New subject: [Bug 56650] Report on SELinux 'execheap' Issues with wine-preloader

8 May 2024


      https://bugs.winehq.org/show_bug.cgi?id=56650
Bug ID: 56650
           Summary: Report on SELinux 'execheap' Issues with
                    wine-preloader
           Product: Wine
           Version: 9.8
          Hardware: x86-64
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: -unknown
          Assignee: wine-bugs@winehq.org
          Reporter: chplee@gmail.com
      Distribution: ---
This report was prepared by ChatGPT. I'm sorry that my own ability is not
enough to support such a large amount of code analysis, so I have to turn to
ChatGPT.
I'm filing this report because a lot of people are suffering from this problem.
Please refer to:
https://bugzilla.redhat.com/show_bug.cgi?id=2247299
### Report on SELinux 'execheap' Issues with `wine-preloader`
#### Introduction
The `wine-preloader` program is a crucial part of the Wine software, which
allows Windows applications to run on Unix-like operating systems. An issue has
been identified where SELinux prevents `wine-preloader` from executing code in
writable memory regions, raising security alerts related to 'execheap'
accesses. This report identifies potential sources of the issue in the program
and provides recommendations for modifications.
#### Potential Issues Identified
1. **Memory Mapping and Protection Setup**:
   In `wine-preloader`, memory mapping is handled with protections set that
could potentially include both write and execute permissions. This is
particularly evident in the function calls to `wld_mmap`, where memory
protection flags are set based on the segment flags parsed from ELF headers.
```c
   wld_mmap((void *)(l->l_addr + c->mapstart), c->mapend - c->mapstart,
c->prot, MAP_FIXED | MAP_COPY | MAP_FILE, fd, c->mapoff);
   ```
Here, the `c->prot` can contain combinations of `PROT_READ`, `PROT_WRITE`,
and `PROT_EXEC` based on the segment's flags.
2. **Dynamic Code Generation**:
   Dynamic generation or modification of code could potentially occur, though
not explicitly shown in the code snippets provided, it could be inferred from
the overall functionality where executable code may be modified or generated
on-the-fly.
3. **Modifying Memory Protection Attributes**:
   The use of `wld_mprotect` to change the protection attributes of memory
pages could lead to states where pages are both writable and executable.
```c
   wld_mprotect((caddr_t) (zero & ~page_mask), page_size, c->prot|PROT_WRITE);
   ```
Although this snippet aims to make pages writable temporarily, if combined
inappropriately with executable flags elsewhere, it could trigger SELinux
policies.
#### Recommendations
- **Restricting Memory Permissions**:
  Enforce strict separations between writable and executable pages. Modify the
logic that sets memory protections to ensure that no memory page is both
writable and executable at the same time. This can be achieved by adjusting the
ELF segment loading routines to separate code and data segments clearly.
- **Use of Memory Protection Changes**:
  Implement a clear two-step process for handling memory that needs to be
executable:
  - Initially, set memory to writable to modify or generate code.
  - Once modifications are complete, change the memory protection to executable
only (removing write permissions).
- **Code Audit and Testing**:
  Conduct a thorough audit of the places where memory permissions are set. Test
under a SELinux-enforced environment to ensure that the adjustments meet
security policies without hindering functionality.
- **SELinux Policy Adjustments**:
  If `wine-preloader` inherently requires certain operations that SELinux
policies restrict, consider creating custom SELinux policy modules that allow
specific actions while maintaining overall security. This should be done
cautiously to avoid creating unnecessary security holes.
#### Conclusion
Adjustments to `wine-preloader` should focus on ensuring that memory regions
are either writable or executable but never both. By adhering to security best
practices and possibly adjusting SELinux policies, `wine-preloader` can
function effectively without triggering security violations in SELinux
environments.
-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 56650] New: Report on SELinux 'execheap' Issues with wine-preloader