Re: [gentoo-hardened] Keeping gentoo-hardened alive (WAS: latest kernel exploit patch for vmsplice coming?)

On 15 Feb 2008 at 14:14, Geoff Kassel wrote:

> > that would work except writing something like that is very hard, definitely
> > beyond my time just for the sake to handle something that a coredump
> > accomplishes well sans resurrection ability.
>
> > on a sidenote, why would it be acceptable to store a process image on disk
> > whereas a coredump isn't?
>
> Hmm... I didn't know that you could restore a process fully from a core dump -
> hence the question.

note the 'sans resurrection ability' above ;). coredumps are for post mortem
analysis only.

> Memory check-pointing to disk for quick recovery from critical faults (such as
> power failure or exploit attempts)

trust me, you don't want to resurrect from an exploit attempt ;)

> > uhm, but you already have such a control over per-process PaX features.
> > either paxctl (which marks the executable's ELF header) or MAC system
> > (both grsec and RSBAC provide controls). or i must be not getting your
> > problem ;-).
>
> Having read a little more deeply into the inner workings of PAGEEXEC,
> SEGMEXEC, and MPROTECT now, I see now what I was asking is already achievable
> by just by removing PAGEEXEC or SEGMEXEC protections for Java or Mono, but
> not MPROTECT.

it's the exact opposite: you keep the basic non-exec page implementation
but omit the strict access control over it (MPROTECT) so that properly
written apps can generate code at runtime. Java et al can these days work
with only MPROTECT disabled, that wasn't always true due to various bad
implementation issues (e.g., for a long time libjvm.so used to have some
FPU initialization code in its .data segment, that didn't get far under
PaX as you can imagine ;). in an ideal world the non-exec options would
just be permanently enabled and only MPROTECT would be a real choice.

> However - while I temporarily have your ear :) I'm interested about being able
> to remove PAGEEXEC/SEGMEXEC and/or MPROTECT protections for a process in
> real-time - while a process is running, or in the hypothetical 'suspended
> awaiting administrative approval to continue' state I keep talking about.
>
> Is such a real-time removal of protections possible with the way PaX is
> currently implemented? If not, I think it'd be an interesting feature in the
> eventuality of such a process suspension feature being developed.

it's obviously possible but it raises more problems than it solves. for
one, who would make the decision about forward progress? it obviously can't
be the process itself as it's jut got suspended, so it must be some external
monitor or a human. in either case, on what grounds would they make this
decision? either has various failure modes that would nicely allow an exploit
to succeed.

-- 
gentoo-hardened@l.g.o mailing list