Messages in this thread | | | From | Kees Cook <> | Date | Thu, 6 Jul 2017 22:49:18 -0700 | Subject | Re: [RFC][PATCH] exec: Use init rlimits for setuid exec |
| |
On Thu, Jul 6, 2017 at 10:39 PM, Linus Torvalds <torvalds@linux-foundation.org> wrote: > On Thu, Jul 6, 2017 at 10:15 PM, Kees Cook <keescook@chromium.org> wrote: >> >> I always say this backwards. :P Default is top-down (allocate at high >> addresses and work down toward low). With unlimited stack, allocations >> start at low addresses and work up. Here's the results (shown with >> randomize_va_space sysctl set to 0): > > But this doesn't affect the stack layout itself. > > So we could do the stack copying without much caring, because that > happens first, right? > > So I think we can do all the envp/argv copying first, and then - as we > change the credentials, change the rlimit. And the string copies > wouldn't need to care much - although I guess they are also fine > checking against a possible *smaller* stack rlimit, which is actually > what we'd want.
Yup, agreed.
> And I think the credentials switch (which is the point of no return > anyway) happens before we start mmap'ing the executable etc. We used > to have some odd code there and do it in the completely wrong order > (checking that the binary was executable for the *old* user, which > makes no sense, iirc)
Yeah, it all happens in setup_new_exec(). The first thing is layout selection, then switching credentials. It could be made to take a hint from GNU_STACK (which was parsed before setup_new_exec() is called), check security_bprm_secureexec() and then make the rlimit changes, all before the layout selection.
> So I'm getting the sense that none of this should be a problem. > > But it's entirely possible that I missed something, and am just full > of shit. Our execve() path has traditionally been very hard to read. > It's actually gotten a bit better, but the whole "jump back and forth > between the generic fs/exec.c code and the binfmt code" is certainly > still there.
Yeah, there might be something else lurking here, but so far, I'm satisfied this will work too.
-Kees
-- Kees Cook Pixel Security
| |