Re: [PATCH] x86_64: Disabling read-implies-exec when the stack is executable

2019-04-18 Thread Kees Cook
On Thu, Apr 18, 2019 at 9:15 AM Andy Lutomirski wrote: > I have the opposite question: who cares if we have NX? On a CPU without NX, > read implies exec, full stop. Why should nasty personality stuff matter at > all? The personality stuff is about supporting old crufty binaries. > > So: are th

Re: [PATCH] x86_64: Disabling read-implies-exec when the stack is executable

2019-04-18 Thread Andy Lutomirski
> On Apr 18, 2019, at 1:17 AM, Thomas Gleixner wrote: > >> On Thu, 18 Apr 2019, Kees Cook wrote: >> On Wed, May 11, 2016 at 5:45 AM Hector Marco-Gisbert wrote: >> *thread necromancy* >> >> I'd still like to see this get landed. READ_IMPLIES_EXEC is way too >> powerful (it impacts, for example

Re: [PATCH] x86_64: Disabling read-implies-exec when the stack is executable

2019-04-18 Thread Kees Cook
On Thu, Apr 18, 2019 at 3:17 AM Thomas Gleixner wrote: > > On Thu, 18 Apr 2019, Kees Cook wrote: > > On Wed, May 11, 2016 at 5:45 AM Hector Marco-Gisbert > > wrote: > > *thread necromancy* > > > > I'd still like to see this get landed. READ_IMPLIES_EXEC is way too > > powerful (it impacts, for e

Re: [PATCH] x86_64: Disabling read-implies-exec when the stack is executable

2019-04-18 Thread Thomas Gleixner
On Thu, 18 Apr 2019, Kees Cook wrote: > On Wed, May 11, 2016 at 5:45 AM Hector Marco-Gisbert wrote: > *thread necromancy* > > I'd still like to see this get landed. READ_IMPLIES_EXEC is way too > powerful (it impacts, for example, mmap() regions of device driver > memory, forcing drivers to not b

Re: [PATCH] x86_64: Disabling read-implies-exec when the stack is executable

2019-04-18 Thread Kees Cook
On Wed, May 11, 2016 at 5:45 AM Hector Marco-Gisbert wrote: > > The READ_IMPLIES_EXEC personality was removed in 2005 for 64-bit processes, > (commit a3cc2546a54361b86b73557df5b85c4fc3fc27c3 form history.git). > > But it's still possible to have all readable areas with EXEC permissions by > settin

Re: [PATCH] x86_64: Disabling read-implies-exec when the stack is executable

2016-05-16 Thread Ingo Molnar
* Kees Cook wrote: > On Wed, May 11, 2016 at 3:45 AM, Hector Marco-Gisbert wrote: > > The READ_IMPLIES_EXEC personality was removed in 2005 for 64-bit processes, > > (commit a3cc2546a54361b86b73557df5b85c4fc3fc27c3 form history.git). > > > > But it's still possible to have all readable areas wi

Re: [PATCH] x86_64: Disabling read-implies-exec when the stack is executable

2016-05-11 Thread Kees Cook
On Wed, May 11, 2016 at 3:40 PM, Andi Kleen wrote: >> However, I would tend to agree: RIE should only be needed on 32-bit >> since 64-bit started its life knowing about no-exec permissions. > > NX was not in the original AMD K8 chips. Was only added some time later. So we should retain this beha

Re: [PATCH] x86_64: Disabling read-implies-exec when the stack is executable

2016-05-11 Thread Andi Kleen
> However, I would tend to agree: RIE should only be needed on 32-bit > since 64-bit started its life knowing about no-exec permissions. NX was not in the original AMD K8 chips. Was only added some time later. > set_personality_64bit()'s (which is confusingly just an initializer > and not called

Re: [PATCH] x86_64: Disabling read-implies-exec when the stack is executable

2016-05-11 Thread Kees Cook
On Wed, May 11, 2016 at 3:45 AM, Hector Marco-Gisbert wrote: > The READ_IMPLIES_EXEC personality was removed in 2005 for 64-bit processes, > (commit a3cc2546a54361b86b73557df5b85c4fc3fc27c3 form history.git). > > But it's still possible to have all readable areas with EXEC permissions by > setting

[PATCH] x86_64: Disabling read-implies-exec when the stack is executable

2016-05-11 Thread Hector Marco-Gisbert
The READ_IMPLIES_EXEC personality was removed in 2005 for 64-bit processes, (commit a3cc2546a54361b86b73557df5b85c4fc3fc27c3 form history.git). But it's still possible to have all readable areas with EXEC permissions by setting the stack as executable in 64-bit ELF executables (also in 32-bit). T