Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1682667

Re: [RFC][PATCH] exec: Use init rlimits for setuid exec

Show all headers | View raw

On Thu, Jul 6, 2017 at 10:52 AM, Linus Torvalds
<torvalds@linux-foundation.org> wrote:
> On Thu, Jul 6, 2017 at 10:29 AM, Kees Cook <keescook@chromium.org> wrote:
>>>
>>>  (a) minimal: just use our existing default stack (and stack _only_)
>>> limit value for suid binaries that actually get extra permissions: {
>>> _STK_LIM, RLIM_INFINITY }.
>>
>> This would look a lot like the existing patch; it'd just not copy the
>> init process rlimits.
>
> Can't we just do the final rlimit setting so late in execve that we
> don't need that whole "saved_rlimit" thing?

The stack rlimit defines the mmap layout too:

do_execveat_common() ->
exec_binprm() ->
search_binary_handler() ->
fmt->load_binary (load_elf_binary()) ->
setup_new_exec() ->
arch_pick_mmap_layout() ->
mmap_is_legacy() ->
rlimit(RLIMIT_STACK) == RLIM_INFINITY

exec_binprm() happens after the other stack setup (copy_strings()), so
if we wanted to avoid saved_rlimit, we'd have to replumb how
arch_pick_mmap_layout() works and how copy_strings() performs its
calculations (neither looks too terrible).

> If the issue is the "people can use argv/envp to already fill the
> stack", then I'd actually be happier with just limiting that.
>
> We already claim that our ARG_MAX is just 128kB (old legacy). And I
> was really happy when we changed our execve() to not have that nasty
> array of pages, and we could expand on the array sizes. But we could
> *easily* just say "limit execve arrays to 8MB", because while our code
> can handle more, you do have latency issues and just memory use issues
> too.

That would address the argv/envp calculation but not the layout control.

> So right now we already limit the stack size artificially to 1/4 the
> stack rlimit (see get_arg_page()), and we could easily just further
> cap it at 8M total - right now people obviously actually run in
> practice with much less (ie for me that argument size is capped at a
> quarter of that 8MB default rlimit).
>
> I have heard of people who want a big stack due to crazy recursion or
> due to just doing otherwise insane things. But needing more than 8MB
> of arg/envp? Not happening.
>
> So I think we could easily do that stack rlimit thing at the very last
> minute, and not have to worry about restoring anything.

We should double check there isn't more than just argv and layout, but
I think both cases could be passed down a value from above instead of
examining current's rlimits.

-Kees

-- 
Kees Cook
Pixel Security

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-06 06:40 +0200
  Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Andy Lutomirski <luto@kernel.org> - 2017-07-06 07:00 +0200
    Re: [RFC][PATCH] exec: Use init rlimits for setuid exec ebiederm@xmission.com (Eric W. Biederman) - 2017-07-06 15:00 +0200
      Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Andy Lutomirski <luto@kernel.org> - 2017-07-06 17:30 +0200
  Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Willy Tarreau <w@1wt.eu> - 2017-07-06 07:50 +0200
  Re: [RFC][PATCH] exec: Use init rlimits for setuid exec ebiederm@xmission.com (Eric W. Biederman) - 2017-07-06 14:50 +0200
    Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Andy Lutomirski <luto@kernel.org> - 2017-07-06 17:40 +0200
  Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-06 18:40 +0200
    Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-06 19:00 +0200
    Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-06 19:30 +0200
      Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-06 20:00 +0200
        Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-06 21:20 +0200
          Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Andy Lutomirski <luto@kernel.org> - 2017-07-07 06:50 +0200
            Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-07 07:10 +0200
            Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 07:20 +0200
              Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-07 07:40 +0200
                Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 07:50 +0200
                Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 08:50 +0200
                Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-07 18:30 +0200
                Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 20:30 +0200
              Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Andy Lutomirski <luto@kernel.org> - 2017-07-07 07:40 +0200
                Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 07:50 +0200
                Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-07 08:10 +0200
                Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 08:20 +0200
                Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-07 18:10 +0200
                Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 20:30 +0200
                Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Andy Lutomirski <luto@kernel.org> - 2017-07-07 17:00 +0200
            Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 07:20 +0200
          Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Michal Hocko <mhocko@kernel.org> - 2017-07-10 10:50 +0200
            Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-10 18:20 +0200
              Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Willy Tarreau <w@1wt.eu> - 2017-07-10 19:00 +0200
            Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-10 18:20 +0200
              Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Michal Hocko <mhocko@kernel.org> - 2017-07-10 18:30 +0200
                Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Michal Hocko <mhocko@kernel.org> - 2017-07-10 20:20 +0200
                Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Rik van Riel <riel@redhat.com> - 2017-07-10 20:40 +0200
    Re: [RFC][PATCH] exec: Use init rlimits for setuid exec Alan Cox <gnomes@lxorguk.ukuu.org.uk> - 2017-07-13 02:00 +0200

csiph-web