Re: [kernel-hardening] patches for __write_rarely section

[Rik van Riel <riel@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 959 bytes --]

On Wed, 2016-11-16 at 22:39 +0800, Gengjia Chen wrote:
> Hello kees and everyone :
> 
> This email introduces two patches.
> 
> Patch 1 introduce the write-rarely memory section for
> those kernel objects which are read only mostly 
> but need to be written to sometimes.
> 
> Patch 2 introduce two helper functions (mark_wrdata_rw/
> mark_wrdata_ro) to make __write_rarely memory section
> writable or unwritable. They play like the pax_open_kernel/
> pax_close_kernel functions in grsecurity patch.Right now 
> this only been implemented on arm32.

Is this the way we want to go with this, or could it
make more sense to have a special ELF section in the
kernel that is allowed to write to write-rarely memory,
and have the exception handler deal with writes coming
from that code?

That way it would be much harder to insert code into the
kernel that calls your mark_wrdata_rw/mark_wrdata_ro
functions.

-- 
All Rights Reversed.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 473 bytes --]