Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1441531 > unrolled thread

[PATCH] prctl: remove one-shot limitation for changing exe link

Back to article view | Back to linux.kernel

Contents

  [PATCH] prctl: remove one-shot limitation for changing exe link Stanislav Kinsburskiy <skinsbursky@virtuozzo.com> - 2016-07-12 18:20 +0200
    Re: [PATCH] prctl: remove one-shot limitation for changing exe link Oleg Nesterov <oleg@redhat.com> - 2016-07-12 18:50 +0200
      Re: [PATCH] prctl: remove one-shot limitation for changing exe link Oleg Nesterov <oleg@redhat.com> - 2016-07-12 19:10 +0200
    Re: [PATCH] prctl: remove one-shot limitation for changing exe link Cyrill Gorcunov <gorcunov@gmail.com> - 2016-07-12 18:50 +0200
      Re: [PATCH] prctl: remove one-shot limitation for changing exe link ebiederm@xmission.com (Eric W. Biederman) - 2016-07-12 19:10 +0200
        Re: [PATCH] prctl: remove one-shot limitation for changing exe link Cyrill Gorcunov <gorcunov@gmail.com> - 2016-07-12 19:30 +0200
          Re: [PATCH] prctl: remove one-shot limitation for changing exe link Cyrill Gorcunov <gorcunov@gmail.com> - 2016-07-12 23:50 +0200
        Re: [PATCH] prctl: remove one-shot limitation for changing exe link One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> - 2016-07-18 22:20 +0200
    Re: [PATCH] prctl: remove one-shot limitation for changing exe link ebiederm@xmission.com (Eric W. Biederman) - 2016-07-25 20:40 +0200
      Re: [PATCH] prctl: remove one-shot limitation for changing exe link Cyrill Gorcunov <gorcunov@gmail.com> - 2016-07-25 21:30 +0200
        Re: [PATCH] prctl: remove one-shot limitation for changing exe link ebiederm@xmission.com (Eric W. Biederman) - 2016-07-25 22:20 +0200

#1441531 — [PATCH] prctl: remove one-shot limitation for changing exe link

This limitation came with the reason to remove "another
way for malicious code to obscure a compromised program and
masquerade as a benign process" by allowing "security-concious program can use
this prctl once during its early initialization to ensure the prctl cannot
later be abused for this purpose":

http://marc.info/?l=linux-kernel&m=133160684517468&w=2

But the way how the feature can be used is the following:

1) Attach to process via ptrace (protected by CAP_SYS_PTRACE)
2) Unmap all the process file mappings, related to "exe" file.
3) Change exe link (protected by CAP_SYS_RESOURCE).

IOW, some other process already has an access to process internals (and thus
it's already compromised), and can inject fork and use the child of the
compromised program to masquerade.
Which means this limitation doesn't solve the problem it was aimed to.

While removing this limitation allow to replace files from underneath of a
running process as many times as required. One of the use cases is network
file systems migration (NFS, to be precise) by CRIU.

NFS mount can't be mounted on restore stage because network is locked.
To overcome this limitation, another file system (FUSE-based) is used. Then
opened files replaced by the proper ones NFS is remounted.
Thus exe link replace has to be done twice: first on restore stage and second
- when actual NFS was remounted.

Signed-off-by: Stanislav Kinsburskiy <skinsbursky@virtuozzo.com>
---
 include/linux/sched.h |    4 +++-
 kernel/sys.c          |   10 ----------
 2 files changed, 3 insertions(+), 11 deletions(-)

diff --git a/include/linux/sched.h b/include/linux/sched.h
index 553af29..83b5f2d 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -518,7 +518,9 @@ static inline int get_dumpable(struct mm_struct *mm)
 					/* leave room for more dump flags */
 #define MMF_VM_MERGEABLE	16	/* KSM may merge identical pages */
 #define MMF_VM_HUGEPAGE		17	/* set when VM_HUGEPAGE is set on vma */
-#define MMF_EXE_FILE_CHANGED	18	/* see prctl_set_mm_exe_file() */
+/* This ine-shot flag is droped due to necessivity of changing exe once again
+ * on NFS restore */
+//#define MMF_EXE_FILE_CHANGED	18	/* see prctl_set_mm_exe_file() */
 
 #define MMF_HAS_UPROBES		19	/* has uprobes */
 #define MMF_RECALC_UPROBES	20	/* MMF_HAS_UPROBES can be wrong */
diff --git a/kernel/sys.c b/kernel/sys.c
index 89d5be4..fd6f508 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1696,16 +1696,6 @@ static int prctl_set_mm_exe_file(struct mm_struct *mm, unsigned int fd)
 		fput(exe_file);
 	}
 
-	/*
-	 * The symlink can be changed only once, just to disallow arbitrary
-	 * transitions malicious software might bring in. This means one
-	 * could make a snapshot over all processes running and monitor
-	 * /proc/pid/exe changes to notice unusual activity if needed.
-	 */
-	err = -EPERM;
-	if (test_and_set_bit(MMF_EXE_FILE_CHANGED, &mm->flags))
-		goto exit;
-
 	err = 0;
 	/* set the new file, lockless */
 	get_file(exe.file);

[toc] | [next] | [standalone]

#1441554

On 07/12, Stanislav Kinsburskiy wrote:
>
> --- a/kernel/sys.c
> +++ b/kernel/sys.c
> @@ -1696,16 +1696,6 @@ static int prctl_set_mm_exe_file(struct mm_struct *mm, unsigned int fd)
>  		fput(exe_file);
>  	}
>  
> -	/*
> -	 * The symlink can be changed only once, just to disallow arbitrary
> -	 * transitions malicious software might bring in. This means one
> -	 * could make a snapshot over all processes running and monitor
> -	 * /proc/pid/exe changes to notice unusual activity if needed.
> -	 */
> -	err = -EPERM;
> -	if (test_and_set_bit(MMF_EXE_FILE_CHANGED, &mm->flags))
> -		goto exit;
> -

I didn't even try to read the changelog so I do not know why do you
want this change ;)

But I would like to ack it in any case. I never understood why do we
want/need this MMF_EXE_FILE_CHANGED check, I suggested to remove it
many times.

And can't resist, please note the xchg() below. Currently (before this
patch) we do not need it. I was specially added to ensure that we can
just remove this test_and_set_bit(MMF_EXE_FILE_CHANGED) without adding
a race.

Acked-by: Oleg Nesterov <oleg@redhat.com>

[toc] | [prev] | [next] | [standalone]

#1441598

On 07/12, Stanislav Kinsburskiy wrote:
>
> 12.07.2016 18:42, Oleg Nesterov пишет:
>> But I would like to ack it in any case. I never understood why do we
>> want/need this MMF_EXE_FILE_CHANGED check, I suggested to remove it
>> many times.
>>
>> And can't resist, please note the xchg() below. Currently (before this
>> patch) we do not need it. I was specially added to ensure that we can
>> just remove this test_and_set_bit(MMF_EXE_FILE_CHANGED) without adding
>> a race.
>
> Thanks, Oleg. I'll take a look.
> But should this be addressed in this patch? Especially if it's not
> needed even now (before this patch)?

Sorry for confusion...

Yes, it is not needed now (before this patch). Because only one caller
of prctl_set_mm_exe_file() can succced and update mm->exe_file. So we
could just do

	fput(mm->exe_file);
	mm->exe_file = get_file(exe.file);


But after this patch we do need this xchg(), otherwise 2 callers of
prctl_set_mm_exe_file() can race with each other. And this was the
actual reason for xchg: simplify the MMF_EXE_FILE_CHANGED removal in
future.

Oleg.

[toc] | [prev] | [next] | [standalone]

#1441556

On Tue, Jul 12, 2016 at 07:30:29PM +0400, Stanislav Kinsburskiy wrote:
> This limitation came with the reason to remove "another
> way for malicious code to obscure a compromised program and
> masquerade as a benign process" by allowing "security-concious program can use
> this prctl once during its early initialization to ensure the prctl cannot
> later be abused for this purpose":
> 
> http://marc.info/?l=linux-kernel&m=133160684517468&w=2
> 
> But the way how the feature can be used is the following:
> 
> 1) Attach to process via ptrace (protected by CAP_SYS_PTRACE)
> 2) Unmap all the process file mappings, related to "exe" file.
> 3) Change exe link (protected by CAP_SYS_RESOURCE).
> 
> IOW, some other process already has an access to process internals (and thus
> it's already compromised), and can inject fork and use the child of the
> compromised program to masquerade.
> Which means this limitation doesn't solve the problem it was aimed to.
> 
> While removing this limitation allow to replace files from underneath of a
> running process as many times as required. One of the use cases is network
> file systems migration (NFS, to be precise) by CRIU.
> 
> NFS mount can't be mounted on restore stage because network is locked.
> To overcome this limitation, another file system (FUSE-based) is used. Then
> opened files replaced by the proper ones NFS is remounted.
> Thus exe link replace has to be done twice: first on restore stage and second
> - when actual NFS was remounted.
> 
> Signed-off-by: Stanislav Kinsburskiy <skinsbursky@virtuozzo.com>

Persistent exe-link doesn't guarantee anything if you have rights to ptrace
task and inject own code into (from security POV). So lets rip it out.

Acked-by: Cyrill Gorcunov <gorcunov@openvz.org>

[toc] | [prev] | [next] | [standalone]

#1441593

Cyrill Gorcunov <gorcunov@gmail.com> writes:

> On Tue, Jul 12, 2016 at 07:30:29PM +0400, Stanislav Kinsburskiy wrote:
>> This limitation came with the reason to remove "another
>> way for malicious code to obscure a compromised program and
>> masquerade as a benign process" by allowing "security-concious program can use
>> this prctl once during its early initialization to ensure the prctl cannot
>> later be abused for this purpose":
>> 
>> http://marc.info/?l=linux-kernel&m=133160684517468&w=2
>> 
>> But the way how the feature can be used is the following:
>> 
>> 1) Attach to process via ptrace (protected by CAP_SYS_PTRACE)
>> 2) Unmap all the process file mappings, related to "exe" file.
>> 3) Change exe link (protected by CAP_SYS_RESOURCE).
>> 
>> IOW, some other process already has an access to process internals (and thus
>> it's already compromised), and can inject fork and use the child of the
>> compromised program to masquerade.
>> Which means this limitation doesn't solve the problem it was aimed to.
>> 
>> While removing this limitation allow to replace files from underneath of a
>> running process as many times as required. One of the use cases is network
>> file systems migration (NFS, to be precise) by CRIU.
>> 
>> NFS mount can't be mounted on restore stage because network is locked.
>> To overcome this limitation, another file system (FUSE-based) is used. Then
>> opened files replaced by the proper ones NFS is remounted.
>> Thus exe link replace has to be done twice: first on restore stage and second
>> - when actual NFS was remounted.
>> 
>> Signed-off-by: Stanislav Kinsburskiy <skinsbursky@virtuozzo.com>
>
> Persistent exe-link doesn't guarantee anything if you have rights to ptrace
> task and inject own code into (from security POV). So lets rip it out.
>
> Acked-by: Cyrill Gorcunov <gorcunov@openvz.org>

I believe the original concern was someone injecting a code into a
process and playing silly buggers with the exe link.  Someone who does
not have ptrace capability.

It is completely not ok to change this until someone goes back to the
original conversation and looks at the original threat model, and
refutes it.

Eric

[toc] | [prev] | [next] | [standalone]

#1441609

On Tue, Jul 12, 2016 at 11:52:09AM -0500, Eric W. Biederman wrote:
> >
> > Persistent exe-link doesn't guarantee anything if you have rights to ptrace
> > task and inject own code into (from security POV). So lets rip it out.
> >
> > Acked-by: Cyrill Gorcunov <gorcunov@openvz.org>
> 
> I believe the original concern was someone injecting a code into a
> process and playing silly buggers with the exe link.  Someone who does
> not have ptrace capability.

If you manage to inject code into a process, that's all, you're
compromised, preventing changing exe-link several times wont help
much I fear. Current limit -- one may change it once, Stas' patch
simply removes this limitation. The ability to change it only _once_
may be suitable for some kind of monitor daemon I guess but this
monitor should detect any change in exe-link state and notify
node's admin, otherwise it's simply useless.

> It is completely not ok to change this until someone goes back to the
> original conversation and looks at the original threat model, and
> refutes it.

[toc] | [prev] | [next] | [standalone]

#1441756

On Tue, Jul 12, 2016 at 08:29:33PM +0300, Cyrill Gorcunov wrote:
> On Tue, Jul 12, 2016 at 11:52:09AM -0500, Eric W. Biederman wrote:
> > >
> > > Persistent exe-link doesn't guarantee anything if you have rights to ptrace
> > > task and inject own code into (from security POV). So lets rip it out.
> > >
> > > Acked-by: Cyrill Gorcunov <gorcunov@openvz.org>
> > 
> > I believe the original concern was someone injecting a code into a
> > process and playing silly buggers with the exe link.  Someone who does
> > not have ptrace capability.
> 
> If you manage to inject code into a process, that's all, you're
> compromised, preventing changing exe-link several times wont help
> much I fear. Current limit -- one may change it once, Stas' patch
> simply removes this limitation. The ability to change it only _once_
> may be suitable for some kind of monitor daemon I guess but this
> monitor should detect any change in exe-link state and notify
> node's admin, otherwise it's simply useless.
> 
> > It is completely not ok to change this until someone goes back to the
> > original conversation and looks at the original threat model, and
> > refutes it.

Btw, if the persistency of exe link is _that_ important (in which I'm
really doubting) we always can use some of sysctl flag on host which
would control it [by default it might be turned off but for those
who really rely on exelink status, for some reason, the sysctl might
be set up and prevent any exelink modification].

[toc] | [prev] | [next] | [standalone]

#1445817

> >> 1) Attach to process via ptrace (protected by CAP_SYS_PTRACE)
> >> 2) Unmap all the process file mappings, related to "exe" file.
> >> 3) Change exe link (protected by CAP_SYS_RESOURCE).
> >> 
> >> IOW, some other process already has an access to process internals (and thus
> >> it's already compromised), and can inject fork and use the child of the
> >> compromised program to masquerade.
> >> Which means this limitation doesn't solve the problem it was aimed to.

IFF it is the same uid or root (in which case you already lost). In the
case of cross uid activity this is not true.

Alan

[toc] | [prev] | [next] | [standalone]

#1449734

Stanislav Kinsburskiy <skinsbursky@virtuozzo.com> writes:

> Gentlemen,
>
> Looks like there are no objections to this patch.

There has been objection.

The only justification for the change that has been put forward is
someone doing a restore lazily.  I don't see a reason why you can't call
prctl_set_mm_exe_file until you have the file in place instead of a
place holder that sounds like a trivial solution to any restore issues.

The truth is an unlimited settable exe link is essentially meaningless,
as you can't depend on it for anything.  One shot seems the best
compromise I have seen put forward between the definite
checkpoint/restart requirement to set the this value and the general
need to have something that makes sense and people can depend on for
system management.

Also there is a big fat bug in prctl_set_mm_exe_file.  It doesn't
validate that the new file is a actually mmaped executable.  We would
definitely need that to be fixed before even considering removing the
limit.

Right now all I see is people involved in the implementation details of
their own little feature

So for the patch I am responding to:
Nacked-by: "Eric W. Biederman" <ebiederm@xmission.com>

Plus the merge window is open so no one is taking any patches right now.
It is the time to take what has already been staged and get that code
merged.

Eric

[toc] | [prev] | [next] | [standalone]

#1449770

On Mon, Jul 25, 2016 at 01:21:51PM -0500, Eric W. Biederman wrote:
> Stanislav Kinsburskiy <skinsbursky@virtuozzo.com> writes:
> 
> > Gentlemen,
> >
> > Looks like there are no objections to this patch.
> 
> There has been objection.
> 
> The only justification for the change that has been put forward is
> someone doing a restore lazily.  I don't see a reason why you can't call
> prctl_set_mm_exe_file until you have the file in place instead of a
> place holder that sounds like a trivial solution to any restore issues.
> 
> The truth is an unlimited settable exe link is essentially meaningless,
> as you can't depend on it for anything.  One shot seems the best
> compromise I have seen put forward between the definite
> checkpoint/restart requirement to set the this value and the general
> need to have something that makes sense and people can depend on for
> system management.
>
> Also there is a big fat bug in prctl_set_mm_exe_file.  It doesn't
> validate that the new file is a actually mmaped executable.  We would
> definitely need that to be fixed before even considering removing the
> limit.

Could you please elaborate? We check for inode being executable,
what else needed?

> Right now all I see is people involved in the implementation details of
> their own little feature
> 
> So for the patch I am responding to:
> Nacked-by: "Eric W. Biederman" <ebiederm@xmission.com>
> 
> Plus the merge window is open so no one is taking any patches right now.
> It is the time to take what has already been staged and get that code
> merged.
> 
> Eric
> 

	Cyrill

[toc] | [prev] | [next] | [standalone]

#1449782

Cyrill Gorcunov <gorcunov@gmail.com> writes:

> On Mon, Jul 25, 2016 at 01:21:51PM -0500, Eric W. Biederman wrote:
>> Stanislav Kinsburskiy <skinsbursky@virtuozzo.com> writes:
>> 
>> > Gentlemen,
>> >
>> > Looks like there are no objections to this patch.
>> 
>> There has been objection.
>> 
>> The only justification for the change that has been put forward is
>> someone doing a restore lazily.  I don't see a reason why you can't call
>> prctl_set_mm_exe_file until you have the file in place instead of a
>> place holder that sounds like a trivial solution to any restore issues.
>> 
>> The truth is an unlimited settable exe link is essentially meaningless,
>> as you can't depend on it for anything.  One shot seems the best
>> compromise I have seen put forward between the definite
>> checkpoint/restart requirement to set the this value and the general
>> need to have something that makes sense and people can depend on for
>> system management.
>>
>> Also there is a big fat bug in prctl_set_mm_exe_file.  It doesn't
>> validate that the new file is a actually mmaped executable.  We would
>> definitely need that to be fixed before even considering removing the
>> limit.
>
> Could you please elaborate? We check for inode being executable,
> what else needed?

That the inode is mmaped into the process with executable mappings.

Effectively what we check the old mapping for and refuse to remove the old
mm_exe_file if it exists.

I think a reasonable argument can be made that if the file is
executable, and it is mmaped with executable pages that exe_file is not
a complete lie.

Which is the important part.  At the end of the day how much can
userspace trust /proc/pid/exe?  If we are too lax it is just a random
file descriptor we can not trust at all.  At which point there is
exactly no point in preserving it in checkpoint/restart, because nothing
will trust or look at it.

If the only user is checkpoint/restart perhaps it should be only ptrace
that can set this and not the process itself with a prctl.  I don't
know.  All I know is that we should work on making it a very trustable
value even though in some specific instances we can set it.

Eric

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web