d1fd836dcf
This fixes the "offset2lib" weakness in ASLR for arm, arm64, mips, powerpc, and x86. The problem is that if there is a leak of ASLR from the executable (ET_DYN), it means a leak of shared library offset as well (mmap), and vice versa. Further details and a PoC of this attack is available here: http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html With this patch, a PIE linked executable (ET_DYN) has its own ASLR region: $ ./show_mmaps_pie 54859ccd6000-54859ccd7000 r-xp ... /tmp/show_mmaps_pie 54859ced6000-54859ced7000 r--p ... /tmp/show_mmaps_pie 54859ced7000-54859ced8000 rw-p ... /tmp/show_mmaps_pie 7f75be764000-7f75be91f000 r-xp ... /lib/x86_64-linux-gnu/libc.so.6 7f75be91f000-7f75beb1f000 ---p ... /lib/x86_64-linux-gnu/libc.so.6 7f75beb1f000-7f75beb23000 r--p ... /lib/x86_64-linux-gnu/libc.so.6 7f75beb23000-7f75beb25000 rw-p ... /lib/x86_64-linux-gnu/libc.so.6 7f75beb25000-7f75beb2a000 rw-p ... 7f75beb2a000-7f75beb4d000 r-xp ... /lib64/ld-linux-x86-64.so.2 7f75bed45000-7f75bed46000 rw-p ... 7f75bed46000-7f75bed47000 r-xp ... 7f75bed47000-7f75bed4c000 rw-p ... 7f75bed4c000-7f75bed4d000 r--p ... /lib64/ld-linux-x86-64.so.2 7f75bed4d000-7f75bed4e000 rw-p ... /lib64/ld-linux-x86-64.so.2 7f75bed4e000-7f75bed4f000 rw-p ... 7fffb3741000-7fffb3762000 rw-p ... [stack] 7fffb377b000-7fffb377d000 r--p ... [vvar] 7fffb377d000-7fffb377f000 r-xp ... [vdso] The change is to add a call the newly created arch_mmap_rnd() into the ELF loader for handling ET_DYN ASLR in a separate region from mmap ASLR, as was already done on s390. Removes CONFIG_BINFMT_ELF_RANDOMIZE_PIE, which is no longer needed. Signed-off-by: Kees Cook <keescook@chromium.org> Reported-by: Hector Marco-Gisbert <hecmargi@upv.es> Cc: Russell King <linux@arm.linux.org.uk> Reviewed-by: Ingo Molnar <mingo@kernel.org> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Will Deacon <will.deacon@arm.com> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Paul Mackerras <paulus@samba.org> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: Heiko Carstens <heiko.carstens@de.ibm.com> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Cc: Oleg Nesterov <oleg@redhat.com> Cc: Andy Lutomirski <luto@amacapital.net> Cc: "David A. Long" <dave.long@linaro.org> Cc: Andrey Ryabinin <a.ryabinin@samsung.com> Cc: Arun Chandran <achandran@mvista.com> Cc: Yann Droneaud <ydroneaud@opteya.com> Cc: Min-Hua Chen <orca.chen@gmail.com> Cc: Paul Burton <paul.burton@imgtec.com> Cc: Alex Smith <alex@alex-smith.me.uk> Cc: Markos Chandras <markos.chandras@imgtec.com> Cc: Vineeth Vijayan <vvijayan@mvista.com> Cc: Jeff Bailey <jeffbailey@google.com> Cc: Michael Holzheu <holzheu@linux.vnet.ibm.com> Cc: Ben Hutchings <ben@decadent.org.uk> Cc: Behan Webster <behanw@converseincode.com> Cc: Ismael Ripoll <iripoll@upv.es> Cc: Jan-Simon Mller <dl9pf@gmx.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
181 lines
7 KiB
Text
181 lines
7 KiB
Text
config BINFMT_ELF
|
|
bool "Kernel support for ELF binaries"
|
|
depends on MMU && (BROKEN || !FRV)
|
|
default y
|
|
---help---
|
|
ELF (Executable and Linkable Format) is a format for libraries and
|
|
executables used across different architectures and operating
|
|
systems. Saying Y here will enable your kernel to run ELF binaries
|
|
and enlarge it by about 13 KB. ELF support under Linux has now all
|
|
but replaced the traditional Linux a.out formats (QMAGIC and ZMAGIC)
|
|
because it is portable (this does *not* mean that you will be able
|
|
to run executables from different architectures or operating systems
|
|
however) and makes building run-time libraries very easy. Many new
|
|
executables are distributed solely in ELF format. You definitely
|
|
want to say Y here.
|
|
|
|
Information about ELF is contained in the ELF HOWTO available from
|
|
<http://www.tldp.org/docs.html#howto>.
|
|
|
|
If you find that after upgrading from Linux kernel 1.2 and saying Y
|
|
here, you still can't run any ELF binaries (they just crash), then
|
|
you'll have to install the newest ELF runtime libraries, including
|
|
ld.so (check the file <file:Documentation/Changes> for location and
|
|
latest version).
|
|
|
|
config COMPAT_BINFMT_ELF
|
|
bool
|
|
depends on COMPAT && BINFMT_ELF
|
|
|
|
config ARCH_BINFMT_ELF_STATE
|
|
bool
|
|
|
|
config BINFMT_ELF_FDPIC
|
|
bool "Kernel support for FDPIC ELF binaries"
|
|
default y
|
|
depends on (FRV || BLACKFIN || (SUPERH32 && !MMU) || C6X)
|
|
help
|
|
ELF FDPIC binaries are based on ELF, but allow the individual load
|
|
segments of a binary to be located in memory independently of each
|
|
other. This makes this format ideal for use in environments where no
|
|
MMU is available as it still permits text segments to be shared,
|
|
even if data segments are not.
|
|
|
|
It is also possible to run FDPIC ELF binaries on MMU linux also.
|
|
|
|
config CORE_DUMP_DEFAULT_ELF_HEADERS
|
|
bool "Write ELF core dumps with partial segments"
|
|
default y
|
|
depends on BINFMT_ELF && ELF_CORE
|
|
help
|
|
ELF core dump files describe each memory mapping of the crashed
|
|
process, and can contain or omit the memory contents of each one.
|
|
The contents of an unmodified text mapping are omitted by default.
|
|
|
|
For an unmodified text mapping of an ELF object, including just
|
|
the first page of the file in a core dump makes it possible to
|
|
identify the build ID bits in the file, without paying the i/o
|
|
cost and disk space to dump all the text. However, versions of
|
|
GDB before 6.7 are confused by ELF core dump files in this format.
|
|
|
|
The core dump behavior can be controlled per process using
|
|
the /proc/PID/coredump_filter pseudo-file; this setting is
|
|
inherited. See Documentation/filesystems/proc.txt for details.
|
|
|
|
This config option changes the default setting of coredump_filter
|
|
seen at boot time. If unsure, say Y.
|
|
|
|
config BINFMT_SCRIPT
|
|
tristate "Kernel support for scripts starting with #!"
|
|
default y
|
|
help
|
|
Say Y here if you want to execute interpreted scripts starting with
|
|
#! followed by the path to an interpreter.
|
|
|
|
You can build this support as a module; however, until that module
|
|
gets loaded, you cannot run scripts. Thus, if you want to load this
|
|
module from an initramfs, the portion of the initramfs before loading
|
|
this module must consist of compiled binaries only.
|
|
|
|
Most systems will not boot if you say M or N here. If unsure, say Y.
|
|
|
|
config BINFMT_FLAT
|
|
bool "Kernel support for flat binaries"
|
|
depends on !MMU && (!FRV || BROKEN)
|
|
help
|
|
Support uClinux FLAT format binaries.
|
|
|
|
config BINFMT_ZFLAT
|
|
bool "Enable ZFLAT support"
|
|
depends on BINFMT_FLAT
|
|
select ZLIB_INFLATE
|
|
help
|
|
Support FLAT format compressed binaries
|
|
|
|
config BINFMT_SHARED_FLAT
|
|
bool "Enable shared FLAT support"
|
|
depends on BINFMT_FLAT
|
|
help
|
|
Support FLAT shared libraries
|
|
|
|
config HAVE_AOUT
|
|
def_bool n
|
|
|
|
config BINFMT_AOUT
|
|
tristate "Kernel support for a.out and ECOFF binaries"
|
|
depends on HAVE_AOUT
|
|
---help---
|
|
A.out (Assembler.OUTput) is a set of formats for libraries and
|
|
executables used in the earliest versions of UNIX. Linux used
|
|
the a.out formats QMAGIC and ZMAGIC until they were replaced
|
|
with the ELF format.
|
|
|
|
The conversion to ELF started in 1995. This option is primarily
|
|
provided for historical interest and for the benefit of those
|
|
who need to run binaries from that era.
|
|
|
|
Most people should answer N here. If you think you may have
|
|
occasional use for this format, enable module support above
|
|
and answer M here to compile this support as a module called
|
|
binfmt_aout.
|
|
|
|
If any crucial components of your system (such as /sbin/init
|
|
or /lib/ld.so) are still in a.out format, you will have to
|
|
say Y here.
|
|
|
|
config OSF4_COMPAT
|
|
bool "OSF/1 v4 readv/writev compatibility"
|
|
depends on ALPHA && BINFMT_AOUT
|
|
help
|
|
Say Y if you are using OSF/1 binaries (like Netscape and Acrobat)
|
|
with v4 shared libraries freely available from Compaq. If you're
|
|
going to use shared libraries from Tru64 version 5.0 or later, say N.
|
|
|
|
config BINFMT_EM86
|
|
tristate "Kernel support for Linux/Intel ELF binaries"
|
|
depends on ALPHA
|
|
---help---
|
|
Say Y here if you want to be able to execute Linux/Intel ELF
|
|
binaries just like native Alpha binaries on your Alpha machine. For
|
|
this to work, you need to have the emulator /usr/bin/em86 in place.
|
|
|
|
You can get the same functionality by saying N here and saying Y to
|
|
"Kernel support for MISC binaries".
|
|
|
|
You may answer M to compile the emulation support as a module and
|
|
later load the module when you want to use a Linux/Intel binary. The
|
|
module will be called binfmt_em86. If unsure, say Y.
|
|
|
|
config BINFMT_MISC
|
|
tristate "Kernel support for MISC binaries"
|
|
---help---
|
|
If you say Y here, it will be possible to plug wrapper-driven binary
|
|
formats into the kernel. You will like this especially when you use
|
|
programs that need an interpreter to run like Java, Python, .NET or
|
|
Emacs-Lisp. It's also useful if you often run DOS executables under
|
|
the Linux DOS emulator DOSEMU (read the DOSEMU-HOWTO, available from
|
|
<http://www.tldp.org/docs.html#howto>). Once you have
|
|
registered such a binary class with the kernel, you can start one of
|
|
those programs simply by typing in its name at a shell prompt; Linux
|
|
will automatically feed it to the correct interpreter.
|
|
|
|
You can do other nice things, too. Read the file
|
|
<file:Documentation/binfmt_misc.txt> to learn how to use this
|
|
feature, <file:Documentation/java.txt> for information about how
|
|
to include Java support. and <file:Documentation/mono.txt> for
|
|
information about how to include Mono-based .NET support.
|
|
|
|
To use binfmt_misc, you will need to mount it:
|
|
mount binfmt_misc -t binfmt_misc /proc/sys/fs/binfmt_misc
|
|
|
|
You may say M here for module support and later load the module when
|
|
you have use for it; the module is called binfmt_misc. If you
|
|
don't know what to answer at this point, say Y.
|
|
|
|
config COREDUMP
|
|
bool "Enable core dump support" if EXPERT
|
|
default y
|
|
help
|
|
This option enables support for performing core dumps. You almost
|
|
certainly want to say Y here. Not necessary on systems that never
|
|
need debugging or only ever run flawless code.
|