linux/arch
Dave Hansen acd547b298 x86/pkeys: Default to a restrictive init PKRU
PKRU is the register that lets you disallow writes or all access to a given
protection key.

The XSAVE hardware defines an "init state" of 0 for PKRU: its most
permissive state, allowing access/writes to everything.  Since we start off
all new processes with the init state, we start all processes off with the
most permissive possible PKRU.

This is unfortunate.  If a thread is clone()'d [1] before a program has
time to set PKRU to a restrictive value, that thread will be able to write
to all data, no matter what pkey is set on it.  This weakens any integrity
guarantees that we want pkeys to provide.

To fix this, we define a very restrictive PKRU to override the
XSAVE-provided value when we create a new FPU context.  We choose a value
that only allows access to pkey 0, which is as restrictive as we can
practically make it.

This does not cause any practical problems with applications using
protection keys because we require them to specify initial permissions for
each key when it is allocated, which override the restrictive default.

In the end, this ensures that threads which do not know how to manage their
own pkey rights can not do damage to data which is pkey-protected.

I would have thought this was a pretty contrived scenario, except that I
heard a bug report from an MPX user who was creating threads in some very
early code before main().  It may be crazy, but folks evidently _do_ it.

Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: linux-arch@vger.kernel.org
Cc: Dave Hansen <dave@sr71.net>
Cc: mgorman@techsingularity.net
Cc: arnd@arndb.de
Cc: linux-api@vger.kernel.org
Cc: linux-mm@kvack.org
Cc: luto@kernel.org
Cc: akpm@linux-foundation.org
Cc: torvalds@linux-foundation.org
Link: http://lkml.kernel.org/r/20160729163021.F3C25D4A@viggo.jf.intel.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2016-09-09 13:02:28 +02:00
..
alpha x86/pkeys: Allocation/free syscalls 2016-09-09 13:02:27 +02:00
arc ARC: export __udivdi3 for modules 2016-08-19 14:09:33 -07:00
arm Staging/IIO driver fixes for 4.8-rc5 2016-09-03 11:33:33 -07:00
arm64 - arm64 fix: debug exception unmasking on the CPU resume path 2016-09-03 12:31:37 -07:00
avr32 dma-mapping: use unsigned long for dma_attrs 2016-08-04 08:50:07 -04:00
blackfin net: smc91x: fix SMC accesses 2016-08-28 23:44:55 -04:00
c6x dma-mapping: use unsigned long for dma_attrs 2016-08-04 08:50:07 -04:00
cris dma-mapping: use unsigned long for dma_attrs 2016-08-04 08:50:07 -04:00
frv RTC for 4.8 2016-08-05 09:48:22 -04:00
h8300 h8300: Add missing include file to asm/io.h 2016-08-13 08:53:56 -07:00
hexagon dma-mapping: use unsigned long for dma_attrs 2016-08-04 08:50:07 -04:00
ia64 Implements HARDENED_USERCOPY verification of copy_to_user/copy_from_user 2016-08-08 14:48:14 -07:00
m32r mm: do not pass mm_struct into handle_mm_fault 2016-07-26 16:19:19 -07:00
m68k m68knommu: fix user a5 register being overwritten 2016-08-08 12:38:47 +10:00
metag metag: Drop show_mem() from mem_init() 2016-08-09 13:41:30 +01:00
microblaze dma-mapping: use unsigned long for dma_attrs 2016-08-04 08:50:07 -04:00
mips x86/pkeys: Allocation/free syscalls 2016-09-09 13:02:27 +02:00
mn10300 RTC for 4.8 2016-08-05 09:48:22 -04:00
nios2 dma-mapping: use unsigned long for dma_attrs 2016-08-04 08:50:07 -04:00
openrisc dma-mapping: use unsigned long for dma_attrs 2016-08-04 08:50:07 -04:00
parisc x86/pkeys: Allocation/free syscalls 2016-09-09 13:02:27 +02:00
powerpc powerpc: signals: Discard transaction state from signal frames 2016-08-29 12:48:40 +10:00
s390 mm/usercopy: get rid of CONFIG_DEBUG_STRICT_USER_COPY_CHECKS 2016-08-30 10:10:21 -07:00
score treewide: replace obsolete _refok by __ref 2016-08-02 17:31:41 -04:00
sh These changes improve device tree support (including builtin DTB), add 2016-08-06 09:00:05 -04:00
sparc Implements HARDENED_USERCOPY verification of copy_to_user/copy_from_user 2016-08-08 14:48:14 -07:00
tile mm/usercopy: get rid of CONFIG_DEBUG_STRICT_USER_COPY_CHECKS 2016-08-30 10:10:21 -07:00
um um: Don't discard .text.exit section 2016-08-23 23:16:16 +02:00
unicore32 unicore32: mm: Add missing parameter to arch_vma_access_permitted 2016-08-13 08:53:18 -07:00
x86 x86/pkeys: Default to a restrictive init PKRU 2016-09-09 13:02:28 +02:00
xtensa x86/pkeys: Allocation/free syscalls 2016-09-09 13:02:27 +02:00
.gitignore
Kconfig Implements HARDENED_USERCOPY verification of copy_to_user/copy_from_user 2016-08-08 14:48:14 -07:00