Re: CVS commit: src

[jean-Yves Migeon <jym%NetBSD.org@localhost>]

On Wed, 21 Dec 2011 16:47:49 +0100, Reinoud Zandijk wrote:
> The patch is written to allow for multiple non-UVM flags to be 
> attached to
> mappings and allow the kernel to react on them. NetBSD/usermode uses 
> this to
> disallow system calls to be made from within mapped regions and get 
> them
> returned as illegal instructions so it can analyse and emulate the 
> system
> calls. To prevent every process to be scrutinized this way a process 
> flag has
> been introduced to mark if a process needs this check since the 
> detection
> involve acuiring a lock to walk the uvm map.

Why make this a memory-level property, and not a process-level 
property? If you want to proxy syscalls between host and usermode 
kernel, why make it exclusive to certain mem regions? I am probably 
missing something with the way usermode processes, usermode kernel host 
kernel interact.

> On the enhancing security argument, malicious source code could 
> trigger
> compiler bugs that allow for code to be modified or otherwise 
> manipulated to
> issue system calls where they shouldn't. Although it wouldn't 
> nessiarily pose
> a system security issue, it could be used for extracting info or for
> malicious behaviour where with the patch it would simply bomb out.

That's the part I have trouble with. It looks like a weaker form of W^X 
(or PaX's mprotect), and I can't see the "additional" security benefits.

Malicious code is free to trigger compiler bugs that can make calls to 
valid memory areas. If you manage to plant a "int 0x80" in a 
MMAP_NOSYSCALLS executable region, just make it to a "call __syscall". 
At the expense of a few more arguments, you will get the same result.

> As for the panic in sys_mmap(), as pointed out by Joerg and David 
> Young, yes,
> that should return a EOPNOTSUPP or an EINVAL. Panicing is indeed far
> too crude
> and i'll change that.
>
> Hope this answers most of your questions.

Waiting for mines :)

--
Jean-Yves Migeon
jym%NetBSD.org@localhost