Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1191406
| Path | csiph.com!aioe.org!bofh.it!news.nic.it!robomod |
|---|---|
| From | Andy Lutomirski <luto@amacapital.net> |
| Newsgroups | linux.kernel |
| Subject | Re: [PATCH v3 2/3] x86/ldt: Make modify_ldt optional |
| Date | Fri, 24 Jul 2015 01:50:01 +0200 |
| Message-ID | <pPypr-5dm-3@gated-at.bofh.it> (permalink) |
| References | <pP7Sh-qJ-13@gated-at.bofh.it> <pP7Si-qJ-27@gated-at.bofh.it> <pPlVf-3Ua-11@gated-at.bofh.it> <pPyfM-527-11@gated-at.bofh.it> |
| X-Original-To | Kees Cook <keescook@chromium.org> |
| X-Google-Dkim-Signature | v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=0qRz6vWiQa6UoN6Ez7cEuCcJ8HPOjH6xK9ZG5vRg+ls=; b=UQ7RwcorhA9PaBNpyKt6wVrXd/PWD/rpzpVaXtpMbKeOeUjcVpeApMK8gdj8DLIhLN pHpR0DcPvC1LOkUdxm2nMgpP9aOWvWQ1qGr8poLaLWqrmgHQhMcCM9BcqHDW/4vG1zGA CWPw8ydJEzvg5ktlcApS7z6qvRvaI+1P/CanWi55FoBVgibB0H3dnNu4C6mhGTqbinrb nl+dykRj1qPU9lEHdwIdeJ1XRMFfSQo003y1EkujXbBk3sx4oJ2fIxz4Dh03io8zNBZN Qa/xbxTG6ycDmSHHnUhVEvVSXWUxyd1PpZ31mALVd9VcDSEN5Wmv3a2DasLFCOCb6A3K PFcA== |
| X-Gm-Message-State | ALoCoQkwaCS++hakLW4CRBkf3M9esZwWxpk9qmRB3XA7/A8BihFBz/D7gQZydN+R7lIaLvb/nsZd |
| X-Received | by 10.152.1.66 with SMTP id 2mr10830337lak.56.1437694833994; Thu, 23 Jul 2015 16:40:33 -0700 (PDT) |
| MIME-Version | 1.0 |
| Content-Type | text/plain; charset=UTF-8 |
| Sender | robomod@news.nic.it |
| List-ID | <linux-kernel.vger.kernel.org> |
| X-Mailing-List | linux-kernel@vger.kernel.org |
| Approved | robomod@news.nic.it |
| Lines | 63 |
| Organization | linux.* mail to news gateway |
| X-Original-Cc | Willy Tarreau <w@1wt.eu>, Andy Lutomirski <luto@kernel.org>, Peter Zijlstra <peterz@infradead.org>, Steven Rostedt <rostedt@goodmis.org>, "security@kernel.org" <security@kernel.org>, X86 ML <x86@kernel.org>, Borislav Petkov <bp@alien8.de>, Sasha Levin <sasha.levin@oracle.com>, LKML <linux-kernel@vger.kernel.org>, Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>, Boris Ostrovsky <boris.ostrovsky@oracle.com>, Andrew Cooper <andrew.cooper3@citrix.com>, Jan Beulich <jbeulich@suse.com>, xen-devel <xen-devel@lists.xen.org> |
| X-Original-Date | Thu, 23 Jul 2015 16:40:14 -0700 |
| X-Original-Message-ID | <CALCETrVvfA+_N_tU2LUwvh+2Q_4AExbQkSgW1C4tESAvhY+4Dg@mail.gmail.com> |
| X-Original-References | <cover.1437592883.git.luto@kernel.org> <7bfde005b84a90a83bf668a320c7d4ad1b940065.1437592883.git.luto@kernel.org> <20150723102434.GA2929@1wt.eu> <CAGXu5j+yEWLuxJ9JUGyN7BxME+iOVXfpFgrZ-_2WXUn6A=0dVg@mail.gmail.com> |
| X-Original-Sender | linux-kernel-owner@vger.kernel.org |
| Xref | aioe.org linux.kernel:1191406 |
Show key headers only | View raw
On Thu, Jul 23, 2015 at 4:36 PM, Kees Cook <keescook@chromium.org> wrote:
> On Thu, Jul 23, 2015 at 3:24 AM, Willy Tarreau <w@1wt.eu> wrote:
>> #ifdef CONFIG_SMP
>> static void flush_ldt(void *current_mm)
>> {
>> @@ -254,6 +260,9 @@ asmlinkage int sys_modify_ldt(int func, void __user *ptr,
>> {
>> int ret = -ENOSYS;
>>
>> + if (!sysctl_modify_ldt)
>> + return ret;
>> +
>> switch (func) {
>> case 0:
>> ret = read_ldt(ptr, bytecount);
>> diff --git a/kernel/sysctl.c b/kernel/sysctl.c
>> index 2082b1a..60270c6 100644
>> --- a/kernel/sysctl.c
>> +++ b/kernel/sysctl.c
>> @@ -111,6 +111,9 @@ extern int sysctl_nr_open_min, sysctl_nr_open_max;
>> #ifndef CONFIG_MMU
>> extern int sysctl_nr_trim_pages;
>> #endif
>> +#ifdef CONFIG_X86
>> +extern int sysctl_modify_ldt;
>> +#endif
>>
>> /* Constants used for minimum and maximum */
>> #ifdef CONFIG_LOCKUP_DETECTOR
>> @@ -962,6 +965,13 @@ static struct ctl_table kern_table[] = {
>> .mode = 0644,
>> .proc_handler = proc_dointvec,
>> },
>> + {
>> + .procname = "modify_ldt",
>> + .data = &sysctl_modify_ldt,
>> + .maxlen = sizeof(int),
>> + .mode = 0644,
>> + .proc_handler = proc_dointvec,
>> + },
>> #endif
>> #if defined(CONFIG_MMU)
>> {
>
> I've been pondering something like this that is even MORE generic, for
> any syscall. Something like a "syscalls" directory under
> /proc/sys/kernel, with 1 entry per syscall. "0" is "available", "1" is
> disabled, and "-1" disabled until next boot.
>
It might want to be /proc/sys/kernel/syscalls/[abi]/[name], possibly
with more than just those options. We might want "disabled, returns
ENOSYS", "disabled, returns EPERM", and a lock bit.
On x86 at least, the implementation's easy -- we can just poke the
syscall table.
--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Re: [PATCH v3 2/3] x86/ldt: Make modify_ldt optional Kees Cook <keescook@chromium.org> - 2015-07-24 01:40 +0200
Re: [PATCH v3 2/3] x86/ldt: Make modify_ldt optional Andy Lutomirski <luto@amacapital.net> - 2015-07-24 01:50 +0200
Re: [PATCH v3 2/3] x86/ldt: Make modify_ldt optional Willy Tarreau <w@1wt.eu> - 2015-07-24 02:00 +0200
Re: [PATCH v3 2/3] x86/ldt: Make modify_ldt optional Kees Cook <keescook@chromium.org> - 2015-07-24 02:10 +0200
Re: [PATCH v3 2/3] x86/ldt: Make modify_ldt optional Willy Tarreau <w@1wt.eu> - 2015-07-24 09:30 +0200
Re: [PATCH v3 2/3] x86/ldt: Make modify_ldt optional Willy Tarreau <w@1wt.eu> - 2015-07-24 09:50 +0200
csiph-web