[kernel-hardening] Re: [PATCH 3/3] arm64: dump: Add checking for writable and exectuable pages

All of lore.kernel.org
 help / color / mirror / Atom feed

From: Mark Rutland <mark.rutland@arm.com>
To: Laura Abbott <labbott@redhat.com>
Cc: AKASHI Takahiro <takahiro.akashi@linaro.org>,
	Ard Biesheuvel <ard.biesheuvel@linaro.org>,
	David Brown <david.brown@linaro.org>,
	Will Deacon <will.deacon@arm.com>,
	Catalin Marinas <catalin.marinas@arm.com>,
	linux-arm-kernel@lists.infradead.org,
	linux-kernel@vger.kernel.org, Kees Cook <keescook@chromium.org>,
	kernel-hardening@lists.openwall.com
Subject: [kernel-hardening] Re: [PATCH 3/3] arm64: dump: Add checking for writable and exectuable pages
Date: Fri, 30 Sep 2016 16:58:25 +0100	[thread overview]
Message-ID: <20160930155814.GA1729@remoulade> (raw)
In-Reply-To: <20160929213257.30505-4-labbott@redhat.com>

On Thu, Sep 29, 2016 at 02:32:57PM -0700, Laura Abbott wrote:
> @@ -219,6 +223,15 @@ static void note_page(struct pg_state *st, unsigned long addr, unsigned level,
>  		unsigned long delta;
>  
>  		if (st->current_prot) {
> +			if (st->check_wx &&
> +			((st->current_prot & PTE_RDONLY) != PTE_RDONLY) &&
> +			((st->current_prot & PTE_PXN) != PTE_PXN)) {
> +				WARN_ONCE(1, "arm64/mm: Found insecure W+X mapping at address %p/%pS\n",
> +					 (void *)st->start_address,
> +					 (void *)st->start_address);
> +				st->wx_pages += (addr - st->start_address) / PAGE_SIZE;
> +			}
> +

Would it be worth verifying that all kernel mappings are UXN, too?

ARMv8 allows execute-only mappings, and a !UXN mapping could result in an info
leak (e.g. pointers in MOVZ+MOVK sequences), or potential asynchronous issues
(e.g. user instruction fetches accessing read-destructive device registers).
All kernel mappings *should* be UXN.

Thanks,
Mark.

WARNING: multiple messages have this Message-ID (diff)

From: mark.rutland@arm.com (Mark Rutland)
To: linux-arm-kernel@lists.infradead.org
Subject: [PATCH 3/3] arm64: dump: Add checking for writable and exectuable pages
Date: Fri, 30 Sep 2016 16:58:25 +0100	[thread overview]
Message-ID: <20160930155814.GA1729@remoulade> (raw)
In-Reply-To: <20160929213257.30505-4-labbott@redhat.com>

On Thu, Sep 29, 2016 at 02:32:57PM -0700, Laura Abbott wrote:
> @@ -219,6 +223,15 @@ static void note_page(struct pg_state *st, unsigned long addr, unsigned level,
>  		unsigned long delta;
>  
>  		if (st->current_prot) {
> +			if (st->check_wx &&
> +			((st->current_prot & PTE_RDONLY) != PTE_RDONLY) &&
> +			((st->current_prot & PTE_PXN) != PTE_PXN)) {
> +				WARN_ONCE(1, "arm64/mm: Found insecure W+X mapping at address %p/%pS\n",
> +					 (void *)st->start_address,
> +					 (void *)st->start_address);
> +				st->wx_pages += (addr - st->start_address) / PAGE_SIZE;
> +			}
> +

Would it be worth verifying that all kernel mappings are UXN, too?

ARMv8 allows execute-only mappings, and a !UXN mapping could result in an info
leak (e.g. pointers in MOVZ+MOVK sequences), or potential asynchronous issues
(e.g. user instruction fetches accessing read-destructive device registers).
All kernel mappings *should* be UXN.

Thanks,
Mark.

WARNING: multiple messages have this Message-ID (diff)

From: Mark Rutland <mark.rutland@arm.com>
To: Laura Abbott <labbott@redhat.com>
Cc: AKASHI Takahiro <takahiro.akashi@linaro.org>,
	Ard Biesheuvel <ard.biesheuvel@linaro.org>,
	David Brown <david.brown@linaro.org>,
	Will Deacon <will.deacon@arm.com>,
	Catalin Marinas <catalin.marinas@arm.com>,
	linux-arm-kernel@lists.infradead.org,
	linux-kernel@vger.kernel.org, Kees Cook <keescook@chromium.org>,
	kernel-hardening@lists.openwall.com
Subject: Re: [PATCH 3/3] arm64: dump: Add checking for writable and exectuable pages
Date: Fri, 30 Sep 2016 16:58:25 +0100	[thread overview]
Message-ID: <20160930155814.GA1729@remoulade> (raw)
In-Reply-To: <20160929213257.30505-4-labbott@redhat.com>

On Thu, Sep 29, 2016 at 02:32:57PM -0700, Laura Abbott wrote:
> @@ -219,6 +223,15 @@ static void note_page(struct pg_state *st, unsigned long addr, unsigned level,
>  		unsigned long delta;
>  
>  		if (st->current_prot) {
> +			if (st->check_wx &&
> +			((st->current_prot & PTE_RDONLY) != PTE_RDONLY) &&
> +			((st->current_prot & PTE_PXN) != PTE_PXN)) {
> +				WARN_ONCE(1, "arm64/mm: Found insecure W+X mapping at address %p/%pS\n",
> +					 (void *)st->start_address,
> +					 (void *)st->start_address);
> +				st->wx_pages += (addr - st->start_address) / PAGE_SIZE;
> +			}
> +

Would it be worth verifying that all kernel mappings are UXN, too?

ARMv8 allows execute-only mappings, and a !UXN mapping could result in an info
leak (e.g. pointers in MOVZ+MOVK sequences), or potential asynchronous issues
(e.g. user instruction fetches accessing read-destructive device registers).
All kernel mappings *should* be UXN.

Thanks,
Mark.

next prev parent reply	other threads:[~2016-09-30 15:58 UTC|newest]

Thread overview: 47+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-09-29 21:32 [kernel-hardening] [PATCH 0/3] WX Checking for arm64 Laura Abbott
2016-09-29 21:32 ` Laura Abbott
2016-09-29 21:32 ` Laura Abbott
2016-09-29 21:32 ` [kernel-hardening] [PATCH 1/3] arm64: dump: Make ptdump debugfs a separate option Laura Abbott
2016-09-29 21:32   ` Laura Abbott
2016-09-29 21:32   ` Laura Abbott
2016-09-30  0:13   ` [kernel-hardening] " Mark Rutland
2016-09-30  0:13     ` Mark Rutland
2016-09-30  0:13     ` Mark Rutland
2016-09-30  0:31     ` [kernel-hardening] " Laura Abbott
2016-09-30  0:31       ` Laura Abbott
2016-09-30  0:31       ` Laura Abbott
2016-09-30  0:48       ` [kernel-hardening] " Mark Rutland
2016-09-30  0:48         ` Mark Rutland
2016-09-30  0:48         ` Mark Rutland
2016-09-30  1:11         ` [kernel-hardening] " Laura Abbott
2016-09-30  1:11           ` Laura Abbott
2016-09-30  1:11           ` Laura Abbott
2016-09-30  1:27           ` [kernel-hardening] " Mark Rutland
2016-09-30  1:27             ` Mark Rutland
2016-09-30  1:27             ` Mark Rutland
2016-09-29 21:32 ` [kernel-hardening] [PATCH 2/3] arm64: dump: Make the page table dumping seq_file optional Laura Abbott
2016-09-29 21:32   ` Laura Abbott
2016-09-29 21:32   ` Laura Abbott
2016-09-30  0:36   ` [kernel-hardening] " Mark Rutland
2016-09-30  0:36     ` Mark Rutland
2016-09-30  0:36     ` Mark Rutland
2016-09-29 21:32 ` [kernel-hardening] [PATCH 3/3] arm64: dump: Add checking for writable and exectuable pages Laura Abbott
2016-09-29 21:32   ` Laura Abbott
2016-09-29 21:32   ` Laura Abbott
2016-09-30  2:08   ` [kernel-hardening] " Mark Rutland
2016-09-30  2:08     ` Mark Rutland
2016-09-30  2:08     ` Mark Rutland
2016-09-30 15:58   ` Mark Rutland [this message]
2016-09-30 15:58     ` Mark Rutland
2016-09-30 15:58     ` Mark Rutland
2016-09-30 16:25     ` [kernel-hardening] " Kees Cook
2016-09-30 16:25       ` Kees Cook
2016-09-30 16:25       ` Kees Cook
2016-09-30 16:41       ` [kernel-hardening] " Mark Rutland
2016-09-30 16:41         ` Mark Rutland
2016-09-30 16:41         ` Mark Rutland
2016-09-30 17:16         ` [kernel-hardening] " Kees Cook
2016-09-30 17:16           ` Kees Cook
2016-09-30 17:16           ` Kees Cook
2016-09-30  1:29 ` [kernel-hardening] [PATCH 0/3] WX Checking for arm64 Kees Cook
2016-09-30  1:29   ` Kees Cook

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20160930155814.GA1729@remoulade \
    --to=mark.rutland@arm.com \
    --cc=ard.biesheuvel@linaro.org \
    --cc=catalin.marinas@arm.com \
    --cc=david.brown@linaro.org \
    --cc=keescook@chromium.org \
    --cc=kernel-hardening@lists.openwall.com \
    --cc=labbott@redhat.com \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=takahiro.akashi@linaro.org \
    --cc=will.deacon@arm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Be sure your reply has a Subject: header at the top and a blank line before the message body.

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.