Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1517673 > unrolled thread
| Started by | Josh Triplett <josh@joshtriplett.org> |
|---|---|
| First post | 2016-11-09 01:20 +0100 |
| Last post | 2016-11-09 02:10 +0100 |
| Articles | 5 — 2 participants |
Back to article view | Back to linux.kernel
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
[PATCH 2/2] kernel: Support compiling out the prctl syscall Josh Triplett <josh@joshtriplett.org> - 2016-11-09 01:20 +0100
Re: [PATCH 2/2] kernel: Support compiling out the prctl syscall Kees Cook <keescook@chromium.org> - 2016-11-09 01:50 +0100
Re: [PATCH 2/2] kernel: Support compiling out the prctl syscall Josh Triplett <josh@joshtriplett.org> - 2016-11-09 01:50 +0100
Re: [PATCH 2/2] kernel: Support compiling out the prctl syscall Kees Cook <keescook@chromium.org> - 2016-11-09 02:00 +0100
Re: [PATCH 2/2] kernel: Support compiling out the prctl syscall Josh Triplett <josh@joshtriplett.org> - 2016-11-09 02:10 +0100
| From | Josh Triplett <josh@joshtriplett.org> |
|---|---|
| Date | 2016-11-09 01:20 +0100 |
| Subject | [PATCH 2/2] kernel: Support compiling out the prctl syscall |
| Message-ID | <sBoMp-8k7-15@gated-at.bofh.it> |
Some embedded systems can do without the prctl syscall, saving some space. This also avoids regular increases in tinyconfig size as people add more non-optional functionality to prctl (observed via the 0-day kernel infrastructure). bloat-o-meter results: add/remove: 0/3 grow/shrink: 0/1 up/down: 0/-2143 (-2143) function old new delta offsets 23 12 -11 prctl_set_auxv 97 - -97 sys_prctl 794 - -794 prctl_set_mm 1241 - -1241 Total: Before=1902583, After=1900440, chg -0.11% Signed-off-by: Josh Triplett <josh@joshtriplett.org> --- init/Kconfig | 12 ++++++++++++ kernel/Makefile | 3 ++- kernel/sys_ni.c | 1 + 3 files changed, 15 insertions(+), 1 deletion(-) diff --git a/init/Kconfig b/init/Kconfig index 34407f1..1dd671c 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1408,6 +1408,18 @@ config MULTIUSER If unsure, say Y here. +config PRCTL + bool "prctl syscall" if EXPERT + default y + help + This option enables the prctl syscall, used for a variety of + operations on the current process. + + If building an embedded system where no applications or libraries use + prctl, you can disable this option to save space. + + If unsure, say Y here. + config SGETMASK_SYSCALL bool "sgetmask/ssetmask syscalls support" if EXPERT def_bool PARISC || MN10300 || BLACKFIN || M68K || PPC || MIPS || X86 || SPARC || CRIS || MICROBLAZE || SUPERH diff --git a/kernel/Makefile b/kernel/Makefile index 37c6d4c..43fb4ca 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -9,9 +9,10 @@ obj-y = fork.o exec_domain.o panic.o \ extable.o params.o \ kthread.o sys_ni.o nsproxy.o \ notifier.o ksysfs.o cred.o reboot.o \ - async.o range.o smpboot.o ucount.o prctl.o + async.o range.o smpboot.o ucount.o obj-$(CONFIG_MULTIUSER) += groups.o +obj-$(CONFIG_PRCTL) += prctl.o ifdef CONFIG_FUNCTION_TRACER # Do not trace internal ftrace files diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c index 635482e..84fd646 100644 --- a/kernel/sys_ni.c +++ b/kernel/sys_ni.c @@ -175,6 +175,7 @@ cond_syscall(sys_setfsgid); cond_syscall(sys_capget); cond_syscall(sys_capset); cond_syscall(sys_copy_file_range); +cond_syscall(sys_prctl); /* arch-specific weak syscall entries */ cond_syscall(sys_pciconfig_read); -- git-series 0.8.11
[toc] | [next] | [standalone]
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Date | 2016-11-09 01:50 +0100 |
| Message-ID | <sBpfr-8tX-5@gated-at.bofh.it> |
| In reply to | #1517673 |
On Tue, Nov 8, 2016 at 4:18 PM, Josh Triplett <josh@joshtriplett.org> wrote: > Some embedded systems can do without the prctl syscall, saving some > space. > > This also avoids regular increases in tinyconfig size as people add more > non-optional functionality to prctl (observed via the 0-day kernel > infrastructure). > > bloat-o-meter results: > > add/remove: 0/3 grow/shrink: 0/1 up/down: 0/-2143 (-2143) > function old new delta > offsets 23 12 -11 > prctl_set_auxv 97 - -97 > sys_prctl 794 - -794 > prctl_set_mm 1241 - -1241 > Total: Before=1902583, After=1900440, chg -0.11% > > Signed-off-by: Josh Triplett <josh@joshtriplett.org> I'm absolutely a fan of doing this, but I wonder how this interacts with the LSMs that define prctl hooks, etc. I wouldn't expect a system that didn't want prctl to want an LSM, but maybe the LSMs all need to depend on CONFIG_PRCTL now? -Kees > --- > init/Kconfig | 12 ++++++++++++ > kernel/Makefile | 3 ++- > kernel/sys_ni.c | 1 + > 3 files changed, 15 insertions(+), 1 deletion(-) > > diff --git a/init/Kconfig b/init/Kconfig > index 34407f1..1dd671c 100644 > --- a/init/Kconfig > +++ b/init/Kconfig > @@ -1408,6 +1408,18 @@ config MULTIUSER > > If unsure, say Y here. > > +config PRCTL > + bool "prctl syscall" if EXPERT > + default y > + help > + This option enables the prctl syscall, used for a variety of > + operations on the current process. > + > + If building an embedded system where no applications or libraries use > + prctl, you can disable this option to save space. > + > + If unsure, say Y here. > + > config SGETMASK_SYSCALL > bool "sgetmask/ssetmask syscalls support" if EXPERT > def_bool PARISC || MN10300 || BLACKFIN || M68K || PPC || MIPS || X86 || SPARC || CRIS || MICROBLAZE || SUPERH > diff --git a/kernel/Makefile b/kernel/Makefile > index 37c6d4c..43fb4ca 100644 > --- a/kernel/Makefile > +++ b/kernel/Makefile > @@ -9,9 +9,10 @@ obj-y = fork.o exec_domain.o panic.o \ > extable.o params.o \ > kthread.o sys_ni.o nsproxy.o \ > notifier.o ksysfs.o cred.o reboot.o \ > - async.o range.o smpboot.o ucount.o prctl.o > + async.o range.o smpboot.o ucount.o > > obj-$(CONFIG_MULTIUSER) += groups.o > +obj-$(CONFIG_PRCTL) += prctl.o > > ifdef CONFIG_FUNCTION_TRACER > # Do not trace internal ftrace files > diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c > index 635482e..84fd646 100644 > --- a/kernel/sys_ni.c > +++ b/kernel/sys_ni.c > @@ -175,6 +175,7 @@ cond_syscall(sys_setfsgid); > cond_syscall(sys_capget); > cond_syscall(sys_capset); > cond_syscall(sys_copy_file_range); > +cond_syscall(sys_prctl); > > /* arch-specific weak syscall entries */ > cond_syscall(sys_pciconfig_read); > -- > git-series 0.8.11 -- Kees Cook Nexus Security
[toc] | [prev] | [next] | [standalone]
| From | Josh Triplett <josh@joshtriplett.org> |
|---|---|
| Date | 2016-11-09 01:50 +0100 |
| Message-ID | <sBpfr-8tX-9@gated-at.bofh.it> |
| In reply to | #1517690 |
On Tue, Nov 08, 2016 at 04:40:02PM -0800, Kees Cook wrote: > On Tue, Nov 8, 2016 at 4:18 PM, Josh Triplett <josh@joshtriplett.org> wrote: > > Some embedded systems can do without the prctl syscall, saving some > > space. > > > > This also avoids regular increases in tinyconfig size as people add more > > non-optional functionality to prctl (observed via the 0-day kernel > > infrastructure). > > > > bloat-o-meter results: > > > > add/remove: 0/3 grow/shrink: 0/1 up/down: 0/-2143 (-2143) > > function old new delta > > offsets 23 12 -11 > > prctl_set_auxv 97 - -97 > > sys_prctl 794 - -794 > > prctl_set_mm 1241 - -1241 > > Total: Before=1902583, After=1900440, chg -0.11% > > > > Signed-off-by: Josh Triplett <josh@joshtriplett.org> > > I'm absolutely a fan of doing this, but I wonder how this interacts > with the LSMs that define prctl hooks, etc. I wouldn't expect a system > that didn't want prctl to want an LSM, but maybe the LSMs all need to > depend on CONFIG_PRCTL now? I did think about that (as well as SECCOMP), but I did confirm that the kernel builds fine with allyesconfig minus CONFIG_PRCTL. An LSM that wants to restrict access to some prctls should be fine with no process having any access to prctl. :) Beyond that, anything wanting configuration via LSM (such as SECCOMP) still exists and functions, even if you can't access it from outside the kernel.
[toc] | [prev] | [next] | [standalone]
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Date | 2016-11-09 02:00 +0100 |
| Message-ID | <sBpp8-5o-7@gated-at.bofh.it> |
| In reply to | #1517692 |
On Tue, Nov 8, 2016 at 4:47 PM, Josh Triplett <josh@joshtriplett.org> wrote: > On Tue, Nov 08, 2016 at 04:40:02PM -0800, Kees Cook wrote: >> On Tue, Nov 8, 2016 at 4:18 PM, Josh Triplett <josh@joshtriplett.org> wrote: >> > Some embedded systems can do without the prctl syscall, saving some >> > space. >> > >> > This also avoids regular increases in tinyconfig size as people add more >> > non-optional functionality to prctl (observed via the 0-day kernel >> > infrastructure). >> > >> > bloat-o-meter results: >> > >> > add/remove: 0/3 grow/shrink: 0/1 up/down: 0/-2143 (-2143) >> > function old new delta >> > offsets 23 12 -11 >> > prctl_set_auxv 97 - -97 >> > sys_prctl 794 - -794 >> > prctl_set_mm 1241 - -1241 >> > Total: Before=1902583, After=1900440, chg -0.11% >> > >> > Signed-off-by: Josh Triplett <josh@joshtriplett.org> >> >> I'm absolutely a fan of doing this, but I wonder how this interacts >> with the LSMs that define prctl hooks, etc. I wouldn't expect a system >> that didn't want prctl to want an LSM, but maybe the LSMs all need to >> depend on CONFIG_PRCTL now? > > I did think about that (as well as SECCOMP), but I did confirm that the > kernel builds fine with allyesconfig minus CONFIG_PRCTL. An LSM that > wants to restrict access to some prctls should be fine with no process > having any access to prctl. :) Beyond that, anything wanting > configuration via LSM (such as SECCOMP) still exists and functions, even > if you can't access it from outside the kernel. Okay, testing that is good, thanks. Seccomp can use the seccomp() syscall, so missing prctl isn't a big deal there. Things like Yama, though, are almost useless in the !PRCTL case. I think a "depends on PRCTL" should be added at least to Yama. All the other LSMs are configured in other ways, and they'll just have some dead code around their prctl hooks; no big deal. This does also beg the question about how to configure some process behaviors by default if PRCTL is disabled, but if people want those things, they can write patches, I would think. :) -Kees -- Kees Cook Nexus Security
[toc] | [prev] | [next] | [standalone]
| From | Josh Triplett <josh@joshtriplett.org> |
|---|---|
| Date | 2016-11-09 02:10 +0100 |
| Message-ID | <sBpyN-nY-15@gated-at.bofh.it> |
| In reply to | #1517696 |
On November 8, 2016 4:56:54 PM PST, Kees Cook <keescook@chromium.org> wrote: >On Tue, Nov 8, 2016 at 4:47 PM, Josh Triplett <josh@joshtriplett.org> >wrote: >> On Tue, Nov 08, 2016 at 04:40:02PM -0800, Kees Cook wrote: >>> On Tue, Nov 8, 2016 at 4:18 PM, Josh Triplett ><josh@joshtriplett.org> wrote: >>> > Some embedded systems can do without the prctl syscall, saving >some >>> > space. >>> > >>> > This also avoids regular increases in tinyconfig size as people >add more >>> > non-optional functionality to prctl (observed via the 0-day kernel >>> > infrastructure). >>> > >>> > bloat-o-meter results: >>> > >>> > add/remove: 0/3 grow/shrink: 0/1 up/down: 0/-2143 (-2143) >>> > function old new delta >>> > offsets 23 12 -11 >>> > prctl_set_auxv 97 - -97 >>> > sys_prctl 794 - -794 >>> > prctl_set_mm 1241 - -1241 >>> > Total: Before=1902583, After=1900440, chg -0.11% >>> > >>> > Signed-off-by: Josh Triplett <josh@joshtriplett.org> >>> >>> I'm absolutely a fan of doing this, but I wonder how this interacts >>> with the LSMs that define prctl hooks, etc. I wouldn't expect a >system >>> that didn't want prctl to want an LSM, but maybe the LSMs all need >to >>> depend on CONFIG_PRCTL now? >> >> I did think about that (as well as SECCOMP), but I did confirm that >the >> kernel builds fine with allyesconfig minus CONFIG_PRCTL. An LSM that >> wants to restrict access to some prctls should be fine with no >process >> having any access to prctl. :) Beyond that, anything wanting >> configuration via LSM (such as SECCOMP) still exists and functions, >even >> if you can't access it from outside the kernel. > >Okay, testing that is good, thanks. > >Seccomp can use the seccomp() syscall, so missing prctl isn't a big >deal there. > >Things like Yama, though, are almost useless in the !PRCTL case. I >think a "depends on PRCTL" should be added at least to Yama. All the >other LSMs are configured in other ways, and they'll just have some >dead code around their prctl hooks; no big deal. OK, I'll add that dependency to Yama in v2. >This does also beg the question about how to configure some process >behaviors by default if PRCTL is disabled, but if people want those >things, they can write patches, I would think. :) Agreed.
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web