static inline int fbfam_execve(void) { return 0; } +static inline int fbfam_exit(void) { return 0; } +#endif + +#endif /* _FBFAM_H_ */ + diff --git a/include/linux/sched.h b/include/linux/sched.h index afe01e232935..00e1aa5e00cd 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -1315,6 +1315,10 @@ struct task_struct { struct callback_head mce_kill_me; #endif +#ifdef CONFIG_FBFAM + struct fbfam_stats *fbfam_stats; +#endif + /* * New fields for task_struct should be added above here, so that * they are included in the randomized portion of task_struct. diff --git a/security/Makefile b/security/Makefile index 3baf435de541..36dc4b536349 100644 --- a/security/Makefile +++ b/security/Makefile @@ -36,3 +36,7 @@ obj-$(CONFIG_BPF_LSM) += bpf/ # Object integrity file lists subdir-$(CONFIG_INTEGRITY) += integrity obj-$(CONFIG_INTEGRITY) += integrity/ + +# Object fbfam file lists +subdir-$(CONFIG_FBFAM) += fbfam +obj-$(CONFIG_FBFAM) += fbfam/ diff --git a/security/fbfam/Makefile b/security/fbfam/Makefile new file mode 100644 index 000000000000..f4b9f0b19c44 --- /dev/null +++ b/security/fbfam/Makefile @@ -0,0 +1,2 @@ +# SPDX-License-Identifier: GPL-2.0 +obj-$(CONFIG_FBFAM) += fbfam.o diff --git a/security/fbfam/fbfam.c b/security/fbfam/fbfam.c new file mode 100644 index 000000000000..0387f95f6408 --- /dev/null +++ b/security/fbfam/fbfam.c @@ -0,0 +1,163 @@ +// SPDX-License-Identifier: GPL-2.0 +#include +#include +#include +#include +#include +#include +#include + +/** + * struct fbfam_stats - Fork brute force attack mitigation statistics. + * @refc: Reference counter. + * @faults: Number of crashes since jiffies. + * @jiffies: First fork or execve timestamp. + * + * The purpose of this structure is to manage all the necessary information to + * compute the crashing rate of an application. So, it holds a first fork or + * execve timestamp and a number of crashes since then. This way the crashing + * rate in milliseconds per fault can be compute when necessary with the + * following formula: + * + * u64 delta_jiffies = get_jiffies_64() - fbfam_stats::jiffies; + * u64 delta_time = jiffies64_to_msecs(delta_jiffies); + * u64 crashing_rate = delta_time / (u64)fbfam_stats::faults; + * + * If the fbfam_stats::faults is zero, the above formula can't be used. In this + * case, the crashing rate is zero. + * + * Moreover, since the same allocated structure will be used in every fork + * since the first one or execve, it's also necessary a reference counter. + */ +struct fbfam_stats { + refcount_t refc; + unsigned int faults; + u64 jiffies; +}; + +/** + * fbfam_new_stats() - Allocation of new statistics structure. + * + * If the allocation is successful the reference counter is set to one to + * indicate that there will be one task that points to this structure. The + * faults field is initialize to zero and the timestamp for this moment is set. + * + * Return: NULL if the allocation fails. A pointer to the new allocated + * statistics structure if it success. + */ +static struct fbfam_stats *fbfam_new_stats(void) +{ + struct fbfam_stats *stats = kmalloc(sizeof(struct fbfam_stats), + GFP_KERNEL); + + if (stats) { + refcount_set(&stats->refc, 1); + stats->faults = 0; + stats->jiffies = get_jiffies_64(); + } + + return stats; +} + +/* + * fbfam_fork() - Fork management. + * @child: Pointer to the child task that will be created with the fork system + * call. + * + * For a correct management of a fork brute force attack it is necessary that + * all the tasks hold statistical data. The same statistical data needs to be + * shared between all the tasks that hold the same memory contents or in other + * words, between all the tasks that have been forked without any execve call. + * + * To ensure this, if the current task doesn't have statistical data when forks + * (only possible in the first fork of the zero task), it is mandatory to + * allocate a new one. This way, the child task always will share the statistics + * with its parent. + * + * Return: -ENOMEN if the allocation of the new statistics structure fails. + * Zero otherwise. + */ +int fbfam_fork(struct task_struct *child) +{ + struct fbfam_stats **stats = ¤t->fbfam_stats; + + if (!*stats) { + *stats = fbfam_new_stats(); + if (!*stats) + return -ENOMEM; + } + + refcount_inc(&(*stats)->refc); + child->fbfam_stats = *stats; + return 0; +} + +/** + * fbfam_execve() - Execve management. + * + * When a forked task calls the execve system call, the memory contents are set + * with new values. So, in this scenario the parent's statistical data no need + * to be share. Instead, a new statistical data structure must be allocated to + * start a new cycle. This condition is detected when the statistics reference + * counter holds a value greater than or equal to two (a fork always sets the + * statistics reference counter to two since the parent and the child task are + * sharing the same data). + * + * However, if the execve function is called immediately after another execve + * call, althought the memory contents are reset, there is no need to allocate + * a new statistical data structure. This is possible because at this moment + * only one task (the task that calls the execve function) points to the data. + * In this case, the previous allocation is used and only the faults and time + * fields are reset. + * + * Return: -ENOMEN if the allocation of the new statistics structure fails. + * -EFAULT if the current task doesn't have statistical data. Zero + * otherwise. + */ +int fbfam_execve(void) +{ + struct fbfam_stats **stats = ¤t->fbfam_stats; + + if (!*stats) + return -EFAULT; + + if (!refcount_dec_not_one(&(*stats)->refc)) { + /* execve call after an execve call */ + (*stats)->faults = 0; + (*stats)->jiffies = get_jiffies_64(); + return 0; + } + + /* execve call after a fork call */ + *stats = fbfam_new_stats(); + if (!*stats) + return -ENOMEM; + + return 0; +} + +/** + * fbfam_exit() - Exit management. + * + * The statistical data that every task holds needs to be clear when a task + * exits. Due to this data is shared across multiples tasks, the reference + * counter is useful to free the previous allocated data only when there are + * not other pointers to the same data. Or in other words, when the reference + * counter reaches zero. + * + * Return: -EFAULT if the current task doesn't have statistical data. Zero + * otherwise. + */ +int fbfam_exit(void) +{ + struct fbfam_stats *stats = current->fbfam_stats; + + if (!stats) + return -EFAULT; + + if (refcount_dec_and_test(&stats->refc)) + kfree(stats); + + return 0; +} + -- 2.25.1