요약·해설과 원문, 전문 번역을 서로 분리했습니다. API 이름, symbol, source path는 원문 표기를 사용합니다.
1. 요약·해설
원문의 핵심 논리와 kernel programming 관점의 보충 설명입니다. 아래의 전문 번역과는 별도로 작성했습니다.
2. 영어 원문 전체
번역 기준이 된 Linux v6.18.37 원문입니다. 줄 번호는 이 버전의 파일 좌표입니다.
원문 전체 펼치기
.. SPDX-License-Identifier: GPL-2.0
.. Copyright © 2024 Microsoft Corporation
===================
Executability check
===================
The ``AT_EXECVE_CHECK`` :manpage:`execveat(2)` flag, and the
``SECBIT_EXEC_RESTRICT_FILE`` and ``SECBIT_EXEC_DENY_INTERACTIVE`` securebits
are intended for script interpreters and dynamic linkers to enforce a
consistent execution security policy handled by the kernel. See the
`samples/check-exec/inc.c`_ example.
Whether an interpreter should check these securebits or not depends on the
security risk of running malicious scripts with respect to the execution
environment, and whether the kernel can check if a script is trustworthy or
not. For instance, Python scripts running on a server can use arbitrary
syscalls and access arbitrary files. Such interpreters should then be
enlighten to use these securebits and let users define their security policy.
However, a JavaScript engine running in a web browser should already be
sandboxed and then should not be able to harm the user's environment.
Script interpreters or dynamic linkers built for tailored execution environments
(e.g. hardened Linux distributions or hermetic container images) could use
``AT_EXECVE_CHECK`` without checking the related securebits if backward
compatibility is handled by something else (e.g. atomic update ensuring that
all legitimate libraries are allowed to be executed). It is then recommended
for script interpreters and dynamic linkers to check the securebits at run time
by default, but also to provide the ability for custom builds to behave like if
``SECBIT_EXEC_RESTRICT_FILE`` or ``SECBIT_EXEC_DENY_INTERACTIVE`` were always
set to 1 (i.e. always enforce restrictions).
AT_EXECVE_CHECK
===============
Passing the ``AT_EXECVE_CHECK`` flag to :manpage:`execveat(2)` only performs a
check on a regular file and returns 0 if execution of this file would be
allowed, ignoring the file format and then the related interpreter dependencies
(e.g. ELF libraries, script's shebang).
Programs should always perform this check to apply kernel-level checks against
files that are not directly executed by the kernel but passed to a user space
interpreter instead. All files that contain executable code, from the point of
view of the interpreter, should be checked. However the result of this check
should only be enforced according to ``SECBIT_EXEC_RESTRICT_FILE`` or
``SECBIT_EXEC_DENY_INTERACTIVE.``.
The main purpose of this flag is to improve the security and consistency of an
execution environment to ensure that direct file execution (e.g.
``./script.sh``) and indirect file execution (e.g. ``sh script.sh``) lead to
the same result. For instance, this can be used to check if a file is
trustworthy according to the caller's environment.
In a secure environment, libraries and any executable dependencies should also
be checked. For instance, dynamic linking should make sure that all libraries
are allowed for execution to avoid trivial bypass (e.g. using ``LD_PRELOAD``).
For such secure execution environment to make sense, only trusted code should
be executable, which also requires integrity guarantees.
To avoid race conditions leading to time-of-check to time-of-use issues,
``AT_EXECVE_CHECK`` should be used with ``AT_EMPTY_PATH`` to check against a
file descriptor instead of a path.
SECBIT_EXEC_RESTRICT_FILE and SECBIT_EXEC_DENY_INTERACTIVE
==========================================================
When ``SECBIT_EXEC_RESTRICT_FILE`` is set, a process should only interpret or
execute a file if a call to :manpage:`execveat(2)` with the related file
descriptor and the ``AT_EXECVE_CHECK`` flag succeed.
This secure bit may be set by user session managers, service managers,
container runtimes, sandboxer tools... Except for test environments, the
related ``SECBIT_EXEC_RESTRICT_FILE_LOCKED`` bit should also be set.
Programs should only enforce consistent restrictions according to the
securebits but without relying on any other user-controlled configuration.
Indeed, the use case for these securebits is to only trust executable code
vetted by the system configuration (through the kernel), so we should be
careful to not let untrusted users control this configuration.
However, script interpreters may still use user configuration such as
environment variables as long as it is not a way to disable the securebits
checks. For instance, the ``PATH`` and ``LD_PRELOAD`` variables can be set by
a script's caller. Changing these variables may lead to unintended code
executions, but only from vetted executable programs, which is OK. For this to
make sense, the system should provide a consistent security policy to avoid
arbitrary code execution e.g., by enforcing a write xor execute policy.
When ``SECBIT_EXEC_DENY_INTERACTIVE`` is set, a process should never interpret
interactive user commands (e.g. scripts). However, if such commands are passed
through a file descriptor (e.g. stdin), its content should be interpreted if a
call to :manpage:`execveat(2)` with the related file descriptor and the
``AT_EXECVE_CHECK`` flag succeed.
For instance, script interpreters called with a script snippet as argument
should always deny such execution if ``SECBIT_EXEC_DENY_INTERACTIVE`` is set.
This secure bit may be set by user session managers, service managers,
container runtimes, sandboxer tools... Except for test environments, the
related ``SECBIT_EXEC_DENY_INTERACTIVE_LOCKED`` bit should also be set.
Here is the expected behavior for a script interpreter according to combination
of any exec securebits:
1. ``SECBIT_EXEC_RESTRICT_FILE=0`` and ``SECBIT_EXEC_DENY_INTERACTIVE=0``
Always interpret scripts, and allow arbitrary user commands (default).
No threat, everyone and everything is trusted, but we can get ahead of
potential issues thanks to the call to :manpage:`execveat(2)` with
``AT_EXECVE_CHECK`` which should always be performed but ignored by the
script interpreter. Indeed, this check is still important to enable systems
administrators to verify requests (e.g. with audit) and prepare for
migration to a secure mode.
2. ``SECBIT_EXEC_RESTRICT_FILE=1`` and ``SECBIT_EXEC_DENY_INTERACTIVE=0``
Deny script interpretation if they are not executable, but allow
arbitrary user commands.
The threat is (potential) malicious scripts run by trusted (and not fooled)
users. That can protect against unintended script executions (e.g. ``sh
/tmp/*.sh``). This makes sense for (semi-restricted) user sessions.
3. ``SECBIT_EXEC_RESTRICT_FILE=0`` and ``SECBIT_EXEC_DENY_INTERACTIVE=1``
Always interpret scripts, but deny arbitrary user commands.
This use case may be useful for secure services (i.e. without interactive
user session) where scripts' integrity is verified (e.g. with IMA/EVM or
dm-verity/IPE) but where access rights might not be ready yet. Indeed,
arbitrary interactive commands would be much more difficult to check.
4. ``SECBIT_EXEC_RESTRICT_FILE=1`` and ``SECBIT_EXEC_DENY_INTERACTIVE=1``
Deny script interpretation if they are not executable, and also deny
any arbitrary user commands.
The threat is malicious scripts run by untrusted users (but trusted code).
This makes sense for system services that may only execute trusted scripts.
.. Links
.. _samples/check-exec/inc.c:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/samples/check-exec/inc.c
3. 한국어 전문 번역
영어 원문의 문단 순서와 의미를 유지한 전체 번역입니다. 코드, 함수명, symbol과 URL은 원문 표기를 유지합니다.
목적과 적용 환경
1-32`AT_EXECVE_CHECK` `execveat(2)` flag와 `SECBIT_EXEC_RESTRICT_FILE`, `SECBIT_EXEC_DENY_INTERACTIVE` securebit는 script interpreter와 dynamic linker가 kernel이 처리하는 일관된 execution security policy를 강제하도록 설계되었습니다. 예제는 `samples/check-exec/inc.c`입니다.
interpreter가 securebit를 확인해야 하는지는 malicious script가 execution environment에 주는 위험과 kernel이 script 신뢰성을 판정할 수 있는지에 달려 있습니다.
server에서 실행하는 Python script는 임의 syscall과 file에 접근할 수 있으므로 interpreter가 securebit를 이해하고 사용자가 security policy를 정하게 해야 합니다. 반면 web browser의 JavaScript engine은 이미 sandbox되어 user environment를 해칠 수 없어야 합니다.
hardened distribution이나 hermetic container image처럼 맞춤 execution environment용 interpreter/linker는 backward compatibility를 다른 방식, 예를 들어 모든 legitimate library 실행을 허용하는 atomic update로 보장한다면 securebit 확인 없이 `AT_EXECVE_CHECK`를 사용할 수 있습니다.
기본 build는 runtime에 securebit를 확인하되 custom build가 `SECBIT_EXEC_RESTRICT_FILE` 또는 `SECBIT_EXEC_DENY_INTERACTIVE`를 항상 1로 둔 것처럼 제약을 언제나 강제할 수 있게 하는 것이 권장됩니다.
interpreter 환경에 따른 securebit 필요성 예입니다.
.. SPDX-License-Identifier: GPL-2.0
.. Copyright © 2024 Microsoft Corporation
===================
Executability check
===================
The ``AT_EXECVE_CHECK`` :manpage:`execveat(2)` flag, and the
``SECBIT_EXEC_RESTRICT_FILE`` and ``SECBIT_EXEC_DENY_INTERACTIVE`` securebits
are intended for script interpreters and dynamic linkers to enforce a
consistent execution security policy handled by the kernel. See the
`samples/check-exec/inc.c`_ example.
Whether an interpreter should check these securebits or not depends on the
security risk of running malicious scripts with respect to the execution
environment, and whether the kernel can check if a script is trustworthy or
not. For instance, Python scripts running on a server can use arbitrary
syscalls and access arbitrary files. Such interpreters should then be
enlighten to use these securebits and let users define their security policy.
However, a JavaScript engine running in a web browser should already be
sandboxed and then should not be able to harm the user's environment.
Script interpreters or dynamic linkers built for tailored execution environments
(e.g. hardened Linux distributions or hermetic container images) could use
``AT_EXECVE_CHECK`` without checking the related securebits if backward
compatibility is handled by something else (e.g. atomic update ensuring that
all legitimate libraries are allowed to be executed). It is then recommended
for script interpreters and dynamic linkers to check the securebits at run time
by default, but also to provide the ability for custom builds to behave like if
``SECBIT_EXEC_RESTRICT_FILE`` or ``SECBIT_EXEC_DENY_INTERACTIVE`` were always
set to 1 (i.e. always enforce restrictions).
AT_EXECVE_CHECK
33-63`execveat(2)`에 `AT_EXECVE_CHECK`를 전달하면 regular file만 검사하고, file format과 interpreter dependency, 예를 들어 ELF library나 script shebang은 무시한 채 그 file의 실행이 허용될 경우 0을 반환합니다.
kernel이 직접 실행하지 않고 userspace interpreter에 전달하는 file에도 kernel-level check를 적용하려면 program이 항상 이 검사를 수행해야 합니다. interpreter 관점에서 executable code를 담은 모든 file을 검사합니다.
검사 결과의 강제 여부는 `SECBIT_EXEC_RESTRICT_FILE` 또는 `SECBIT_EXEC_DENY_INTERACTIVE`에 따라야 합니다.
목적은 direct execution `./script.sh`와 indirect execution `sh script.sh`가 같은 결과를 내게 하여 execution environment의 security와 consistency를 높이는 것입니다. caller environment 기준으로 file 신뢰성을 확인하는 데 쓸 수 있습니다.
secure environment에서는 library와 모든 executable dependency도 검사해야 합니다. dynamic linking은 `LD_PRELOAD` 같은 단순 우회를 막기 위해 모든 library 실행이 허용됐는지 확인해야 합니다. trusted code만 실행 가능하려면 integrity guarantee도 필요합니다.
time-of-check to time-of-use race를 피하려면 path 대신 file descriptor를 검사하도록 `AT_EXECVE_CHECK`를 `AT_EMPTY_PATH`와 함께 사용합니다.
직접·간접 실행에서 같은 kernel policy를 적용합니다.
AT_EXECVE_CHECK
===============
Passing the ``AT_EXECVE_CHECK`` flag to :manpage:`execveat(2)` only performs a
check on a regular file and returns 0 if execution of this file would be
allowed, ignoring the file format and then the related interpreter dependencies
(e.g. ELF libraries, script's shebang).
Programs should always perform this check to apply kernel-level checks against
files that are not directly executed by the kernel but passed to a user space
interpreter instead. All files that contain executable code, from the point of
view of the interpreter, should be checked. However the result of this check
should only be enforced according to ``SECBIT_EXEC_RESTRICT_FILE`` or
``SECBIT_EXEC_DENY_INTERACTIVE.``.
The main purpose of this flag is to improve the security and consistency of an
execution environment to ensure that direct file execution (e.g.
``./script.sh``) and indirect file execution (e.g. ``sh script.sh``) lead to
the same result. For instance, this can be used to check if a file is
trustworthy according to the caller's environment.
In a secure environment, libraries and any executable dependencies should also
be checked. For instance, dynamic linking should make sure that all libraries
are allowed for execution to avoid trivial bypass (e.g. using ``LD_PRELOAD``).
For such secure execution environment to make sense, only trusted code should
be executable, which also requires integrity guarantees.
To avoid race conditions leading to time-of-check to time-of-use issues,
``AT_EXECVE_CHECK`` should be used with ``AT_EMPTY_PATH`` to check against a
file descriptor instead of a path.
SECBIT_EXEC_RESTRICT_FILE
64-88`SECBIT_EXEC_RESTRICT_FILE`이 설정되면 관련 file descriptor와 `AT_EXECVE_CHECK`를 사용한 `execveat(2)` 호출이 성공한 file만 process가 interpret하거나 execute해야 합니다.
user session manager, service manager, container runtime, sandboxer tool 등이 이 securebit를 설정할 수 있습니다. test environment를 제외하면 `SECBIT_EXEC_RESTRICT_FILE_LOCKED`도 함께 설정해야 합니다.
program은 securebit에 따른 일관된 restriction만 강제하고 다른 user-controlled configuration에 의존하면 안 됩니다. system configuration과 kernel이 검증한 executable code만 신뢰하는 것이 목적이므로 untrusted user가 이 configuration을 제어하게 해서는 안 됩니다.
securebit 검사를 끄는 수단이 아니라면 interpreter가 environment variable 같은 user configuration을 계속 써도 됩니다. caller가 `PATH`와 `LD_PRELOAD`를 바꿔 의도치 않은 code execution이 생겨도 vetted executable program만 실행된다면 허용됩니다.
이 전제가 성립하려면 write xor execute policy 같은 일관된 system security policy로 arbitrary code execution을 막아야 합니다.
설정 주체와 반드시 지켜야 할 조건입니다.
SECBIT_EXEC_RESTRICT_FILE and SECBIT_EXEC_DENY_INTERACTIVE
==========================================================
When ``SECBIT_EXEC_RESTRICT_FILE`` is set, a process should only interpret or
execute a file if a call to :manpage:`execveat(2)` with the related file
descriptor and the ``AT_EXECVE_CHECK`` flag succeed.
This secure bit may be set by user session managers, service managers,
container runtimes, sandboxer tools... Except for test environments, the
related ``SECBIT_EXEC_RESTRICT_FILE_LOCKED`` bit should also be set.
Programs should only enforce consistent restrictions according to the
securebits but without relying on any other user-controlled configuration.
Indeed, the use case for these securebits is to only trust executable code
vetted by the system configuration (through the kernel), so we should be
careful to not let untrusted users control this configuration.
However, script interpreters may still use user configuration such as
environment variables as long as it is not a way to disable the securebits
checks. For instance, the ``PATH`` and ``LD_PRELOAD`` variables can be set by
a script's caller. Changing these variables may lead to unintended code
executions, but only from vetted executable programs, which is OK. For this to
make sense, the system should provide a consistent security policy to avoid
arbitrary code execution e.g., by enforcing a write xor execute policy.
SECBIT_EXEC_DENY_INTERACTIVE
89-101`SECBIT_EXEC_DENY_INTERACTIVE`가 설정되면 process는 interactive user command, 예를 들어 script snippet을 절대 interpret하지 않아야 합니다.
다만 command가 stdin 같은 file descriptor로 전달되었고 해당 descriptor에 대한 `AT_EXECVE_CHECK` `execveat(2)` 호출이 성공하면 그 content를 interpret해야 합니다.
script snippet을 argument로 받은 interpreter는 이 securebit가 설정된 경우 항상 실행을 거부합니다.
session/service manager, container runtime, sandboxer 등이 설정할 수 있고 test environment 외에는 `SECBIT_EXEC_DENY_INTERACTIVE_LOCKED`도 함께 설정해야 합니다.
입력 경로별 허용 조건입니다.
When ``SECBIT_EXEC_DENY_INTERACTIVE`` is set, a process should never interpret
interactive user commands (e.g. scripts). However, if such commands are passed
through a file descriptor (e.g. stdin), its content should be interpreted if a
call to :manpage:`execveat(2)` with the related file descriptor and the
``AT_EXECVE_CHECK`` flag succeed.
For instance, script interpreters called with a script snippet as argument
should always deny such execution if ``SECBIT_EXEC_DENY_INTERACTIVE`` is set.
This secure bit may be set by user session managers, service managers,
container runtimes, sandboxer tools... Except for test environments, the
related ``SECBIT_EXEC_DENY_INTERACTIVE_LOCKED`` bit should also be set.
Securebit 조합 0/0
102-115`RESTRICT_FILE=0`, `DENY_INTERACTIVE=0`이면 모든 script를 interpret하고 임의 user command를 허용하는 기본 mode입니다.
모두를 신뢰하므로 threat는 없다고 가정하지만 interpreter는 `AT_EXECVE_CHECK` 호출을 항상 수행하고 결과를 무시해야 합니다. 그래야 administrator가 audit 등으로 request를 검증하고 secure mode migration을 준비할 수 있습니다.
기본 허용 mode입니다.
Here is the expected behavior for a script interpreter according to combination
of any exec securebits:
1. ``SECBIT_EXEC_RESTRICT_FILE=0`` and ``SECBIT_EXEC_DENY_INTERACTIVE=0``
Always interpret scripts, and allow arbitrary user commands (default).
No threat, everyone and everything is trusted, but we can get ahead of
potential issues thanks to the call to :manpage:`execveat(2)` with
``AT_EXECVE_CHECK`` which should always be performed but ignored by the
script interpreter. Indeed, this check is still important to enable systems
administrators to verify requests (e.g. with audit) and prepare for
migration to a secure mode.
Securebit 조합 1/0
116-124`RESTRICT_FILE=1`, `DENY_INTERACTIVE=0`이면 executable로 허용되지 않은 script 해석을 거부하지만 임의 user command는 허용합니다.
trusted user가 악의적 script를 속아서 실행할 가능성을 위협으로 보며 `sh /tmp/*.sh` 같은 의도치 않은 실행을 막습니다. semi-restricted user session에 적합합니다.
file restriction만 강제합니다.
2. ``SECBIT_EXEC_RESTRICT_FILE=1`` and ``SECBIT_EXEC_DENY_INTERACTIVE=0``
Deny script interpretation if they are not executable, but allow
arbitrary user commands.
The threat is (potential) malicious scripts run by trusted (and not fooled)
users. That can protect against unintended script executions (e.g. ``sh
/tmp/*.sh``). This makes sense for (semi-restricted) user sessions.
Securebit 조합 0/1
125-133`RESTRICT_FILE=0`, `DENY_INTERACTIVE=1`이면 script는 항상 interpret하지만 임의 user command는 거부합니다.
interactive user session이 없는 secure service에서 script integrity를 IMA/EVM 또는 dm-verity/IPE로 검증하지만 access right가 아직 준비되지 않은 경우 유용할 수 있습니다. 임의 interactive command는 검사하기 훨씬 어렵습니다.
interactive input만 차단합니다.
3. ``SECBIT_EXEC_RESTRICT_FILE=0`` and ``SECBIT_EXEC_DENY_INTERACTIVE=1``
Always interpret scripts, but deny arbitrary user commands.
This use case may be useful for secure services (i.e. without interactive
user session) where scripts' integrity is verified (e.g. with IMA/EVM or
dm-verity/IPE) but where access rights might not be ready yet. Indeed,
arbitrary interactive commands would be much more difficult to check.
Securebit 조합 1/1과 예제
134-144`RESTRICT_FILE=1`, `DENY_INTERACTIVE=1`이면 executable로 허용되지 않은 script를 거부하고 임의 user command도 모두 거부합니다.
untrusted user가 malicious script를 실행하는 상황을 threat로 보되 실행 code 자체는 trusted라고 가정합니다. trusted script만 실행해야 하는 system service에 적합합니다.
`samples/check-exec/inc.c` 예제 link는 `https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/samples/check-exec/inc.c`입니다.
두 bit 조합의 최종 실행 정책입니다.
4. ``SECBIT_EXEC_RESTRICT_FILE=1`` and ``SECBIT_EXEC_DENY_INTERACTIVE=1``
Deny script interpretation if they are not executable, and also deny
any arbitrary user commands.
The threat is malicious scripts run by untrusted users (but trusted code).
This makes sense for system services that may only execute trusted scripts.
.. Links
.. _samples/check-exec/inc.c:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/samples/check-exec/inc.c
요약·해설
check_exec.rst:1-144AT_EXECVE_CHECK와 실행 제한 securebit를 통해 직접·간접 script 실행에 일관된 kernel policy를 적용하는 방법을 설명합니다.
원문 ABI name, ioctl, sysfs path, 수치, code symbol과 줄 좌표를 유지해 모든 절을 한국어로 옮겼습니다.