ima_mmap_file returning 0 to userspace as mmap result.

DISCUSSION Dave Jones 3 participants 6 messages Jun 4, 2014 – Jun 6, 2014 Memory management

Share & tools

Dave Jones

author

2014-06-04 23:31 UTC #0 lore raw

I just noticed that trinity was freaking out in places when mmap was returning zero. This surprised me, because I had the mmap_min_addr sysctl set to 64k, so it wasn't a MAP_FIXED mapping that did it.

There's no mention of this return value in the man page, so I dug into the kernel code, and it appears that we do..

sys_mmap
vm_mmap_pgoff
security_mmap_file
ima_file_mmap <- returns 0 if not PROT_EXEC

and then the 0 gets propagated up as a retval all the way to userspace.

It smells to me like we might be violating a standard or two here, and instead of 0 ima should be returning -Esomething

thoughts?

Dave

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>

Michael Kerrisk (man-pages)

2014-06-05 04:40 UTC #1 lore raw

Quoted 12 lines · Dave Jones

I just noticed that trinity was freaking out in places when mmap was returning zero. This surprised me, because I had the mmap_min_addr sysctl set to 64k, so it wasn't a MAP_FIXED mapping that did it.
There's no mention of this return value in the man page, so I dug into the kernel code, and it appears that we do..
sys_mmap
vm_mmap_pgoff
security_mmap_file
ima_file_mmap <- returns 0 if not PROT_EXEC

Quoted 6 lines

and then the 0 gets propagated up as a retval all the way to userspace.
It smells to me like we might be violating a standard or two here, and instead of 0 ima should be returning -Esomething
thoughts?

Seems like either EACCESS or ENOTSUP is appropriate; here's the pieces from POSIX:

EACCES The fildes argument is not open for read, regardless of
the protection specified, or fildes is not open for write and PROT_WRITE was specified for a MAP_SHARED type mapping.

ENOTSUP
The implementation does not support the combination of accesses requested in the prot argument.

ENOTSUP seems to be more appropriate in my reading of the above, though I'd somehow more have expected EACCES.

Cheers,

Michael

Signature · 9 lines

Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to [email protected].  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>

Dave Jones

author

2014-06-05 15:57 UTC #2 lore raw

Quoted 28 lines · Michael Kerrisk (man-pages)

Quoted 12 lines · Dave Jones
I just noticed that trinity was freaking out in places when mmap was returning zero. This surprised me, because I had the mmap_min_addr sysctl set to 64k, so it wasn't a MAP_FIXED mapping that did it.
There's no mention of this return value in the man page, so I dug into the kernel code, and it appears that we do..
sys_mmap
vm_mmap_pgoff
security_mmap_file
ima_file_mmap <- returns 0 if not PROT_EXEC
Quoted 6 lines
and then the 0 gets propagated up as a retval all the way to userspace.
It smells to me like we might be violating a standard or two here, and instead of 0 ima should be returning -Esomething
thoughts?
Seems like either EACCESS or ENOTSUP is appropriate; here's the pieces from POSIX:
EACCES The fildes argument is not open for read, regardless of
the protection specified, or fildes is not open for write and PROT_WRITE was specified for a MAP_SHARED type mapping.

Quoted 6 lines

ENOTSUP
The implementation does not support the combination of accesses requested in the prot argument.
ENOTSUP seems to be more appropriate in my reading of the above, though I'd somehow more have expected EACCES.

I just realised that this affects even kernels with CONFIG_IMA unset, because there we just do 'return 0' unconditionally.

Also, it appears that kernels with CONFIG_SECURITY unset will also return a zero for the same reason.

This is kind of a mess, and has been that way for a long time. Fixing this will require user-visible breakage, but in this case I think it's justified as there's no way an app can do the right thing if it gets a 0 back. Linus ?

Dave

Dave Jones

author

2014-06-05 16:21 UTC #3 lore raw

Quoted 14 lines · Dave Jones

Quoted 13 lines · Michael Kerrisk (man-pages)
Quoted 12 lines · Dave Jones
I just noticed that trinity was freaking out in places when mmap was returning zero. This surprised me, because I had the mmap_min_addr sysctl set to 64k, so it wasn't a MAP_FIXED mapping that did it.
There's no mention of this return value in the man page, so I dug into the kernel code, and it appears that we do..
sys_mmap
vm_mmap_pgoff
security_mmap_file
ima_file_mmap <- returns 0 if not PROT_EXEC

Quoted 7 lines

Quoted 1 line
Quoted 1 line
and then the 0 gets propagated up as a retval all the way to userspace.
I just realised that this affects even kernels with CONFIG_IMA unset, because there we just do 'return 0' unconditionally.
Also, it appears that kernels with CONFIG_SECURITY unset will also return a zero for the same reason.

Hang on, I was misreading that whole security_mmap_file ret handling code. There's something else at work here. I'll dig and get a reproducer.

Dave

Mimi Zohar

2014-06-06 01:49 UTC #4 lore raw

Quoted 17 lines · Dave Jones

Quoted 16 lines · Dave Jones
Quoted 14 lines · Michael Kerrisk (man-pages)
Quoted 13 lines · Dave Jones
I just noticed that trinity was freaking out in places when mmap was returning zero. This surprised me, because I had the mmap_min_addr sysctl set to 64k, so it wasn't a MAP_FIXED mapping that did it.
There's no mention of this return value in the man page, so I dug into the kernel code, and it appears that we do..
sys_mmap
vm_mmap_pgoff
security_mmap_file
ima_file_mmap <- returns 0 if not PROT_EXEC
and then the 0 gets propagated up as a retval all the way to userspace.

Quoted 8 lines

Quoted 5 lines
I just realised that this affects even kernels with CONFIG_IMA unset, because there we just do 'return 0' unconditionally.
Also, it appears that kernels with CONFIG_SECURITY unset will also return a zero for the same reason.
Hang on, I was misreading that whole security_mmap_file ret handling code. There's something else at work here. I'll dig and get a reproducer.

According to security.h, it should return 0 if permission is granted. If IMA is not enabled, it should also return 0. What exactly is the problem?

thanks,

Mimi

Dave Jones

author

2014-06-06 01:56 UTC #5 lore raw

Quoted 16 lines · Mimi Zohar

Quoted 16 lines
Quoted 15 lines
Quoted 9 lines
Quoted 9 lines
There's no mention of this return value in the man page, so I dug into the kernel code, and it appears that we do..
sys_mmap
vm_mmap_pgoff
security_mmap_file
ima_file_mmap <- returns 0 if not PROT_EXEC
and then the 0 gets propagated up as a retval all the way to userspace.
I just realised that this affects even kernels with CONFIG_IMA unset, because there we just do 'return 0' unconditionally.
Also, it appears that kernels with CONFIG_SECURITY unset will also return a zero for the same reason.

Quoted 6 lines

Quoted 2 lines
Hang on, I was misreading that whole security_mmap_file ret handling code. There's something else at work here. I'll dig and get a reproducer.
According to security.h, it should return 0 if permission is granted. If IMA is not enabled, it should also return 0. What exactly is the problem?

Still digging. I managed to get this to reproduce constantly last night, but no luck today. From re-reading the code though, I think IMA/lsm isn't the problem.

Dave