Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH 0/4] aarch64: avoid mprotect(PROT_BTI|PROT_EXEC) [BZ
 #26831]
To:     Florian Weimer <fweimer@redhat.com>, Will Deacon <will@kernel.org>
Cc:     Mark Brown <broonie@kernel.org>,
        Szabolcs Nagy <szabolcs.nagy@arm.com>,
        libc-alpha@sourceware.org, Jeremy Linton <jeremy.linton@arm.com>,
        Catalin Marinas <catalin.marinas@arm.com>,
        Mark Rutland <mark.rutland@arm.com>,
        Kees Cook <keescook@chromium.org>,
        Salvatore Mesoraca <s.mesoraca16@gmail.com>,
        Lennart Poettering <mzxreary@0pointer.de>,
        linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
        kernel-hardening@lists.openwall.com,
        linux-hardening@vger.kernel.org
References: <cover.1604393169.git.szabolcs.nagy@arm.com>
 <20201103173438.GD5545@sirena.org.uk>
 <20201104092012.GA6439@willie-the-truck>
 <87h7q54ghy.fsf@oldenburg2.str.redhat.com>
From:   Topi Miettinen <toiwoton@gmail.com>
Message-ID: <d2f51a90-c5d6-99bd-35b8-f4fded073f95@gmail.com>
Date:   Wed, 4 Nov 2020 11:55:57 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.4.0
MIME-Version: 1.0
In-Reply-To: <87h7q54ghy.fsf@oldenburg2.str.redhat.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Precedence: bulk

On 4.11.2020 11.29, Florian Weimer wrote:
> * Will Deacon:
> 
>> Is there real value in this seccomp filter if it only looks at mprotect(),
>> or was it just implemented because it's easy to do and sounds like a good
>> idea?
> 
> It seems bogus to me.  Everyone will just create alias mappings instead,
> just like they did for the similar SELinux feature.  See “Example code
> to avoid execmem violations” in:
> 
>    <https://www.akkadia.org/drepper/selinux-mem.html>

Also note "But this is very dangerous: programs should never use memory 
regions which are writable and executable at the same time. Assuming 
that it is really necessary to generate executable code while the 
program runs the method employed should be reconsidered."

> As you can see, this reference implementation creates a PROT_WRITE
> mapping aliased to a PROT_EXEC mapping, so it actually reduces security
> compared to something that generates the code in an anonymous mapping
> and calls mprotect to make it executable.

Drepper's methods to avoid SELinux protections are indeed the two ways 
(which I'm aware) to also avoid the seccomp filter: by using 
memfd_create() and using a file system which writable and executable to 
the process to create a new executable file. Both methods can be 
eliminated for many system services, memfd_create() with seccomp and 
filesystem W&X with mount namespaces.

If a service legitimately needs executable and writable mappings (due to 
JIT, trampolines etc), it's easy to disable the filter whenever really 
needed with "MemoryDenyWriteExecute=no" (which is the default) in case 
of systemd or a TE rule like "allow type_t self:process { execmem };" 
for SELinux. But this shouldn't be the default case, since there are 
many services which don't need W&X.

I'd also question what is the value of BTI if it can be easily 
circumvented by removing PROT_BTI with mprotect()?

-Topi