Re: [PATCH] add param that allows bootline control of hardened usercopy

[Laura Abbott]

On 06/25/2018 08:22 AM, Christoph von Recklinghausen wrote:
> Add correct address for linux-mm
>
> On 06/25/2018 11:08 AM, Chris von Recklinghausen wrote:
> > Enabling HARDENED_USER_COPY causes measurable regressions in the
> > networking performances, up to 8% under UDP flood.
> >
> > A generic distro may want to enable HARDENED_USER_COPY in their default
> > kernel config, but at the same time, such distro may want to be able to
> > avoid the performance penalties in with the default configuration and
> > enable the stricter check on a per-boot basis.
> >
> > This change adds a config variable and a boot parameter to conditionally
> > enable HARDENED_USER_COPY at boot time, and switch HUC to off if
> > HUC_DEFAULT_OFF is set.
> >
> > Signed-off-by: Chris von Recklinghausen <crecklin@xxxxxxxxxx>
> > ---
> >   .../admin-guide/kernel-parameters.rst         |  2 ++
> >   .../admin-guide/kernel-parameters.txt         |  3 ++
> >   include/linux/thread_info.h                   |  7 +++++
> >   mm/usercopy.c                                 | 28 +++++++++++++++++++
> >   security/Kconfig                              | 10 +++++++
> >   5 files changed, 50 insertions(+)
> >
> > diff --git a/Documentation/admin-guide/kernel-parameters.rst b/Documentation/admin-guide/kernel-parameters.rst
> > index b8d0bc07ed0a..c3035038e3ae 100644
> > --- a/Documentation/admin-guide/kernel-parameters.rst
> > +++ b/Documentation/admin-guide/kernel-parameters.rst
> > @@ -100,6 +100,8 @@ parameter is applicable::
> >   	FB	The frame buffer device is enabled.
> >   	FTRACE	Function tracing enabled.
> >   	GCOV	GCOV profiling is enabled.
> > +	HUC	Hardened usercopy is enabled
> > +	HUCF	Hardened usercopy disabled at boot
> >   	HW	Appropriate hardware is enabled.
> >   	IA-64	IA-64 architecture is enabled.
> >   	IMA     Integrity measurement architecture is enabled.
> > diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
> > index efc7aa7a0670..cd3354bc14d3 100644
> > --- a/Documentation/admin-guide/kernel-parameters.txt
> > +++ b/Documentation/admin-guide/kernel-parameters.txt
> > @@ -816,6 +816,9 @@
> >   	disable=	[IPV6]
> >   			See Documentation/networking/ipv6.txt.
> >   
> > +	enable_hardened_usercopy [HUC,HUCF]
> > +			Enable hardened usercopy checks
> > +
> >   	disable_radix	[PPC]
> >   			Disable RADIX MMU mode on POWER9
> >   
> > diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
> > index 8d8821b3689a..140a36cc1c2c 100644
> > --- a/include/linux/thread_info.h
> > +++ b/include/linux/thread_info.h
> > @@ -109,12 +109,19 @@ static inline int arch_within_stack_frames(const void * const stack,
> >   #endif
> >   
> >   #ifdef CONFIG_HARDENED_USERCOPY
> > +#include <linux/jump_label.h>
> > +
> > +DECLARE_STATIC_KEY_FALSE(bypass_usercopy_checks);
> > +
> >   extern void __check_object_size(const void *ptr, unsigned long n,
> >   					bool to_user);
> >   
> >   static __always_inline void check_object_size(const void *ptr, unsigned long n,
> >   					      bool to_user)
> >   {
> > +	if (static_branch_likely(&bypass_usercopy_checks))
> > +		return;
> > +
> >   	if (!__builtin_constant_p(n))
> >   		__check_object_size(ptr, n, to_user);
> >   }
> > diff --git a/mm/usercopy.c b/mm/usercopy.c
> > index e9e9325f7638..ce3996da1b2e 100644
> > --- a/mm/usercopy.c
> > +++ b/mm/usercopy.c
> > @@ -279,3 +279,31 @@ void __check_object_size(const void *ptr, unsigned long n, bool to_user)
> >   	check_kernel_text_object((const unsigned long)ptr, n, to_user);
> >   }
> >   EXPORT_SYMBOL(__check_object_size);
> > +
> > +DEFINE_STATIC_KEY_FALSE(bypass_usercopy_checks);
> > +EXPORT_SYMBOL(bypass_usercopy_checks);
> > +
> > +#ifdef CONFIG_HUC_DEFAULT_OFF
> > +#define HUC_DEFAULT false
> > +#else
> > +#define HUC_DEFAULT true
> > +#endif
> > +
> > +static bool enable_huc_atboot = HUC_DEFAULT;
> > +
> > +static int __init parse_enable_usercopy(char *str)
> > +{
> > +	enable_huc_atboot = true;
> > +	return 1;
> > +}
> > +
> > +static int __init set_enable_usercopy(void)
> > +{
> > +	if (enable_huc_atboot == false)
> > +		static_branch_enable(&bypass_usercopy_checks);
> > +	return 1;
> > +}
> > +
> > +__setup("enable_hardened_usercopy", parse_enable_usercopy);
> > +
> > +late_initcall(set_enable_usercopy);
> > diff --git a/security/Kconfig b/security/Kconfig
> > index c4302067a3ad..a6173897b85c 100644
> > --- a/security/Kconfig
> > +++ b/security/Kconfig
> > @@ -189,6 +189,16 @@ config HARDENED_USERCOPY_PAGESPAN
> >   	  been removed. This config is intended to be used only while
> >   	  trying to find such users.
> >   
> > +config HUC_DEFAULT_OFF
> > +	bool "allow CONFIG_HARDENED_USERCOPY to be configured but disabled"
> > +	depends on HARDENED_USERCOPY
> > +	help
> > +	  When CONFIG_HARDENED_USERCOPY is enabled, disable its
> > +	  functionality unless it is enabled via at boot time
> > +	  via the "enable_hardened_usercopy" boot parameter. This allows
> > +	  the functionality of hardened usercopy to be present but not
> > +	  impact performance unless it is needed.
> > +
> >   config FORTIFY_SOURCE
> >   	bool "Harden common str/mem functions against buffer overflows"
> >   	depends on ARCH_HAS_FORTIFY_SOURCE

This seems a bit backwards, I'd much rather see hardened user copy
default to on with the basic config option and then just have a command
line option to turn it off.

Thanks,
Laura