Re: [PATCH 2/2] aarch64: Make glibc.mem.tagging SXID_ERASE

[Siddhesh Poyarekar <siddhesh@sourceware.org>]

On 2023-10-06 08:25, Zack Weinberg wrote:
>> I don't completely disagree with the conclusion below, but the CVE
>> that prompted this discussion doesn't say anything about environment
>> inheritance because the vulnerability had nothing to do with
>> environment processing and inheritance.
> 
> I may have misunderstood the CVE or mixed it up with another one.
> I thought there was a recent CVE in which a SXID_IGNORE environment
> variable was inherited by a child process, and that child process was
> rendered vulnerable to further exploitation because it honored that
> variable.

Hmm, I don't remember anything like this recently (but my memory is 
worse than my airplane flying skills), but something like that would be 
an interesting data point and further confirmation that we need to get 
rid of SXID_IGNORE and SXID_NONE.  In any case, I can't see a good 
reason anymore to keep these levels, especially if we drop memory 
tagging, malloc tuning and malloc debugging tunables from SXID_IGNORE. 
If memory tagging needs to persist across setxid programs then there 
needs to be a different way, maybe through systemwide tunables[1] that 
DJ is working on, or maybe even ELF markup.

Adhemerval has taken this patchset and is going to build on it to rip it 
all out, so we'll hopefully resolve all of this together.

Thanks,
Sid

[1] 
https://inbox.sourceware.org/libc-alpha/xn1qeayuo9.fsf@greed.delorie.com/T/#u