Commit bf00745e authored by Andy Lutomirski's avatar Andy Lutomirski Committed by Borislav Petkov
Browse files

x86/vsyscall: Remove CONFIG_LEGACY_VSYSCALL_EMULATE 



CONFIG_LEGACY_VSYSCALL_EMULATE is, as far as I know, only needed for the
combined use of exotic and outdated debugging mechanisms with outdated
binaries. At this point, no one should be using it. Eventually, dynamic
switching of vsyscalls will be implemented, but this is much more
complicated to support in EMULATE mode than XONLY mode.

So let's force all the distros off of EMULATE mode. If anyone actually
needs it, they can set vsyscall=emulate, and the kernel can then get
away with refusing to support newer security models if that option is
set.

  [ bp: Remove "we"s. ]

Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Acked-by: default avatarFlorian Weimer <fweimer@redhat.com>
Link: https://lore.kernel.org/r/898932fe61db6a9d61bc2458fa2f6049f1ca9f5c.1652290558.git.luto@kernel.org
parent c5eb0a61

arch/x86/Kconfig

+3 −15
Original line number Diff line number Diff line
@@ -2326,7 +2326,9 @@ choice 
	  it can be used to assist security vulnerability exploitation.



	  This setting can be changed at boot time via the kernel command

	  line parameter vsyscall=[emulate|xonly|none].

	  line parameter vsyscall=[emulate|xonly|none].  Emulate mode

	  is deprecated and can only be enabled using the kernel command

	  line.



	  On a system with recent enough glibc (2.14 or newer) and no

	  static binaries, you can say None without a performance penalty
@@ -2334,20 +2336,6 @@ choice 


	  If unsure, select "Emulate execution only".



	config LEGACY_VSYSCALL_EMULATE

		bool "Full emulation"

		help

		  The kernel traps and emulates calls into the fixed vsyscall

		  address mapping. This makes the mapping non-executable, but

		  it still contains readable known contents, which could be

		  used in certain rare security vulnerability exploits. This

		  configuration is recommended when using legacy userspace

		  that still uses vsyscalls along with legacy binary

		  instrumentation tools that require code to be readable.



		  An example of this type of legacy userspace is running

		  Pin on an old binary that still uses vsyscalls.



	config LEGACY_VSYSCALL_XONLY

		bool "Emulate execution only"

		help

arch/x86/entry/vsyscall/vsyscall_64.c

+1 −1
Original line number Diff line number Diff line
@@ -48,7 +48,7 @@ static enum { EMULATE, XONLY, NONE } vsyscall_mode __ro_after_init = 
#elif defined(CONFIG_LEGACY_VSYSCALL_XONLY)

	XONLY;

#else

	EMULATE;

	#error VSYSCALL config is broken

#endif



static int __init vsyscall_setup(char *str)