From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-3.1 required=5.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.4 Received: from second.openwall.net (second.openwall.net [193.110.157.125]) by inbox.vuxu.org (Postfix) with SMTP id AC0262C7F0 for ; Wed, 21 Feb 2024 21:18:34 +0100 (CET) Received: (qmail 17524 invoked by uid 550); 21 Feb 2024 20:15:11 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: musl@lists.openwall.com Received: (qmail 17503 invoked from network); 21 Feb 2024 20:15:11 -0000 Date: Wed, 21 Feb 2024 15:18:37 -0500 From: "dalias@libc.org" To: "Edgecombe, Rick P" Cc: "linux-arch@vger.kernel.org" , "suzuki.poulose@arm.com" , "Szabolcs.Nagy@arm.com" , "musl@lists.openwall.com" , "linux-fsdevel@vger.kernel.org" , "linux-riscv@lists.infradead.org" , "kvmarm@lists.linux.dev" , "corbet@lwn.net" , "linux-kernel@vger.kernel.org" , "catalin.marinas@arm.com" , "broonie@kernel.org" , "oliver.upton@linux.dev" , "palmer@dabbelt.com" , "debug@rivosinc.com" , "aou@eecs.berkeley.edu" , "shuah@kernel.org" , "arnd@arndb.de" , "maz@kernel.org" , "oleg@redhat.com" , "fweimer@redhat.com" , "keescook@chromium.org" , "james.morse@arm.com" , "ebiederm@xmission.com" , "will@kernel.org" , "brauner@kernel.org" , "hjl.tools@gmail.com" , "linux-kselftest@vger.kernel.org" , "paul.walmsley@sifive.com" , "ardb@kernel.org" , "linux-arm-kernel@lists.infradead.org" , "linux-mm@kvack.org" , "thiago.bauermann@linaro.org" , "akpm@linux-foundation.org" , "sorear@fastmail.com" , "linux-doc@vger.kernel.org" Message-ID: <20240221201837.GW4163@brightrain.aerifal.cx> References: <20240221012736.GQ4163@brightrain.aerifal.cx> <20240221145800.GR4163@brightrain.aerifal.cx> <4a3809e8-61b2-4341-a868-292ba6e64e8a@sirena.org.uk> <20240221175717.GS4163@brightrain.aerifal.cx> <20240221183055.GT4163@brightrain.aerifal.cx> <20240221190639.GU4163@brightrain.aerifal.cx> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Subject: Re: [musl] Re: [PATCH v8 00/38] arm64/gcs: Provide support for GCS in userspace On Wed, Feb 21, 2024 at 07:22:21PM +0000, Edgecombe, Rick P wrote: > On Wed, 2024-02-21 at 14:06 -0500, dalias@libc.org wrote: > > Due to arbitrarily nestable signal frames, no, this does not suffice. > > An interrupted operation using the lock could be arbitrarily delayed, > > even never execute again, making any call to dlopen deadlock. > > Doh! Yep, it is not robust to this. The only thing that could be done > would be a timeout in dlopen(). Which would make the whole thing just > better than nothing. > > > > > > > > > > It's fine to turn RDSSP into an actual emulated read of the SSP, or > > at > > least an emulated load of zero so that uninitialized data is not left > > in the target register. > > We can't intercept RDSSP, but it becomes a NOP by default. (disclaimer > x86-only knowledge). OK, then I think the contract just has to be that userspace, in a process that might dynamically disable shadow stack, needs to do something like xor %reg,%reg before rdssp so that the outcome is deterministic in disabled case. > > If doing the latter, code working with the > > shadow stack just needs to be prepared for the possibility that it > > could be async-disabled, and check the return value. > > > > I have not looked at all the instructions that become #UD but I > > suspect they all have reasonable trivial ways to implement a > > "disabled" version of them that userspace can act upon reasonably. > > This would have to be thought through functionally and performance > wise. I'm not opposed if can come up with a fully fleshed out plan. How > serious are you in pursuing musl support, if we had something like > this? Up til this thread, my position was pretty much "nope" because it looked like it could not be done in a way compatible with existing interface requirements. However, what's been discussed here, contingent on a dynamic-disable (ideally allowing choice of per-thread or global, to minimize loss of hardening properties), Personally, I believe shadow stack has very low hardening value relative to cost/complexity, and my leaning would be just to ignore it. However, I also know it becomes marketing pressure, including pressure on distros that use musl -- "Why doesn't [distro] do shadow stack?? I thought you were security oriented!!!" -- and if it can be done in a non-breaking and non-invasive way, I think it's reasonable to pursue and make something work. > HJ, any thoughts on whether glibc would use this as well? > > It is probably worth mentioning that from the security side (as Mark > mentioned there is always tension in the tradeoffs on these features), > permissive mode is seen by some as something that weakens security too > much. Apps could call dlopen() on a known unsupported DSO before doing > ROP. I don't know if you have any musl users with specific shadow stack > use cases to ask about this. Yes, this is potentially an argument for something like the option 2, if there's a way to leave SS enabled but then trap when something goes wrong, detect if it went wrong via SS-incompatible library code, and lazily disable SS, otherwise terminate. But I just realized, I'm not even sure why shared libraries need to be explicitly SS-compatible. Unless they're doing their own asm stack switches, shouldn't they just work by default? And since I don't understand this reason, I also don't understand what the failure mode is when an incompatible library is loaded, and thus whether it would be possible to detect and attribute the failure to the library, or whether the library would induce failure somewhere else. Anyway, a mechanism to allow the userspace implementation to disable SS doesn't inherently expose a means to do that. A system integrator doing maximum hardening might choose to build all libraries as SS-compatible, or to patch the loader to refuse to load incompatible libraries. Rich