Hi
On Mon, Jun 10, 2024 at 7:20 PM Randy Dunlap rdunlap@infradead.org wrote:
Hi--
On 6/7/24 1:35 PM, jeffxu@chromium.org wrote:
From: Jeff Xu jeffxu@chromium.org
Add documentation for memfd_create flags: FMD_NOEXEC_SEAL
s/FMD/MFD/
and MFD_EXEC
Signed-off-by: Jeff Xu jeffxu@chromium.org
Documentation/userspace-api/index.rst | 1 + Documentation/userspace-api/mfd_noexec.rst | 86 ++++++++++++++++++++++ 2 files changed, 87 insertions(+) create mode 100644 Documentation/userspace-api/mfd_noexec.rst
diff --git a/Documentation/userspace-api/index.rst b/Documentation/userspace-api/index.rst index 5926115ec0ed..8a251d71fa6e 100644 --- a/Documentation/userspace-api/index.rst +++ b/Documentation/userspace-api/index.rst @@ -32,6 +32,7 @@ Security-related interfaces seccomp_filter landlock lsm
- mfd_noexec spec_ctrl tee
diff --git a/Documentation/userspace-api/mfd_noexec.rst b/Documentation/userspace-api/mfd_noexec.rst new file mode 100644 index 000000000000..0d2c840f37e1 --- /dev/null +++ b/Documentation/userspace-api/mfd_noexec.rst @@ -0,0 +1,86 @@ +.. SPDX-License-Identifier: GPL-2.0
+================================== +Introduction of non executable mfd
non-executable mfd+================================== +:Author:
- Daniel Verkamp dverkamp@chromium.org
- Jeff Xu jeffxu@chromium.org
+:Contributor:
Aleksa Sarai <cyphar@cyphar.com>+Since Linux introduced the memfd feature, memfd have always had their
memfdsi.e., plural
+execute bit set, and the memfd_create() syscall doesn't allow setting +it differently.
+However, in a secure by default system, such as ChromeOS, (where all
secure-by-default+executables should come from the rootfs, which is protected by Verified +boot), this executable nature of memfd opens a door for NoExec bypass +and enables “confused deputy attack”. E.g, in VRP bug [1]: cros_vm +process created a memfd to share the content with an external process, +however the memfd is overwritten and used for executing arbitrary code +and root escalation. [2] lists more VRP in this kind.
of this kind.
+On the other hand, executable memfd has its legit use, runc uses memfd’s
use:+seal and executable feature to copy the contents of the binary then +execute them, for such system, we need a solution to differentiate runc's
them. For such a system,+use of executable memfds and an attacker's [3].
+To address those above.
above:
- Let memfd_create() set X bit at creation time.
- Let memfd be sealed for modifying X bit when NX is set.
- A new pid namespace sysctl: vm.memfd_noexec to help applications to
- Add a new applications in
- migrating and enforcing non-executable MFD.
+User API +======== +``int memfd_create(const char *name, unsigned int flags)``
+``MFD_NOEXEC_SEAL``
When MFD_NOEXEC_SEAL bit is set in the ``flags``, memfd is createdwith NX. F_SEAL_EXEC is set and the memfd can't be modified toadd X later. MFD_ALLOW_SEALING is also implied.This is the most common case for the application to use memfd.+``MFD_EXEC``
When MFD_EXEC bit is set in the ``flags``, memfd is created with X.+Note:
``MFD_NOEXEC_SEAL`` implies ``MFD_ALLOW_SEALING``. In case thatapp doesn't want sealing, it can add F_SEAL_SEAL after creation.an app
+Sysctl: +======== +``pid namespaced sysctl vm.memfd_noexec``
+The new pid namespaced sysctl vm.memfd_noexec has 3 values:
- 0: MEMFD_NOEXEC_SCOPE_EXEC
memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL acts likeMFD_EXEC was set.
- 1: MEMFD_NOEXEC_SCOPE_NOEXEC_SEAL
memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL acts likeMFD_NOEXEC_SEAL was set.
- 2: MEMFD_NOEXEC_SCOPE_NOEXEC_ENFORCED
memfd_create() without MFD_NOEXEC_SEAL will be rejected.+The sysctl allows finer control of memfd_create for old-software that
old software+doesn't set the executable bit, for example, a container with
bit;+vm.memfd_noexec=1 means the old-software will create non-executable memfd
old software+by default while new-software can create executable memfd by setting
new software+MFD_EXEC.
+The value of vm.memfd_noexec is passed to child namespace at creation +time, in addition, the setting is hierarchical, i.e. during memfd_create,
time. In addition,
Updated in V2. Thanks! -Jeff
+we will search from current ns to root ns and use the most restrictive +setting.
+[1] https://crbug.com/1305267
+[2] https://bugs.chromium.org/p/chromium/issues/list?q=type%3Dbug-security%20mem...
-- ~Randy