Allow Kconfig to set default mmap_min_addr protection

PATCH In review Eric Paris 4 participants 12 messages Dec 19, 2007 – Jan 2, 2008 Security (LSM)

Share & tools

Eric Paris

author

2007-12-19 22:00 UTC #0 lore raw

PATCH 1/1 Allow Kconfig to set default mmap_min_addr protection

Since it was decided that low memory protection from userspace couldn't be turned on by default add a Kconfig option to allow users/distros to set a default at compile time. This value is still tunable after boot in /proc/sys/vm/mmap_min_addr

Signed-off-by Eric Paris <[email protected]>

---

 security/Kconfig    |   18 ++++++++++++++++++
 security/security.c |    4 +++-
 2 files changed, 21 insertions(+), 1 deletions(-)

security/Kconfig +18 -0

index 8086e61..10c9e40 100644
@@ -103,6 +103,24 @@ config SECURITY_ROOTPLUG
 	  
 	  If you are unsure how to answer this question, answer N.
 
+config SECURITY_DEFAULT_MMAP_MIN_ADDR
+        int "Low address space to protect from user allocation"
+        depends on SECURITY
+        default 0
+        help
+	  This is the portion of low virtual memory which should be protected
+	  from userspace allocation.  Keeping a user from writing to low pages
+	  can help reduce the impact of kernel NULL pointer bugs.
+
+	  For most users with lots of address space a value of 65536 is
+	  reasonable and should cause no problems.  Programs which use vm86
+	  functionality would either need additional permissions from either
+	  the LSM or the capabilities module or have this protection disabled.
+
+	  This value can be changed after boot using the
+	  /proc/sys/vm/mmap_min_addr tunable.
+
+
 source security/selinux/Kconfig
 
 endmenu

security/security.c +3 -1

index 0e1f1f1..c784726 100644
@@ -23,7 +23,9 @@ extern struct security_operations dummy_security_ops;
 extern void security_fixup_ops(struct security_operations *ops);
 
 struct security_operations *security_ops;	/* Initialized to NULL */
-unsigned long mmap_min_addr;		/* 0 means no protection */
+
+/* amount of vm to protect from userspace access */
+unsigned long mmap_min_addr = CONFIG_SECURITY_DEFAULT_MMAP_MIN_ADDR;
 
 static inline int verify(struct security_operations *ops)
 {

Jan Engelhardt

2007-12-19 23:29 UTC #1 lore raw

security/Kconfig config SECURITY_ROOTPLUG · line 107

Quoted 3 lines · Eric Paris

security/Kconfig +2 -0

+config SECURITY_DEFAULT_MMAP_MIN_ADDR
+        int "Low address space to protect from user allocation"

Hm, should not this be 'hex'?

Quoted 3 lines

security/Kconfig +3 -0

+        depends on SECURITY
+        default 0
+        help

Eric Paris

author

2007-12-21 20:32 UTC #2 lore raw

Quoted 6 lines · Jan Engelhardt

security/Kconfig config SECURITY_ROOTPLUG · line 107
Quoted 3 lines · Eric Paris
security/Kconfig +2 -0
+config SECURITY_DEFAULT_MMAP_MIN_ADDR
+        int "Low address space to protect from user allocation"
Hm, should not this be 'hex'?

I guess it could be, but the input for /proc/sys/vm/mmap_min_addr is base 10 as well so I figured consistency was a good thing. Do you have strong feelings? I guess so since you posted about it.

-Eric

Jan Engelhardt

2007-12-21 21:10 UTC #3 lore raw

Quoted 10 lines · Eric Paris

Quoted 6 lines · Jan Engelhardt
security/Kconfig config SECURITY_ROOTPLUG · line 107
Quoted 3 lines · Eric Paris
security/Kconfig +2 -0
+config SECURITY_DEFAULT_MMAP_MIN_ADDR
+        int "Low address space to protect from user allocation"
Hm, should not this be 'hex'?
I guess it could be, but the input for /proc/sys/vm/mmap_min_addr is base 10 as well

sysfs is autobase, i.e. echo "0xb000" >/sys/foo will Do The Right Thing.

Quoted 2 lines

so I figured consistency was a good thing. Do you have strong feelings? I guess so since you posted about it.

Willy Tarreau

2007-12-21 21:18 UTC #4 lore raw

Hi Jan,

Quoted 8 lines · Jan Engelhardt

Quoted 6 lines · Eric Paris
Quoted 5 lines · Jan Engelhardt
Quoted 3 lines · Eric Paris
security/Kconfig +2 -0
+config SECURITY_DEFAULT_MMAP_MIN_ADDR
+        int "Low address space to protect from user allocation"

Quoted 6 lines

Quoted 4 lines
Quoted 1 line
Hm, should not this be 'hex'?
I guess it could be, but the input for /proc/sys/vm/mmap_min_addr is base 10 as well
sysfs is autobase, i.e. echo "0xb000" >/sys/foo will Do The Right Thing.

yes but if you cat /proc/sys/vm/mmap_min_addr, it returns in base 10. While most of us have no problem doing an instant conversion, many people will find it painful to convert the output of cat before copying it into their .config.

I'm generally for hex, but here I'd prefer to stay with the in-place format which is already decimal. And as you said, people can still write the hex value into /proc/sys if they want to.

Regards,
Willy

Jan Engelhardt

2007-12-21 22:04 UTC #5 lore raw

Quoted 5 lines · Willy Tarreau

Hi Jan,
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
Quoted 2 lines
security/Kconfig +2 -0
+config SECURITY_DEFAULT_MMAP_MIN_ADDR
+        int "Low address space to protect from user allocation"

Quoted 8 lines

Quoted 6 lines
Quoted 4 lines
Quoted 1 line
Hm, should not this be 'hex'?
I guess it could be, but the input for /proc/sys/vm/mmap_min_addr is base 10 as well
sysfs is autobase, i.e. echo "0xb000" >/sys/foo will Do The Right Thing.
yes but if you cat /proc/sys/vm/mmap_min_addr, it returns in base 10.

sysfs should probably be tuned to output it in a preferred base.

Greg KH

2007-12-21 22:36 UTC #6 lore raw

Quoted 9 lines · Jan Engelhardt

Quoted 7 lines · Willy Tarreau
Hi Jan,
Quoted 5 lines
Quoted 5 lines
Quoted 4 lines
security/Kconfig config SECURITY_ROOTPLUG · line 107
Quoted 2 lines
security/Kconfig +2 -0
+config SECURITY_DEFAULT_MMAP_MIN_ADDR
+        int "Low address space to protect from user allocation"
Hm, should not this be 'hex'?

Quoted 8 lines

Quoted 6 lines
Quoted 4 lines
Quoted 2 lines
I guess it could be, but the input for /proc/sys/vm/mmap_min_addr is base 10 as well
sysfs is autobase, i.e. echo "0xb000" >/sys/foo will Do The Right Thing.
yes but if you cat /proc/sys/vm/mmap_min_addr, it returns in base 10.
sysfs should probably be tuned to output it in a preferred base.

Again, this is sysctl, not sysfs. two very different things...

Jan Engelhardt

2007-12-21 22:59 UTC #7 lore raw

Quoted 11 lines · Greg KH

Quoted 8 lines
Quoted 6 lines
Quoted 4 lines
Quoted 2 lines
I guess it could be, but the input for /proc/sys/vm/mmap_min_addr is base 10 as well
sysfs is autobase, i.e. echo "0xb000" >/sys/foo will Do The Right Thing.
yes but if you cat /proc/sys/vm/mmap_min_addr, it returns in base 10.
sysfs should probably be tuned to output it in a preferred base.
Again, this is sysctl, not sysfs. two very different things...

Argh... :) Just shows that /proc is the wrong place for system variables.

Well, module_params(integer) are autobase, and that's all I needed so far :-D

Eric Paris

author

2008-01-02 17:10 UTC #8 lore raw

Quoted 8 lines · Jan Engelhardt

Quoted 7 lines · Greg KH
Quoted 7 lines
Quoted 6 lines
Quoted 4 lines
Quoted 2 lines
I guess it could be, but the input for /proc/sys/vm/mmap_min_addr is base 10 as well
sysfs is autobase, i.e. echo "0xb000" >/sys/foo will Do The Right Thing.
yes but if you cat /proc/sys/vm/mmap_min_addr, it returns in base 10.

Quoted 8 lines

Quoted 4 lines
Quoted 1 line
sysfs should probably be tuned to output it in a preferred base.
Again, this is sysctl, not sysfs. two very different things...
Argh... :) Just shows that /proc is the wrong place for system variables.
Well, module_params(integer) are autobase, and that's all I needed so far :-D

So in the end we are all happy with the original patch I sent?

-Eric

Jan Engelhardt

2008-01-02 17:26 UTC #9 lore raw

Quoted 3 lines · Eric Paris

So in the end we are all happy with the original patch I sent?

No objections at least :)

Willy Tarreau

2008-01-02 18:16 UTC #10 lore raw

Quoted 6 lines · Jan Engelhardt

Quoted 3 lines · Eric Paris
So in the end we are all happy with the original patch I sent?
No objections at least :)

I agree too. BTW, I've intentionally not merged it into 2.4, I prefer that admins deliberately set the sysctl on their servers than using a kernel in which they forgot it was enabled. But I agree that for wider use, the kernel option will help a lot.

Regards,
Willy

Greg KH

2007-12-21 22:35 UTC #11 lore raw

In reply to Jan Engelhardt

Quoted 8 lines · Jan Engelhardt

Quoted 6 lines · Eric Paris
Quoted 5 lines · Jan Engelhardt
Quoted 3 lines · Eric Paris
security/Kconfig +2 -0
+config SECURITY_DEFAULT_MMAP_MIN_ADDR
+        int "Low address space to protect from user allocation"

Quoted 6 lines

Quoted 4 lines
Quoted 1 line
Hm, should not this be 'hex'?
I guess it could be, but the input for /proc/sys/vm/mmap_min_addr is base 10 as well
sysfs is autobase, i.e. echo "0xb000" >/sys/foo will Do The Right Thing.

Hm, no, that is not sysfs doing this, and sysfs is not autobase in all places. That is sysctl (/proc/sys/), not sysfs.

thanks,

greg k-h