Re: [PATCH v2 3/3] x86,arch_prctl Add ARCH_[GET|SET]_CPUID for controlling the CPUID instruction

From	Andy Lutomirski <luto@amacapital.net>
Newsgroups	linux.kernel
Subject	Re: [PATCH v2 3/3] x86,arch_prctl Add ARCH_[GET\|SET]_CPUID for controlling the CPUID instruction
Date	2016-09-15 04:00 +0200
Message-ID	<shu81-re-5@gated-at.bofh.it> (permalink)
References	<shpBn-665-13@gated-at.bofh.it> <shpBo-665-39@gated-at.bofh.it> <shtEZ-hh-1@gated-at.bofh.it> <shtYl-nL-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Wed, Sep 14, 2016 at 6:47 PM, Kyle Huey <me@kylehuey.com> wrote:
> On Wed, Sep 14, 2016 at 6:29 PM, Andy Lutomirski <luto@amacapital.net> wrote:
>> On Wed, Sep 14, 2016 at 2:01 PM, Kyle Huey <me@kylehuey.com> wrote:

>>> +
>>> +int set_cpuid_mode(struct task_struct *task, unsigned long val)
>>> +{
>>> +       /* Only disable/enable_cpuid() if it is supported on this hardware. */
>>> +       bool cpuid_fault_supported = static_cpu_has(X86_FEATURE_CPUID_FAULT);
>>> +
>>> +       if (val == ARCH_CPUID_ENABLE && cpuid_fault_supported) {
>>> +               if (task_no_new_privs(task) && test_thread_flag(TIF_NOCPUID))
>>> +                       return -EACCES;
>>
>> This check seems confused.  If this flag were preserved on execve,
>> it's the SIGSEGV mode that would need the check.
>
> Not sure I follow this one.  no_new_privs should block transitions
> from SIGSEGV to ENABLE, right?  That's what this check does.

It's the other way around entirely: if you make a change to your
process context such that a subseqently execve()'d setuid program
might malfunction, you've just done something dangerous.  This is only
okay, at least in newly-supported instances, if you are either
privileged or if you have no_new_privs set.  Having privilege makes it
okay: unprivileged programs can't use it to subvert setuid programs.
no_new_privs makes it safe as well: if no_new_privs is set, you can't
gain privilege via execve(), so there's no attack surface.  So, if you
have execve() keep ARCH_CPUID_SIGSEGV set, then setting it that way in
the first place should require privilege or no_new_privs.

I personally favor resetting to ARCH_CPUID_ENABLE on execve() and not
worrying about no_new_privs.

Does that make sense?

Thread

[PATCH v2 3/3] x86,arch_prctl Add ARCH_[GET|SET]_CPUID for controlling the CPUID instruction Kyle Huey <me@kylehuey.com> - 2016-09-14 23:10 +0200
  Re: [PATCH v2 3/3] x86,arch_prctl Add ARCH_[GET|SET]_CPUID for  controlling the CPUID instruction Andy Lutomirski <luto@amacapital.net> - 2016-09-15 03:30 +0200
    Re: [PATCH v2 3/3] x86,arch_prctl Add ARCH_[GET|SET]_CPUID for  controlling the CPUID instruction Kyle Huey <me@kylehuey.com> - 2016-09-15 03:50 +0200
      Re: [PATCH v2 3/3] x86,arch_prctl Add ARCH_[GET|SET]_CPUID for  controlling the CPUID instruction Andy Lutomirski <luto@amacapital.net> - 2016-09-15 04:00 +0200
        Re: [PATCH v2 3/3] x86,arch_prctl Add ARCH_[GET|SET]_CPUID for  controlling the CPUID instruction Kyle Huey <me@kylehuey.com> - 2016-09-15 04:30 +0200

csiph-web