diff mbox series

[v2] eal/linux: improve ASLR check

Message ID 20250313061904.1466-1-ming.1.yang@nokia-sbell.com (mailing list archive)
State New
Delegated to: David Marchand
Headers
Series [v2] eal/linux: improve ASLR check |

Checks

Context Check Description
ci/checkpatch success coding style OK
ci/loongarch-compilation success Compilation OK
ci/loongarch-unit-testing success Unit Testing PASS
ci/Intel-compilation success Compilation OK
ci/intel-Testing success Testing PASS
ci/intel-Functional success Functional PASS
ci/github-robot: build success github build: passed
ci/iol-marvell-Functional success Functional Testing PASS
ci/iol-mellanox-Performance success Performance Testing PASS
ci/iol-intel-Performance success Performance Testing PASS
ci/iol-intel-Functional success Functional Testing PASS
ci/iol-broadcom-Performance success Performance Testing PASS
ci/iol-unit-arm64-testing success Testing PASS
ci/iol-abi-testing success Testing PASS
ci/iol-unit-amd64-testing fail Testing issues
ci/iol-compile-arm64-testing success Testing PASS
ci/iol-compile-amd64-testing success Testing PASS
ci/iol-sample-apps-testing success Testing PASS

Commit Message

Yang Ming March 13, 2025, 6:19 a.m. UTC 
This change ensures that the current process is checked for
being run with 'setarch' before verifying the value of
'/proc/sys/kernel/randomize_va_space'. The '-R' or
'--addr-no-randomize' parameter of the 'setarch' command is used
to disable the randomization of the virtual address space.

Fixes: af75078fece3 ("first public release")
Cc: stable@dpdk.org

Signed-off-by: Yang Ming <ming.1.yang@nokia-sbell.com>
---
 lib/eal/linux/eal_memory.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

Comments

Stephen Hemminger March 13, 2025, 3:37 p.m. UTC | #1 
On Thu, 13 Mar 2025 14:19:03 +0800
Yang Ming <ming.1.yang@nokia-sbell.com> wrote:

> This change ensures that the current process is checked for
> being run with 'setarch' before verifying the value of
> '/proc/sys/kernel/randomize_va_space'. The '-R' or
> '--addr-no-randomize' parameter of the 'setarch' command is used
> to disable the randomization of the virtual address space.
> 
> Fixes: af75078fece3 ("first public release")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Yang Ming <ming.1.yang@nokia-sbell.com>

Acked-by: Stephen Hemminger <stephen@networkplumber.org>
Yang Ming March 27, 2025, 8:02 a.m. UTC | #2 
On 2025/3/13 23:37, Stephen Hemminger wrote:
> Caution: This is an external email. Please be very careful when clicking links or opening attachments. See http://nok.it/nsb for additional information.
>
> On Thu, 13 Mar 2025 14:19:03 +0800
> Yang Ming <ming.1.yang@nokia-sbell.com> wrote:
>
>> This change ensures that the current process is checked for
>> being run with 'setarch' before verifying the value of
>> '/proc/sys/kernel/randomize_va_space'. The '-R' or
>> '--addr-no-randomize' parameter of the 'setarch' command is used
>> to disable the randomization of the virtual address space.
>>
>> Fixes: af75078fece3 ("first public release")
>> Cc: stable@dpdk.org
>>
>> Signed-off-by: Yang Ming <ming.1.yang@nokia-sbell.com>
> Acked-by: Stephen Hemminger <stephen@networkplumber.org>
>
Hi Experts,

is there any chance to review and accept this patch?

Brs,

Yang Ming
David Marchand March 27, 2025, 8:14 a.m. UTC | #3 
Hello,

On Thu, Mar 27, 2025 at 9:02 AM Yang Ming <ming.1.yang@nokia-sbell.com> wrote:
> On 2025/3/13 23:37, Stephen Hemminger wrote:
> > On Thu, 13 Mar 2025 14:19:03 +0800
> > Yang Ming <ming.1.yang@nokia-sbell.com> wrote:
> >
> >> This change ensures that the current process is checked for
> >> being run with 'setarch' before verifying the value of
> >> '/proc/sys/kernel/randomize_va_space'. The '-R' or
> >> '--addr-no-randomize' parameter of the 'setarch' command is used
> >> to disable the randomization of the virtual address space.
> >>
> >> Fixes: af75078fece3 ("first public release")
> >> Cc: stable@dpdk.org
> >>
> >> Signed-off-by: Yang Ming <ming.1.yang@nokia-sbell.com>
> > Acked-by: Stephen Hemminger <stephen@networkplumber.org>
> >
> Hi Experts,
>
> is there any chance to review and accept this patch?

I just merged rc0 which means the patch merging fest is opened.

I put this patch and a few other EAL patches on my rc1 queue, as those
changes don't belong to next-net.
Yang Ming March 30, 2025, 9:49 a.m. UTC | #4 
On 2025/3/27 16:14, David Marchand wrote:
> Caution: This is an external email. Please be very careful when clicking links or opening attachments. See http://nok.it/nsb for additional information.
>
> Hello,
>
> On Thu, Mar 27, 2025 at 9:02 AM Yang Ming <ming.1.yang@nokia-sbell.com> wrote:
>> On 2025/3/13 23:37, Stephen Hemminger wrote:
>>> On Thu, 13 Mar 2025 14:19:03 +0800
>>> Yang Ming <ming.1.yang@nokia-sbell.com> wrote:
>>>
>>>> This change ensures that the current process is checked for
>>>> being run with 'setarch' before verifying the value of
>>>> '/proc/sys/kernel/randomize_va_space'. The '-R' or
>>>> '--addr-no-randomize' parameter of the 'setarch' command is used
>>>> to disable the randomization of the virtual address space.
>>>>
>>>> Fixes: af75078fece3 ("first public release")
>>>> Cc: stable@dpdk.org
>>>>
>>>> Signed-off-by: Yang Ming <ming.1.yang@nokia-sbell.com>
>>> Acked-by: Stephen Hemminger <stephen@networkplumber.org>
>>>
>> Hi Experts,
>>
>> is there any chance to review and accept this patch?
> I just merged rc0 which means the patch merging fest is opened.
>
> I put this patch and a few other EAL patches on my rc1 queue, as those
> changes don't belong to next-net.
>
Hi David,

Got it. Thanks for your update. Looking forward to seeing it in rc1.

Brs,

Yang Ming
diff mbox series

Patch

diff --git a/lib/eal/linux/eal_memory.c b/lib/eal/linux/eal_memory.c
index 9dda60c0e1..5ef1575b66 100644
--- a/lib/eal/linux/eal_memory.c
+++ b/lib/eal/linux/eal_memory.c
@@ -15,6 +15,7 @@ 
 #include <sys/stat.h>
 #include <sys/file.h>
 #include <sys/resource.h>
+#include <sys/personality.h>
 #include <unistd.h>
 #include <limits.h>
 #include <signal.h>
@@ -200,6 +201,17 @@  static int
 aslr_enabled(void)
 {
 	char c;
+
+	/*
+	 * Check whether the current process is executed with the command line
+	 * "setarch ... --addr-no-randomize ..." or "setarch ... -R ..."
+	 * This complements the sysfs check to ensure comprehensive ASLR status detection.
+	 * This check is necessary to support the functionality of the "setarch" command,
+	 * which can disable ASLR by setting the ADDR_NO_RANDOMIZE personality flag.
+	 */
+	if ((personality(0xffffffff) & ADDR_NO_RANDOMIZE) == ADDR_NO_RANDOMIZE)
+		return 0;
+
 	int retval, fd = open(RANDOMIZE_VA_SPACE_FILE, O_RDONLY);
 	if (fd < 0)
 		return -errno;