Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1450475

Re: [PATCH] prctl: remove one-shot limitation for changing exe link

Show all headers | View raw

On Mon, Jul 25, 2016 at 02:56:43PM -0500, Eric W. Biederman wrote:
...
> >>
> >> Also there is a big fat bug in prctl_set_mm_exe_file.  It doesn't
> >> validate that the new file is a actually mmaped executable.  We would
> >> definitely need that to be fixed before even considering removing the
> >> limit.
> >
> > Could you please elaborate? We check for inode being executable,
> > what else needed?
> 
> That the inode is mmaped into the process with executable mappings.
> 
> Effectively what we check the old mapping for and refuse to remove the old
> mm_exe_file if it exists.
> 
> I think a reasonable argument can be made that if the file is
> executable, and it is mmaped with executable pages that exe_file is not
> a complete lie.

I might be missing something obvious, so sorry for the question --
when criu setups old exe link the inode we obtain from file open
is not mapped into memory, the old exe not read by anyone because
it's not even executed anyhow. So I don't really understand which
mapping we should check here. Mind to point me?

> Which is the important part.  At the end of the day how much can
> userspace trust /proc/pid/exe?  If we are too lax it is just a random
> file descriptor we can not trust at all.  At which point there is
> exactly no point in preserving it in checkpoint/restart, because nothing
> will trust or look at it.

You know, I think we should not trust exe link much, and in real we
never could: this link is rather a hint pointing which executable a
process has been using on execve call, once the process start working
one can't be sure if the code currently running is exactly from the
file pointed by exe link. It just a hint suitable for debuggin and
obtain clean view of which processes are running on noncompromised
system. Monitoring exe link change won't help much if there are
malicious software running on the system.

> If the only user is checkpoint/restart perhaps it should be only ptrace
> that can set this and not the process itself with a prctl.  I don't
> know.  All I know is that we should work on making it a very trustable
> value even though in some specific instances we can set it.

Since as I said I suppose nobody except us using this feature, we can
setup some sysctl trigger for it (I personally think this is an
overkill, but OTOH if people rely on the exe link and not going
to use criu at all, this trigger will help).

	Cyrill

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH] prctl: remove one-shot limitation for changing exe link Stanislav Kinsburskiy <skinsbursky@virtuozzo.com> - 2016-07-12 18:20 +0200
  Re: [PATCH] prctl: remove one-shot limitation for changing exe link Oleg Nesterov <oleg@redhat.com> - 2016-07-12 18:50 +0200
    Re: [PATCH] prctl: remove one-shot limitation for changing exe link Oleg Nesterov <oleg@redhat.com> - 2016-07-12 19:10 +0200
  Re: [PATCH] prctl: remove one-shot limitation for changing exe link Cyrill Gorcunov <gorcunov@gmail.com> - 2016-07-12 18:50 +0200
    Re: [PATCH] prctl: remove one-shot limitation for changing exe link ebiederm@xmission.com (Eric W. Biederman) - 2016-07-12 19:10 +0200
      Re: [PATCH] prctl: remove one-shot limitation for changing exe link Cyrill Gorcunov <gorcunov@gmail.com> - 2016-07-12 19:30 +0200
        Re: [PATCH] prctl: remove one-shot limitation for changing exe link Cyrill Gorcunov <gorcunov@gmail.com> - 2016-07-12 23:50 +0200
      Re: [PATCH] prctl: remove one-shot limitation for changing exe link One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> - 2016-07-18 22:20 +0200
  Re: [PATCH] prctl: remove one-shot limitation for changing exe link ebiederm@xmission.com (Eric W. Biederman) - 2016-07-25 20:40 +0200
    Re: [PATCH] prctl: remove one-shot limitation for changing exe link Cyrill Gorcunov <gorcunov@gmail.com> - 2016-07-25 21:30 +0200
      Re: [PATCH] prctl: remove one-shot limitation for changing exe link ebiederm@xmission.com (Eric W. Biederman) - 2016-07-25 22:20 +0200
        Re: [PATCH] prctl: remove one-shot limitation for changing exe link Cyrill Gorcunov <gorcunov@gmail.com> - 2016-07-26 10:40 +0200
          Re: [PATCH] prctl: remove one-shot limitation for changing exe link ebiederm@xmission.com (Eric W. Biederman) - 2016-07-30 19:50 +0200
            Re: [PATCH] prctl: remove one-shot limitation for changing exe link Mateusz Guzik <mguzik@redhat.com> - 2016-07-30 22:30 +0200
              Re: [PATCH] prctl: remove one-shot limitation for changing exe link ebiederm@xmission.com (Eric W. Biederman) - 2016-07-31 21:00 +0200
            Re: [PATCH] prctl: remove one-shot limitation for changing exe link Cyrill Gorcunov <gorcunov@gmail.com> - 2016-08-01 00:50 +0200
              Re: [PATCH] prctl: remove one-shot limitation for changing exe link Andy Lutomirski <luto@amacapital.net> - 2016-08-01 01:00 +0200
            Re: [PATCH] prctl: remove one-shot limitation for changing exe link Cyrill Gorcunov <gorcunov@gmail.com> - 2016-08-01 11:30 +0200

csiph-web