Received-SPF: pass (google.com: domain of linux-kernel+bounces-105045-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Date: Fri, 15 Mar 2024 20:24:27 -0700
From: Kees Cook <kees@kernel.org>
To: Paul Moore <paul@paul-moore.com>,
 =?ISO-8859-1?Q?Christian_G=F6ttsche?= <cgzones@googlemail.com>
CC: linux-security-module@vger.kernel.org, Eric Biederman <ebiederm@xmission.com>,
 Kees Cook <keescook@chromium.org>, Alexander Viro <viro@zeniv.linux.org.uk>,
 Christian Brauner <brauner@kernel.org>, Jan Kara <jack@suse.cz>,
 James Morris <jmorris@namei.org>, "Serge E. Hallyn" <serge@hallyn.com>,
 Khadija Kamran <kamrankhadijadj@gmail.com>,
 Andrii Nakryiko <andrii@kernel.org>,
 Casey Schaufler <casey@schaufler-ca.com>,
 Alexei Starovoitov <ast@kernel.org>, Ondrej Mosnacek <omosnace@redhat.com>,
 Roberto Sassu <roberto.sassu@huawei.com>, Alfred Piccioni <alpic@google.com>,
 John Johansen <john.johansen@canonical.com>, linux-mm@kvack.org,
 linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [RFC PATCH 1/2] lsm: introduce new hook security_vm_execstack
User-Agent: K-9 Mail for Android
In-Reply-To: <CAHC9VhRkawYWQN0UY2R68Qn4pRijpXgu97YOr6XPA7Ls0-zQcA@mail.gmail.com>
References: <20240315181032.645161-1-cgzones@googlemail.com> <20240315181032.645161-2-cgzones@googlemail.com> <CAHC9VhRkawYWQN0UY2R68Qn4pRijpXgu97YOr6XPA7Ls0-zQcA@mail.gmail.com>
Message-ID: <5368DC74-41CF-4450-AF6F-FFB51EFCCF99@kernel.org>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable


On March 15, 2024 1:22:39 PM PDT, Paul Moore <paul@paul-moore=2Ecom> wrote=
:
>On Fri, Mar 15, 2024 at 2:10=E2=80=AFPM Christian G=C3=B6ttsche
><cgzones@googlemail=2Ecom> wrote:
>>
>> Add a new hook guarding instantiations of programs with executable
>> stack=2E  They are being warned about since commit 47a2ebb7f505 ("execv=
e:
>> warn if process starts with executable stack")=2E  Lets give LSMs the
>> ability to control their presence on a per application basis=2E
>>
>> Signed-off-by: Christian G=C3=B6ttsche <cgzones@googlemail=2Ecom>
>> ---
>>  fs/exec=2Ec                     |  4 ++++
>>  include/linux/lsm_hook_defs=2Eh |  1 +
>>  include/linux/security=2Eh      |  6 ++++++
>>  security/security=2Ec           | 13 +++++++++++++
>>  4 files changed, 24 insertions(+)
>
>Looking at the commit referenced above, I'm guessing the existing
>security_file_mprotect() hook doesn't catch this?
>
>> diff --git a/fs/exec=2Ec b/fs/exec=2Ec
>> index 8cdd5b2dd09c=2E=2Ee6f9e980c6b1 100644
>> --- a/fs/exec=2Ec
>> +++ b/fs/exec=2Ec
>> @@ -829,6 +829,10 @@ int setup_arg_pages(struct linux_binprm *bprm,
>>         BUG_ON(prev !=3D vma);
>>
>>         if (unlikely(vm_flags & VM_EXEC)) {
>> +               ret =3D security_vm_execstack();
>> +               if (ret)
>> +                       goto out_unlock;
>> +
>>                 pr_warn_once("process '%pD4' started with executable st=
ack\n",
>>                              bprm->file);
>>         }
>
>Instead of creating a new LSM hook, have you considered calling the
>existing security_file_mprotect() hook?  The existing LSM controls
>there may not be a great fit in this case, but I'd like to hear if
>you've tried that, and if you have, what made you decide a new hook
>was the better option?

Also, can't MDWE handle this already?
https://git=2Ekernel=2Eorg/linus/b507808ebce23561d4ff8c2aa1fb949fe402bc61

-Kees

--=20
Kees Cook