Re: [PATCH] proc: add config to block FOLL_FORCE in mem writes

[Adrian Ratiu]

On Thursday, July 18, 2024 03:04 EEST, Linus Torvalds <torvalds at linux-foundation.org> wrote:

> On Wed, 17 Jul 2024 at 15:24, Kees Cook <kees at kernel.org> wrote:
> >
> > > In particular, this patch would make it easy to make that
> > > SECURITY_PROC_MEM_RESTRICT_FOLL_FORCE config option be a "choice"
> > > where you pick "never, ptrace, always" by just changing the rules in
> > > proc_is_ptracing().
> >
> > So the original patch could be reduced to just the single tristate option
> > instead of 3 tristates? I think that would be a decent middle ground,
> > and IIUC, will still provide the coverage Chrome OS is looking for[1].
> 
> So here's what I kind of think might be ok.
> 
> ENTIRELY UNTESTED! This is more of a "look, something like this,
> perhaps" patch than a real one.
> 
> If somebody tests this, and it is ok for Chrome OS, you can consider
> this signed-off-on, but only with actual testing. I might have gotten
> something hroribly wrong.

Thanks for the patch!

I tested it on ChromeOS and it does what it intends, just with two
minor fixes applied:

--- a/security/Kconfig
+++ b/security/Kconfig
-config CONFIG_PROC_MEM_FORCE_PTRACE
+config PROC_MEM_FORCE_PTRACE
.....
 -config CONFIG_PROC_MEM_NO_FORCE
+config PROC_MEM_NO_FORCE

As Kees suggested, I'll add a bootparam with a simple __ro_after_init
variable to select this and then send a v2 for review.