Slashdot Mirror
Red Hat Introduces NX Software Support For Linux
abertoll writes "In this story at ZDnet, Red Hat has apparently added NX support to Linux. NX security technology is a hardware attempt at stopping malicious code." (We recently posted about Transmeta's announcement that its chips will incorporate the NX bit as well.)
What I fail to understand is the difference between this 'no execute' bit and the 'executable' bit in standard 386 protected mode. Does the 'executable' bit not cause an exception if the PC proceeds to pages without it set? Even then, protected mode also has a 'read-only' bit - isn't this set for code pages? And if not, why not?
I personally can't wiat until some great evil makes a virus harnising NX to say.....block the execution of MSIE .....widespread luser panic is always fun
-- Checking emails and kicking cheats `till the day I die.
And I always wanted processor support for the Evil Bit. Dang.
... NX support is not an excuse to write potentially unsafe code.
I noticed Slashdot was down for a few minutes just prior to posting this. I'll assume they were upgrading their servers.
So does this mean I'm out of luck with all those shellcodes I keep posting in my comments?
Karma: Segmentation fault (tried to dereference a null post)
Windows has supported that for years.
Why just yesterday it stoped executing for no particular reason.
Standard 386 protected mode controls per segment, where CS (code segment) is executable and DS (data segment) is writable. However, many 32-bit operating systems use a so-called "tiny" memory model, setting CS = DS, and the 386 allows for turning off read and write privileges per page but not execute privileges (if you can read a page in an executable segment, you can execute from it).
However, true W^X (shorthand for "no segment is both writable and executable") support won't work for applications that depend on self-modifying code, such as JIT-compiling virtual machines for Java and .NET platforms.
Karma: Segmentation fault (tried to dereference a null post)
... all those fellow /.'ers who cried out loud "we don't want no DRM" when they first read the titles of the stories about NX support in upcoming procs, without even bothering to understand WTH NX is for, and kept and kept writing idiotic comments about how evil Windows must be because it now supports NX (which they seriously thought was some form of ah-so-evil DRM feature)
:) I am happy that you will now have an opportunity to open your minds to this fine new technology.
See, NX is a good thing, now even Linux has support for it
Cheers.
Seriousely, the NX stuff is a "good" thing to add to slow down malicious code - the only thing better would be a HULK Instruction which would SMASH Puny Human malicious code ... ;-)
Hulk SMASH Celiac Disease
This "NX" stuff to separate data and instructions is sort of like crossing current CPUs' Von Neumann architecture with a Harvard architecture type of chip, where the storage is actually separate from the executable code.
This is all well and good, but is certainlly not a panacia.
No execute means that somewhere, somehow there will be an override and the day the override is used the virus' will follow by tricking (and explaining how) to the user why this is needed and bingo, it's in.
And of course I could be completely wrong in that this no execute bit does not exist on older processors and that in itself is going to cause problems. Intel has xbit on newer processors, but what about AMD, VIA, whoever else? Is this part of the Intel half of the WinTel duopoly?
I think it's probably a good idea, but I'm suspicious.
Comment removed based on user account deletion
How would Just-in-time compilers and interpreters work? If I understand this correctly, you can't write data to executable areas of memory, but then how do you run instructions that are written to memory!?!? Could someone explain?
Calling it a "technology" I suppose detracts from the fact that the lack of an executable bit in x86 page tables is a deficiency. You see, this "feature" has been around since, oh, the middle of the last century, and many processors other than x86 have supported it without even considering it worth mentioning.
I'm Captain Jonathon Archer of the starship, Red Hat Enterprise, NX-01 class security. ;-)
It is impossible to enjoy idling thoroughly unless one has plenty of work to do.
- Jerome Klapka Jerome
"AMD's Athlon 64 and Opteron processors have had NX since their debut, though the extra bit won't do anything on a Windows XP system until you obtain and install Service Pack 2. Intel is expected to add NX (or XD) to the next generation of its 90-nanometer-process Pentium 4 "Prescott" CPUs -- bundling the security enhancement with a larger 2MB Level 2 cache and perhaps a faster 1066MHz front-side bus -- in the fourth quarter of this year."
This year has truly been AMD's year to guide the microprocessor market. Remember not so far back when everything AMD did was a response to Intel? This year it's been Intel responding to AMD. I hope this trend continues as it shows that the so-called WIntel stranglehold is starting to crack and that it is possible for the competition to assume a leading role in the market. Now hopefully, IBM has something in the works for it's PPC/Power lines, as they've been working closely with AMD and this processor feature is something that every networked system could use.
Who defines what is malicious? Is it outwrite malicous activity (READ intrusion and destruction), or code that is identified and peer reviewed as malicious? I just want to know who is deciding what can go on my box and why. Will mp3's be one day named malicious because the code may or may not infringe on patents? Or is this truly a stop-gap measure to prevent getting rooted? What about patent infringements? Im sure some quarters would say that is malicious indeed. Just a question after my beers. DB
This new patch is to support NX in 32-bit processors or 64-bit processors running in 32-bit mode.
The 2.6.6 kernel already included an NX patch for x86_64. Details are in the "Non-Exec stack patches" LKML thread here.
Who defines what is interesting? I just want to know who is deciding what posts are interesting and what is not. Because this poster has no fucking clue what he's talking about.
Yes, I sincerely agree. Unfortunately this usage error of the word is now so widespread, I fear nothing can be done anymore.
Looks like only the wise understand the distinction among "tool" and "feature" and and "technique" and "technology", but the rest of the people who gather their world knowledge from buzzword driven press articles will keep thinking that Visual Basic is a "technology" as well as Java.
Actually it would be interesting to discuss how the scopes of these 3-4 concepts should be in the area of computers.
Some legitimate programs, such as Java compilers that perform just-in-time code generation, execute instructions within data areas -- and will have to be rewritten for Service Pack 2. But the most common exploiters of x86 architecture's porous program and data boundaries are applications (called, as a matter of fact, exploits) that perform buffer overrun attacks -- one-two punches that first flood a program's input area with more data than it's designed to handle, then deliver a poisonous executable payload. ..........
Software developers will be able to selectively disable execution protection for 32-bit applications, using a DisableNX fix in SP2's compatibility toolkit, and end users will be able to switch the feature on and off for the entire system or for individual applications (like those Java compilers) via a new Control Panel dialog box, similar to those for SP2's beefed-up firewall .
Now it is time for you, young grsshopper, to learn as well.
translation:
Malicious code executing itself via a buffer overflow is actually one of the lesser evils in the virus world. Most users will gladly allow anything to run on their box, especially if it does something cool (time, weather, cutesy things, etc), and with everyone being root on Windows boxes, this means the program can do whatever the hell it wants and windows won't say anything/much.
The NX bit is great, especially for servers where generally the only kind of attack is a buffer overflow. Like I said the procesor has learned well, but the users must learn also.
md5sum
d41d8cd98f00b204e9800998ecf8427e
Due to overhead, if any!
This is basically an "execute / no-execute" bit in the page-table entries. It means the OS can mark portions of an application's virtual address space as non-executable - such as pages in the heap or the stack. It'll help against buffer-overflow attacks that put new assembly code in the stack and return into it. It won't help against buffer-overflow attacks that return into existing code (e.g., to do a system call). It won't help against worms that take advantage of meta-character expansion vulnerabilities. It won't help against scripting flaws (such as javascript, active-x, or visual-basic/outlook vulnerabilities). It won't help against weaknesses in the OS itself.
Think of this as raising the bar. Of course, the "clever" attackers will still find flaws, and still write code for the script kiddies to use to exploit them.
http://zdnet.com.com/2100-1104-5227102.html:
Don't they mean that Linux had new wireless network support this year? Or was Intel the wireless support contributor for Linux? Either way I think the sentence is in error. Though I'm probably just being pendantic for raising it.
---
VPS Hosting
This, to me, seems like just one more slow, inexhorable step towards "Trusted Computing".
...of the Evil Bit?
From what I've read, it certainly makes sense to break a few apps for this functionality, as you can always run them in a build without it. Things should be a lot safer, as crap like buffer overruns from carefully formatted input strings can no longer contain executable code.
I think this should be available for individual programs to set the NX bit on memory pages that should only contain data, so, for example, when you download a file, it is impossible to execute it (say, while in memory) until you save it and explicitely set the execute bit. In other words, there is a completely non-executable path for all untrusted code from its inception until the user explicitly makes it run. Now, when some Joe Luser clicks an email attachment virus made for Linux, if this ever happens, it will be very difficult for him to make it run, and hence, it won't. Add to that the protections inherent in all Linux systems (multiuser permissions, heterogeneous configurations, etc.), and it's very unlikely that Linux users will experience the kind of crap that Windows users have to put up with on a daily basis, even if Linux somehow gains a huge market share on the desktop.
These are exciting times.
It might be a bit 'off topic' but the draw back of NX is that self modifying code is no more supported.
Although, I don't know if SM code is supported on Linux - Under Windows you had to use 'VirtualProtect with PAGE_READWRITE -, anyway it's a bit 'outdated' technique - lot of cache misses issues, Intel was against SM code, although i used it a lot a long time ago). So it shouldn't be a real issue.
The question is : can NX will disable with the (root) user under Linux, as it will be under WinXP SP2 ?
I need a Sino-Logic 16. Sogo-7 data-gloves, a GPL stealth module...
Considering the current Linux architecture, I really don't see a problem with what's proposed... especially if the chances of breaking things are almost nill. Doesn't seem a far stretch due to the way things currently run in Linux anyway. Developers can work around any problems that may arise anyway. This will help to ensure that Linux remains one of the most promising operating systems available, and even moreso than it is already.
I saw mention in the linked article that Microsoft plans NX support in their SP2 release for Windows XP, but seriously... I don't see this as either happening in the first place, or having the potential to really screw things up. Won't this break a huge amount of applications? Think about it, the Windows platform is notorious for allowing programs to execute whatever code they like... even going so far as to say that some rely on that ability. Any thoughts on this?? I just don't see it happening with the current architecture, that's all.
Linux with kernel panic...
MadPenguin.org
The PaX patch effectively implements this feature on older x86 processors that don't have hardware NX support. It takes advantage of the fact that data and code have separate page table caches.
It comes with a pretty high performance overhead, though. A page fault will occur for any miss of the TLB cache while normally they are just loaded from the page table in main memory.
Stop worrying about the risks of nuclear power and start worrying about the risks of not using nuclear power.
How does this affect C++ compilers that generate vtables of class function pointers? Does that mean we'll all need new compilers (or updated run time libraries), not just an API call that we'd only use if our code actually needs to execute from mallocated memory?
Why do we need a per-page NX bit if the write and execute permissions are already set for the segment?
Even on the 286 (running in protected mode), code segments are executable, but cannot be writeable, and non-code segments can be writeable, but not executable. I think that's basically what you want - non-executable data, and non-modifiable code (of course, the code needs to be written to memory once, but you can make it non-writeable before starting execution).
So how come we also need an NX bit on pages (knowing that pages can only be accessed if there is a segment that references them)? Do our operating simply ignore the security that the segment permissions provide, and if yes, why? Why is per-page control so much better than per-segment control?
Please correct me if I got my facts wrong.
I love C++
Grsecurity/PAX users have had this on ALL the platforms for couple years already.
Grsecurity/pax has had a few hundred more security enhanchement improvements over the stuff the articles now here are talking about. So what's the fuzz? Hah.
Btw, the development of Grsecurity (which is the best [most secure, most effective, easiest] way to make Linux platform secure) stopped already and the project will officially die tomorrow due the lack of sponsors.
Grsecurity is ending... we need to find a new maintainer for it:
5/31/04 Important Announcement Regarding the grsecurity Project Beginning today, May 31, 2004, development of grsecurity will cease. On June 7, the website, forums, mailing list, and CVS will be shut down. Due to a sponsor unexpectedly dropping sponsorship of grsecurity while continually promising payment, I began the summer in debt and had to borrow money from family to pay for food. If none of the companies that depend on grsecurity, some of them being very large, are able to sponsor the project, grsecurity will cease to exist. Though grsecurity is licensed under the GPL, I am the sole developer and originator of ideas for the project. Though it would be possible for others to handle maintenance of the project, the quality won't be held to the same standards and will not progress with the same goals I have set for the project. I am not looking for help with hosting, as the hosting for grsecurity has been provided for free for over a year and a half and will continue to be provided unless the project has to end. I am also not looking for paypal donations at this point, unless those that donate do so with the recognition that despite their donation, grsecurity may still never be returning. If your company wishes to sponsor grsecurity, please contact me at spender@grsecurity.net. To continue to the website (until June 7th), click here.
You people are so mean! :(
That is it from now I - I ain't playing no more
Got to lurve my new sig tho!
by design.
Say goodbye to insecure and slow programs - and say hello to fast and secure languages!
This is not DRM and does nothing to stop downloaded code from running.
The NX bit is used to mark parts of memory of a running program. Certainly it will mark anything allocated from the heap, such as the memory used to store a piece of data downloaded from the net, and then written to the disk. However it does not have any magic "sticky" property that stays with the data. If the downloading program thinks that data is a program that should be run, rest assurred that it will have the capability of saving it on disk, turning on the execute file bit (on Linux), and exec'ing it, with no changes to the code from today.
Even today without the NX bit, I really doubt any program actually and deliberatly downloads blocks of data from the net and then jumps to it. What NX does is prevent that from happening due to a malicious program that somehow gets some data into memory including a jmp instruction to that data. This is possible today by overwriting the stack so the return address and malicious code is there.
The VAX had NX, this is not new technology. I'm assumming NX was not added for so long was that there was that there was no room to add a bit to do it to the page description. Though I don't understand why Intel didn't just make a mode where write-permission==NX so you cannot execute any page you can write to.
When is that to be integrated into the CPU, and supported by all OS's?
Just so know when to stop buying hardware and horde older equipment that isnt crippled.....
---- Booth was a patriot ----
IIRC, certain DSP processor really had an assembly instruction called HAB - Halt And Burn. Or something similar.
What it did was it somehow shorted the address pins of the DSP so that the IO pin output buffers heated from all the current flowing through them, and eventually they melted.. Making the DSP effectively not working.
Propably useful in military applications.
The IA32 CPU architecture defines 4 protection rings, with ring 0 being the most privileged and ring 3 being the less privileged. This type of protection is not used in modern operating systems, though, because this protection involves segmentation. What is used is the page descriptor's R/W bits and the user/supervisor bit.
Instead of having R/W or user/supervisor bits, the page descriptor could have separate ring information for each type of access( write/read/execute), as well the ring level of the page. 8 bits would be needed for such a protection mechanism (2 bits per access type).
For example, the IA32 page descriptor could have the following format:
Proposed page descriptor format:
bit 0: page present/swapped
bit 1: page written
bit 2: page read
bits 4-5: current ring
bits 6-7: max ring allowed to read
bits 8-9: max ring allowed to write
bits 10-11: max ring allowed to execute
bits 12-31: page frame
The CPU would produce a protection fault if
current ring > access type ring.
The above elegant solution solves some foundamental problems of the operating systems:
a) prevent execution of code "hidden" in data (this is what the NX bit does)
b) easy transition from ring 3 to ring 0 (or from any higher to lower ring) and vice versa without any special instructions, without interrupts, without reading from GDT or LDT tables: code in a page with current ring = 3 could execute code with execute ring = 3, but the executed code would be kernel code, since it would have current ring = 0.
c) separation between kernel, drivers, libraries and applications: the kernel would be at ring 0, drivers at ring 1, libraries at ring 2, and applications at ring 3. No badly written piece of code (driver, library, application) could ruin the kernel.
To further enchance security, the first instruction after a jump/call should be a special instruction which does not do anything, other than allow code to be executed. This solution would make impossible for wild pointers to execute code.
The above security scheme is very flexible and does not compromise flat 32-bit addressing.
(I hope some hardware engineer from Intel/AMD reads this. I would be happy to explain it further).
I bet you are the life of the party!
All you needed was to use M$ and I would have pissed my pants! I am laughing uncontrollably, honest!
Whats your pickup line?
"hey there, why do all credit card numbers have 5 in them?"
lollol roflroflrofllollol omg omglolroflrofllolomgomgomg lol roflrofl
I, for one, welcome our new NX overlords...
Ethics is what you say you do. Morals is what you actually do.
I bet that was a bugger if you had a memory corruption bug in your code.