Re: [PATCH 2/2] aarch64: Make glibc.mem.tagging SXID_ERASE

[Szabolcs Nagy <szabolcs.nagy@arm.com>]

The 10/03/2023 16:11, Siddhesh Poyarekar wrote:
> Limit effect of memory tagging to the same process and don't let it
> bleed across privilege boundaries into non-setuid children of setuid
> processes.
> 
> Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>

the description does not match the documented behaviour of
SXID_IGNORE. (the setuid binary passes on the setting from
its parent, i don't see the privilege boundary crossing)

and it does not explain why would you want to turn a security
hardening feature off.

i'm not against the patch as the heap tagging feature is
very experimental at this point, but it needs a better
explanation.

> ---
>  elf/dl-tunables.list | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/elf/dl-tunables.list b/elf/dl-tunables.list
> index 42d8ffd06d..44baf10eaa 100644
> --- a/elf/dl-tunables.list
> +++ b/elf/dl-tunables.list
> @@ -152,7 +152,6 @@ glibc {
>        type: INT_32
>        minval: 0
>        maxval: 255
> -      security_level: SXID_IGNORE
>      }
>    }
>  
> -- 
> 2.41.0
>