From: "Alexander Graf" <agraf@csgraf.de>
To: Ard Biesheuvel <ardb@kernel.org>,
dann frazier <dann.frazier@canonical.com>
Cc: devel@edk2.groups.io, kraxel@redhat.com,
Leif Lindholm <quic_llindhol@quicinc.com>
Subject: Re: [edk2-devel] [PATCH v3 03/16] ArmVirtPkg: make EFI_LOADER_DATA non-executable
Date: Tue, 3 Jan 2023 20:39:24 +0100 [thread overview]
Message-ID: <7bba7344-fc37-abde-a792-5ae40621c70f@csgraf.de> (raw)
In-Reply-To: <CAMj1kXHMtr4qD9UjXSTP93=kybSxWrtKUqKRbAa3SXpFhp_7GA@mail.gmail.com>
Hey Ard,
On 03.01.23 10:59, Ard Biesheuvel wrote:
> On Thu, 29 Dec 2022 at 19:00, dann frazier <dann.frazier@canonical.com> wrote:
>> On Mon, Nov 28, 2022 at 04:46:10PM +0100, Gerd Hoffmann wrote:
>>> On Mon, Sep 26, 2022 at 10:24:58AM +0200, Ard Biesheuvel wrote:
>>>> When the memory protections were implemented and enabled on ArmVirtQemu
>>>> 5+ years ago, we had to work around the fact that GRUB at the time
>>>> expected EFI_LOADER_DATA to be executable, as that is the memory type it
>>>> allocates when loading its modules.
>>>>
>>>> This has been fixed in GRUB in August 2017, so by now, we should be able
>>>> to tighten this, and remove execute permissions from EFI_LOADER_DATA
>>>> allocations.
>>> Data point: https://bugzilla.redhat.com/show_bug.cgi?id=2149020
>>> tl;dr: fedora 37 grub.efi is still broken.
>> This is also the case with existing Ubuntu releases, as well as
>> AlmaLinux 9.1 and RHEL 8.7[*]. While it does appear to be fixed for
>> the upcoming Ubuntu 23.04 (presumably via [**]), I plan to revert this
>> patch in Debian/Ubuntu until it is more ubiquitous. Do you want to do
>> the same upstream? I'm not sure at what point it would make sense to
>> reintroduce it, given we can't force users to upgrade their bootloaders.
>>
> Thanks for the report.
>
> You can override PCDs on the build command line, so I suggest you use
> that for building these images as long as it is needed.
>
> E.g,, append this to the build.sh command line
>
> --pcd PcdDxeNxMemoryProtectionPolicy=0xC000000000007FD1
>
> to undo the effects of this patch.
>
> I do not intend to revert this patch - the trend under EFI is towards
> much stricter memory permissions, also on the MS side, and this is
> especially important under CC scenarios. And if 5+ years is not
> sufficient for out-of-tree GRUB to catch up, what is the point of
> waiting for it?
I think we need to be smarter here. ArmVirtPkg is used by a lot of
virtualization software - such as QEMU. Typically, users (and
developers) expect that an update to a newer version will preserve
compatibility.
Let me contrive an example: In 1 year, QEMU updates to the latest AAVMF.
It ships that as part of its pc-bios directory. Suddenly, we
accidentally break old (immutable!) iso images that used to work. So
someone that updates QEMU to a newer version will have a regression in
running a Fedora 37 installation. Or RHEL 8.7 installation. Not good :).
Outside of OSVs providing new iso images, there is also not much you can
do about this. The grub binary here runs way before any updater code
that could pull a fixed version from the internet.
What alternatives do we have? Assuming grub is the only offender we have
to worry about, is there a way we can identify that the allocation came
from an unpatched version? Or have a database of hashes (with all known
grub binaries that have this bug in existing isos) that would force
disable NX protection for it if we hit it? Or disable NX when Secure
Boot is disabled?
I really think we need to be a bit more creative than make NX mandatory
in all cases when we know the are immutable images out there that won't
work with it, otherwise we break very legit use cases.
Alex
next prev parent reply other threads:[~2023-01-03 19:39 UTC|newest]
Thread overview: 49+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-26 8:24 [PATCH v3 00/16] ArmVirtPkg/ArmVirtQemu: Performance streamlining Ard Biesheuvel
2022-09-26 8:24 ` [PATCH v3 01/16] ArmVirtPkg: remove EbcDxe from all platforms Ard Biesheuvel
2022-09-26 8:24 ` [PATCH v3 02/16] ArmVirtPkg: do not enable iSCSI driver by default Ard Biesheuvel
2022-09-26 8:24 ` [PATCH v3 03/16] ArmVirtPkg: make EFI_LOADER_DATA non-executable Ard Biesheuvel
2022-09-26 22:28 ` [edk2-devel] " Leif Lindholm
2022-11-28 15:46 ` Gerd Hoffmann
2022-12-29 18:00 ` dann frazier
2023-01-03 9:59 ` Ard Biesheuvel
2023-01-03 19:39 ` Alexander Graf [this message]
2023-01-03 22:47 ` dann frazier
2023-01-04 9:35 ` Ard Biesheuvel
2023-01-04 11:11 ` Gerd Hoffmann
2023-01-04 12:04 ` Ard Biesheuvel
2023-01-04 12:56 ` Gerd Hoffmann
2023-01-06 9:55 ` Laszlo Ersek
2023-01-06 10:06 ` Laszlo Ersek
2023-01-04 13:13 ` Alexander Graf
2023-01-05 0:09 ` Alexander Graf
2023-01-05 8:11 ` Gerd Hoffmann
2023-01-05 8:43 ` Alexander Graf
2023-01-05 9:41 ` Ard Biesheuvel
2023-01-05 11:19 ` Gerd Hoffmann
2023-01-05 11:44 ` Ard Biesheuvel
2023-01-05 15:12 ` Gerd Hoffmann
2023-01-05 19:58 ` Gerd Hoffmann
2023-01-06 2:19 ` Sean
2023-01-06 8:44 ` Gerd Hoffmann
2023-01-05 23:37 ` Alexander Graf
2022-09-26 8:24 ` [PATCH v3 04/16] ArmVirtPkg/ArmVirtQemu: wire up timeout PCD to Timeout variable Ard Biesheuvel
2022-09-26 8:25 ` [PATCH v3 05/16] ArmPkg/ArmMmuLib: don't replace table entries with block entries Ard Biesheuvel
2022-09-26 22:32 ` Leif Lindholm
2022-09-26 8:25 ` [PATCH v3 06/16] ArmPkg/ArmMmuLib: Disable and re-enable MMU only when needed Ard Biesheuvel
2022-09-26 23:28 ` Leif Lindholm
2022-09-26 8:25 ` [PATCH v3 07/16] ArmPkg/ArmMmuLib: permit initial configuration with MMU enabled Ard Biesheuvel
2022-09-26 22:35 ` Leif Lindholm
2022-09-26 8:25 ` [PATCH v3 08/16] ArmPkg/ArmMmuLib: Reuse XIP MMU routines when splitting entries Ard Biesheuvel
2022-09-26 22:38 ` Leif Lindholm
2022-09-26 8:25 ` [PATCH v3 09/16] ArmPlatformPkg/PrePeiCore: permit entry with the MMU enabled Ard Biesheuvel
2022-09-26 22:39 ` [edk2-devel] " Leif Lindholm
2022-09-26 8:25 ` [PATCH v3 10/16] ArmVirtPkg/ArmVirtQemu: implement ArmPlatformLib with static ID map Ard Biesheuvel
2022-09-26 8:25 ` [PATCH v3 11/16] ArmVirtPkg/ArmVirtQemu: use first 128 MiB as permanent PEI memory Ard Biesheuvel
2022-09-26 8:25 ` [PATCH v3 12/16] ArmVirtPkg/ArmVirtQemu: enable initial ID map at early boot Ard Biesheuvel
2022-12-29 21:10 ` [edk2-devel] " dann frazier
2023-01-03 9:02 ` Ard Biesheuvel
2023-01-03 19:38 ` dann frazier
2022-09-26 8:25 ` [PATCH v3 13/16] ArmVirtPkg/ArmVirtQemu: Drop unused variable PEIM Ard Biesheuvel
2022-09-26 8:25 ` [PATCH v3 14/16] ArmVirtPkg/ArmVirtQemu: avoid shadowing PEIMs unless necessary Ard Biesheuvel
2022-09-26 8:25 ` [PATCH v3 15/16] ArmVirtPkg/QemuVirtMemInfoLib: use HOB not PCD to record the memory size Ard Biesheuvel
2022-09-26 8:25 ` [PATCH v3 16/16] ArmVirtPkg/ArmVirtQemu: omit PCD PEIM unless TPM support is enabled Ard Biesheuvel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7bba7344-fc37-abde-a792-5ae40621c70f@csgraf.de \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox