The HASHKEYR register contains a secret per-process key to enable unique hashes per process. In general it should not be exposed to userspace at all and a regular process has no need to know its key. However, checkpoint restore in userspace (CRIU) functionality requires that a process be able to set the HASHKEYR of another process, otherwise existing hashes on the stack would be invalidated by a new random key. Exposing HASHKEYR in this way also makes it appear in core dumps, which is a security concern. Multiple threads may share a key, for example just after a fork() call, where the kernel cannot know if the child is going to return back along the parent's stack. If such a thread is coerced into making a core dump, then the HASHKEYR value will be readable and able to be used against all other threads sharing that key, effectively undoing any protection offered by hashst/hashchk. Therefore we expose HASHKEYR to ptrace when CONFIG_CHECKPOINT_RESTORE is enabled, providing a choice of increased security or migratable ROP protected processes. This is similar to how ARM exposes its PAC keys.
Showing the changes to include/uapi (1 of 4 files). Show all
Unified · Split
| @@ -404,6 +404,7 @@ typedef struct elf64_shdr { · 403 unmodified lines | |||
| 404 | #define NT_PPC_TM_CDSCR 0x10f /* TM checkpointed Data Stream Control Register */ | 404 | #define NT_PPC_TM_CDSCR 0x10f /* TM checkpointed Data Stream Control Register */ |
| 405 | #define NT_PPC_PKEY 0x110 /* Memory Protection Keys registers */ | 405 | #define NT_PPC_PKEY 0x110 /* Memory Protection Keys registers */ |
| 406 | #define NT_PPC_DEXCR 0x111 /* PowerPC DEXCR registers */ | 406 | #define NT_PPC_DEXCR 0x111 /* PowerPC DEXCR registers */ |
| 407 | #define NT_PPC_HASHKEYR 0x112 /* PowerPC HASHKEYR register */ | ||
| 407 | #define NT_386_TLS 0x200 /* i386 TLS slots (struct user_desc) */ | 408 | #define NT_386_TLS 0x200 /* i386 TLS slots (struct user_desc) */ |
| 408 | #define NT_386_IOPERM 0x201 /* x86 io permission bitmap (1=deny) */ | 409 | #define NT_386_IOPERM 0x201 /* x86 io permission bitmap (1=deny) */ |
| 409 | #define NT_X86_XSTATE 0x202 /* x86 extended state using xsave */ | 410 | #define NT_X86_XSTATE 0x202 /* x86 extended state using xsave */ |