From: Kees Cook <keescook@chromium.org>
To: Adrian Ratiu <adrian.ratiu@collabora.com>
Cc: linux-fsdevel@vger.kernel.org, kernel@collabora.com,
linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org,
linux-doc@vger.kernel.org, Guenter Roeck <groeck@chromium.org>,
Doug Anderson <dianders@chromium.org>,
Jann Horn <jannh@google.com>,
Andrew Morton <akpm@linux-foundation.org>,
Randy Dunlap <rdunlap@infradead.org>,
Christian Brauner <brauner@kernel.org>,
Mike Frysinger <vapier@chromium.org>
Subject: Re: [PATCH v2] proc: allow restricting /proc/pid/mem writes
Date: Mon, 4 Mar 2024 09:42:00 -0800 [thread overview]
Message-ID: <202403040940.BAFD26EA4@keescook> (raw)
In-Reply-To: <39f23-65e5d580-3-638b0780@155677577>
On Mon, Mar 04, 2024 at 02:06:43PM +0000, Adrian Ratiu wrote:
> On Saturday, March 02, 2024 01:55 EET, Kees Cook <keescook@chromium.org> wrote:
> > On Fri, Mar 01, 2024 at 11:34:42PM +0200, Adrian Ratiu wrote:
> > > [...]
> > > +# define PROC_PID_MEM_MODE S_IRUSR
> > > +#else
> > > +# define PROC_PID_MEM_MODE (S_IRUSR|S_IWUSR)
> > > +#endif
> >
> > PROC_PID_MEM_MODE will need to be a __ro_after_init variable, set by
> > early_restrict_proc_mem_write, otherwise the mode won't change based on
> > the runtime setting. e.g.:
> >
> > #ifdef CONFIG_SECURITY_PROC_MEM_RESTRICT_WRITE_DEFAULT_ON
> > mode_t proc_pid_mem_mode __ro_after_init = S_IRUSR;
> > #else
> > mode_t proc_pid_mem_mode __ro_after_init = (S_IRUSR|S_IWUSR);
> > #endif
> >
> > DEFINE_STATIC_KEY_MAYBE_RO(CONFIG_SECURITY_PROC_MEM_RESTRICT_WRITE_DEFAULT_ON,
> > restrict_proc_mem_write);
> > ...
> > if (bool_result) {
> > static_branch_enable(&restrict_proc_mem_write);
> > proc_pid_mem_mode = S_IRUSR;
> > } else {
> > static_branch_disable(&restrict_proc_mem_write);
> > proc_pid_mem_mode = (S_IRUSR|S_IWUSR);
> > }
> > ...
> > REG("mem", proc_pid_mem_mode, proc_mem_operations),
>
> I'm having trouble implementing this because the proc_pid_mem_mode initializer needs to be a compile-time constant, so I can't set a runtime value in the REG() definition like suggested above.
Ah. Yeah, so I guess just drop the perms change -- you're already
checking the behavior in the open(), so you can just leave the perms
alone.
--
Kees Cook
next prev parent reply other threads:[~2024-03-04 17:42 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-01 21:34 [PATCH v2] proc: allow restricting /proc/pid/mem writes Adrian Ratiu
2024-03-01 23:55 ` Kees Cook
2024-03-02 10:31 ` Adrian Ratiu
2024-03-04 14:06 ` Adrian Ratiu
2024-03-04 17:42 ` Kees Cook [this message]
2024-03-04 13:20 ` Christian Brauner
2024-03-04 13:48 ` Adrian Ratiu
2024-03-04 14:05 ` Christian Brauner
2024-03-04 14:35 ` Adrian Ratiu
2024-03-04 17:56 ` Kees Cook
2024-03-04 17:49 ` Kees Cook
2024-03-05 8:59 ` Christian Brauner
2024-03-05 9:41 ` Kees Cook
2024-03-05 9:58 ` Christian Brauner
2024-03-05 10:12 ` Kees Cook
2024-03-05 10:32 ` Christian Brauner
2024-03-05 18:37 ` Kees Cook
2024-03-05 19:34 ` Adrian Ratiu
2024-03-05 19:38 ` Kees Cook
2024-03-06 10:31 ` Christian Brauner
2024-03-05 11:03 ` Christian Brauner
2024-03-05 18:33 ` Kees Cook
2024-03-06 10:49 ` Matt Denton
2024-03-05 15:38 ` Adrian Ratiu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202403040940.BAFD26EA4@keescook \
--to=keescook@chromium.org \
--cc=adrian.ratiu@collabora.com \
--cc=akpm@linux-foundation.org \
--cc=brauner@kernel.org \
--cc=dianders@chromium.org \
--cc=groeck@chromium.org \
--cc=jannh@google.com \
--cc=kernel@collabora.com \
--cc=linux-doc@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=rdunlap@infradead.org \
--cc=vapier@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).