Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Nikolay Borisov <nik.borisov@suse.com>
To:     x86@kernel.org
Cc:     linux-kernel@vger.kernel.org, mhocko@suse.cz,
        Nikolay Borisov <nik.borisov@suse.com>
Subject: [RFC PATCH] x86/entry: Disable ia32 syscalls and introduce a boot time toggle
Date:   Fri, 26 May 2023 16:28:06 +0300
Message-Id: <20230526132806.1475900-1-nik.borisov@suse.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

Distributions would like to reduce their attack surface as much as
possible but at the same time they have to cater to a wide variety of
legacy software. One such avenue where distros have to strike a balance
is the support for 32bit syscalls on a 64bit kernel. Ideally the compat
support should be disabled for the majority of the time, yet in the few
cases where it might be needed it'd be good if there is some toggle
which would allow users to turn on back compat support.

This patch aims to cater for this use case by disabling ia32 syscalls
and introducing a boot time parameter 'ia32_enabled' which if set to
'true' brings backs 32bit syscall support.

Signed-off-by: Nikolay Borisov <nik.borisov@suse.com>
---

Rather than being a final implementation I'd like this to serve as a conversation
starter and agree on a final solution that's acceptable to everyone.

 arch/x86/entry/common.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c
index 6c2826417b33..6063727a75fe 100644
--- a/arch/x86/entry/common.c
+++ b/arch/x86/entry/common.c
@@ -19,6 +19,7 @@
 #include <linux/nospec.h>
 #include <linux/syscalls.h>
 #include <linux/uaccess.h>
+#include <linux/init.h>

 #ifdef CONFIG_XEN_PV
 #include <xen/xen-ops.h>
@@ -96,6 +97,20 @@ static __always_inline int syscall_32_enter(struct pt_regs *regs)
 	return (int)regs->orig_ax;
 }

+int ia32_enabled = 0;
+
+static int __init ia32_enabled_parsecmdline(char *arg)
+{
+	if (!strcmp(arg, "true"))
+		ia32_enabled = 1;
+	else
+		pr_crit("Unsupported ia32_enabled=%s, ia32 syscalls disabled\n",
+			arg);
+
+	return 0;
+}
+early_param("ia32_enabled", ia32_enabled_parsecmdline);
+
 /*
  * Invoke a 32-bit syscall.  Called with IRQs on in CONTEXT_KERNEL.
  */
@@ -107,7 +122,7 @@ static __always_inline void do_syscall_32_irqs_on(struct pt_regs *regs, int nr)
 	 */
 	unsigned int unr = nr;

-	if (likely(unr < IA32_NR_syscalls)) {
+	if (likely(unr < IA32_NR_syscalls) && ia32_enabled) {
 		unr = array_index_nospec(unr, IA32_NR_syscalls);
 		regs->ax = ia32_sys_call_table[unr](regs);
 	} else if (nr != -1) {
--
2.34.1