Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Received-SPF: Pass (protection.outlook.com: domain of arm.com designates
 63.35.35.123 as permitted sender) receiver=protection.outlook.com;
 client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com;
Authentication-Results-Original: gmail.com; dkim=none (message not signed)
 header.d=none;gmail.com; dmarc=none action=none header.from=arm.com;
Date:   Thu, 22 Oct 2020 09:29:12 +0100
From:   Szabolcs Nagy <szabolcs.nagy@arm.com>
To:     Topi Miettinen <toiwoton@gmail.com>
Cc:     Florian Weimer <fweimer@redhat.com>,
        Lennart Poettering <mzxreary@0pointer.de>,
        Mark Rutland <mark.rutland@arm.com>,
        systemd-devel@lists.freedesktop.org,
        Kees Cook <keescook@chromium.org>,
        Catalin Marinas <Catalin.Marinas@arm.com>,
        Will Deacon <will.deacon@arm.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Mark Brown <broonie@kernel.org>, libc-alpha@sourceware.org,
        Dave Martin <dave.martin@arm.com>,
        "linux-arm-kernel@lists.infradead.org" 
        <linux-arm-kernel@lists.infradead.org>
Subject: Re: [systemd-devel] BTI interaction between seccomp filters in
 systemd and glibc mprotect calls, causing service failures
Message-ID: <20201022082912.GQ3819@arm.com>
References: <8584c14f-5c28-9d70-c054-7c78127d84ea@arm.com>
 <20201022071812.GA324655@gardel-login>
 <87sga6snjn.fsf@oldenburg2.str.redhat.com>
 <511318fd-efde-f2fc-9159-9d16ac8d33a7@gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <511318fd-efde-f2fc-9159-9d16ac8d33a7@gmail.com>
User-Agent: Mutt/1.9.4 (2018-02-28)
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
Received: from arm.com (217.140.106.54) by LNXP265CA0047.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:5c::35) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3499.18 via Frontend Transport; Thu, 22 Oct 2020 08:29:14 +0000
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-HT: Tenant
X-MS-Office365-Filtering-Correlation-Id: cd356d35-32da-43a2-c548-08d87664959a
X-MS-TrafficTypeDiagnostic: PA4PR08MB6141:|AM5PR0801MB1779:
X-MS-Exchange-Transport-Forked: True
X-Microsoft-Antispam-PRVS: <AM5PR0801MB1779AEF90662D4228C740656ED1D0@AM5PR0801MB1779.eurprd08.prod.outlook.com>
x-checkrecipientrouted: true
NoDisclaimer: true
X-MS-Oob-TLC-OOBClassifiers: OLM:10000;OLM:10000;
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam-Untrusted: BCL:0;
X-Microsoft-Antispam-Message-Info-Original: k/IN4WjNFdYnmj9Yh7XEXnnjmpJnhFv4xUxs0iI8roha6WGR3nibmK4aNGXJ7QO1eqFkmQNqDgUPq3QdV9kwzd4U03cbyxMManqOfE9XVujQlEM8zwpudIaanUIzBqWGSZ4zLkfbXP6LLT3ijhZG0uzlzIqBmxl63FsrSmXpPkL+YsMSeGDcrkmxMuDAEv5HkbvBgt+3f+p9IJdZ2oM3xP/BCbfV/zqY7tV/XeOTfP+kCqMSbf3xbh1At/bq85ht05gYsxE+bDKM9sw1+C5Kjysl2TKG2zTC9rSyxl6g0TyYhPTKtS16bPs/fly5V6yrdRq5ebdZOqidJzmsvm578lF81hnz0nicgaZvYRN505UA+QtKGhk3c6oDfTEpuPpB6nirDXjUzXJK8xymWfLuXw==
X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:PR3PR08MB5564.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(346002)(396003)(366004)(376002)(136003)(39860400002)(966005)(5660300002)(2906002)(8886007)(55016002)(26005)(478600001)(1076003)(186003)(7696005)(52116002)(8676002)(16526019)(44832011)(66946007)(66476007)(66556008)(316002)(36756003)(8936002)(6916009)(4326008)(2616005)(33656002)(54906003)(956004)(83380400001)(86362001);DIR:OUT;SFP:1101;
X-MS-Exchange-AntiSpam-MessageData: d3QTZM4x8ULLVxRHSmMIEofvqV6OeiFp/08wPg72yRYq5l9n03l1Phdoi1KLElbEonGTALNoJnKgsqxSgDOp+VVtwaah5PMWmV+TsMgF5ppApnGXRapdGDmPfvONrcVWE9ZcJ29iOtY76dkOs/LrLIA7bjAYCIrmZJLZFCJvHxT+jkd2ChDB+tHa1EkEA4W0RVFtPfwaeAsVw1usPRqUBH+5ybEutH2E6hwHbtpnqiL0emyc6tubB+XMkA1V/kaAtn2k53Mu9O7MdV8D2ZxmS9/mDzFX9YpCwIJ0241EuvzV6g9T7Y/bV1ahIZtbMFTY2esQDgFIpGEGpVhsSPwfeRsFXMv9TZZV9Yc6BH8FY13FJoLWNmJ9jgkTSB+fpl8vJGVit04Iw9xi8AT5W0JIm7OcPaiYh0yrDzwt03YXGmSCzUy6kHV3PTPFnFpcPv8R9PPSqrO7mcDh4eJd6qh8XiaA4M37jrWsPbb92JMJzY5XFPzm56qSa+R9117vDxMUAL/8mOD399njuXitGksXcXn4SDtbBJCySUhtbkdcKENqr6gZTeEpuIkw+KBiv23tylMhApWZl2w55gDJ4HxGo3K1hB/RSBwl5PqDM8gcZ9WklcXmhvYAFXdu8anEe8R/i4agcli4D6mQEhBqlAp71A==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA4PR08MB6141
Original-Authentication-Results: gmail.com; dkim=none (message not signed)
 header.d=none;gmail.com; dmarc=none action=none header.from=arm.com;
X-EOPAttributedMessage: 0
X-MS-Exchange-Transport-CrossTenantHeadersStripped: DB5EUR03FT025.eop-EUR03.prod.protection.outlook.com
X-MS-Office365-Filtering-Correlation-Id-Prvs: a7b3ee6c-c4f5-45a4-4383-08d876648f6d
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: YytYYScXINyjpB4DOaeoeOXH6SfVjjYO6jeoXDB55RxEIwuavSSS7lVM/a+FCJmfujnllJz86HP42NiQrti1pBSGD1lgxVG1oqWXiK+ob8m+YaC9j3R0fKB1jTEJduXjmDV2RS2VaVBCZx/A5RAoNmVCwwlvVcKSL/WfRWn9QWwAWdLBDnw+eU+0PLH1PY7yKzQDu4Q6nwKWUuUX4OrBqf+I0yp/9SPx5Geb1upQTYdkzPCJWf7wWOyZmre363NJntOqFp2CTwbMo6c1eoP/XJTfpmHlwoO/MRTe9bUkGJLrkI1IXqunLIZpUPfzxqt7WN/pmVzhJBFJ8EIUMr8ER9qR9OeelMihqbQbVXy4HO0OauPqYIriXNUK5rIvHblxekqUshD3avXZIY/cgoJOexQPJUyd+MwiZ+qCQusfcZDwi+2YufDaDUeFXVqMiwz41t9ygst98EvOxWC9RpG4CTMwx9Rvg6yi4OyxMw8Ad98=
X-Forefront-Antispam-Report: CIP:63.35.35.123;CTRY:IE;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:64aa7808-outbound-1.mta.getcheckrecipient.com;PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com;CAT:NONE;SFS:(4636009)(396003)(136003)(376002)(346002)(39860400002)(46966005)(966005)(336012)(316002)(47076004)(8676002)(86362001)(81166007)(2906002)(5660300002)(82740400003)(1076003)(107886003)(55016002)(6862004)(70206006)(26005)(33656002)(956004)(186003)(4326008)(44832011)(7696005)(2616005)(16526019)(54906003)(83380400001)(8886007)(36756003)(478600001)(8936002)(82310400003)(356005)(70586007);DIR:OUT;SFP:1101;
X-OriginatorOrg: arm.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Oct 2020 08:29:25.1610
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: cd356d35-32da-43a2-c548-08d87664959a
X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d;Ip=[63.35.35.123];Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com]
X-MS-Exchange-CrossTenant-AuthSource: DB5EUR03FT025.eop-EUR03.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5PR0801MB1779
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

The 10/22/2020 11:17, Topi Miettinen via Libc-alpha wrote:
> On 22.10.2020 10.54, Florian Weimer wrote:
> > * Lennart Poettering:
> > > Did you see Topi's comments on the systemd issue?
> > > 
> > > https://github.com/systemd/systemd/issues/17368#issuecomment-710485532
> > > 
> > > I think I agree with this: it's a bit weird to alter the bits after
> > > the fact. Can't glibc set up everything right from the begining? That
> > > would keep both concepts working.
> > 
> > The dynamic loader has to process the LOAD segments to get to the ELF
> > note that says to enable BTI.  Maybe we could do a first pass and load
> > only the segments that cover notes.  But that requires lots of changes
> > to generic code in the loader.
> 
> What if the loader always enabled BTI for PROT_EXEC pages, but then when
> discovering that this was a mistake, mprotect() the pages without BTI? Then
> both BTI and MDWX would work and the penalty of not getting MDWX would fall
> to non-BTI programs. What's the expected proportion of BTI enabled code vs.
> disabled in the future, is it perhaps expected that a distro would enable
> the flag globally so eventually only a few legacy programs might be
> unprotected?

i thought mprotect(PROT_EXEC) would get filtered
with or without bti, is that not the case?

then i guess we can do the protection that way
around, but then i don't see why the filter cannot
treat PROT_EXEC|PROT_BTI the same as PROT_EXEC.