Linux Patches Posted That Would Allow Boot-Time Disabling Of x86 32-bit Processes

[ferry]

What hybrid car has a benzine engine? That would be REALLY dangerous to fill at the pump!

Toyota Prius

[binarybanana]

In my kernel I just disable x86 support entirely. So far I have not missed it. But I run a Windows VM for games instead of relying on wine/proton so that's the biggest use case already covered.

[Weasel]

So wait a sec… Disabling 32-bit syscalls is a separate change from disallowing 32-bit code segments? So what happens if someone loads a 32-bit process successfully but syscalls are unavailable? :/

It will fault when it executes the 32-bit syscall.

You can run code without syscalls though, and switch modes inside of the process.

[lowflyer]

I fail to see how disallowing 32-bit syscalls to the 64-bit system reduces the attack surface. It's just another one of these checkbox approaches: "Yeah, we've done something, check!"

[ssokolow]

I fail to see how disallowing 32-bit syscalls to the 64-bit system reduces the attack surface. It's just another one of these checkbox approaches: "Yeah, we've done something, check!"

Basically, the same rationale as when they disabled 16-bit LDT because they found an exploitable vulnerability in it, breaking Wine for a while. Less commonly used code paths are more likely to have vulnerabilities lurking, so, if you don't use them, it makes sense to have the ability to disable them on your system.

Heck, if I can ever find time to write my planned self-hosted alternative to Disqus (the existing Go-based one doesn't meet my needs), I intend to migrate my blog from the copy of WordPress I've been upgrading since 2005 to a static site generator, because code that doesn't exist won't waste my time constantly needing patches installed.

[loganj]

You probably mean x86. x32 is a special abi. Clueless Windows users typically think x32 must be the name of the old stuff because x64 exists.

i know about all that crap, great master linux user. i'm so sick of it with all those naming schems like i386 i686 x86 and all that crap. by x32 i ment 32bits. sorry i offended such a master

[loganj]

x32 programs already don't run on most distributions, because that requires a separate kernel config option to be enabled.

ok. but what about x32 libs i keep seeing some programs still using? are those programs x64bits using x32libs?

[oiaohm]

ok. but what about x32 libs i keep seeing some programs still using? are those programs x64bits using x32libs?

https://en.wikipedia.org/wiki/X32_ABI

Just something to be aware of Linux world has two 32 bit addressing on x86 . x32 and x64 are both 64 bit extended x86 instructions. Your normal distribution 32-bit linux is 32 bit x86 instructions. The x is the word extended. x86 is extended 86 as in extended 8086. x32 is extended 32 and x64 is extended 64.

On linux
1) i386/x86 is normally used to market packages that are 32 bit instruction with 32 bit addressing.
2) x32 is used 64 bit instructions with 32 bit addressing.
3) X64 is used for 64 bit instructions with 64 bit addressing.
Linux kernel can be built with all 3 enabled as syscalls to be provided.

x32 is not that popular. Reason for 64 bit instructions with 32 bit addressing was to get the performance advantage of 64 bit addressing and avoid the memory cost of long pointers in structures this turned out to be a very minor amount of difference.

What makes i386/x86 +x32+x64 horrible is they don't share libraries with each other. So you want to run today the following

• 1 x32 application you need all the libraries it will be using in x32.
• 1 x64 application you need all the libraries it will be using in x64
• 1 i386/x86 application you need all the libraries it will be using in i386/x86.

There is no bridge between them in the Linux world other than the kernel itself.

Winehq project with hangover work shows that bridges between are in fact possible. Wine has a bridge from 16 to 32 bit and will have bridge from 32 to 64 bit once all the required alterations are done.

Disable 32 bit syscalls in kernel might give the push to make 32 to 64 bit bridge so that 32 bit application can use 64 bit libraries so reducing amount of runtime system needs..

[jacob]

There is plenty of legacy software which will never be recompiled for 64-bit architectures. What will we do if this becomes the default? Run them through a 32-bit emulator? Probably this won't be the default for end-user desktops. Workstations and servers would be fine.

I guess eventually yes, run through an emulator just like nowadays we run "real mode" 16-bit software through an emulator, even though the CPUs still theoretically support it. When that time comes, a 32-bit CPU emulator running on the hardware we will have by then will easily outperform the Athlons and Pentium 4's etc. that kind of software was meant to run on anyway.

[archkde]

https://en.wikipedia.org/wiki/X32_ABI

Just something to be aware of Linux world has two 32 bit addressing on x86 . x32 and x64 are both 64 bit extended x86 instructions. Your normal distribution 32-bit linux is 32 bit x86 instructions. The x is the word extended. x86 is extended 86 as in extended 8086. x32 is extended 32 and x64 is extended 64.

No, "x" does not mean "extended", it's a wildcard standing for several successors of the 8086 (80186, 80286, 80386 and 80486), and the term caught on and kept being used even when Intel began calling their processors something else (e.g. Pentium). x64 is the Microsoft term for what's more accurately called x86-64, and x32 is a Linux-specific ABI for x86-64 programs with 32-bit pointers.