From mboxrd@z Thu Jan 1 00:00:00 1970 From: Thomas Garnier Subject: [RFC v3 24/27] x86/mm: Make the x86 GOT read-only Date: Wed, 4 Oct 2017 14:20:00 -0700 Message-ID: <20171004212003.28296-25-thgarnie@google.com> References: <20171004212003.28296-1-thgarnie@google.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: In-Reply-To: <20171004212003.28296-1-thgarnie@google.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" To: Herbert Xu , "David S . Miller" , Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , Peter Zijlstra , Josh Poimboeuf , Thomas Garnier , Arnd Bergmann , Kees Cook , Matthias Kaehlcke , Tom Lendacky , Andy Lutomirski , "Kirill A . Shutemov" , Borislav Petkov , "Rafael J . Wysocki" , Len Brown , Pavel Machek , Juergen Gross , Chris Wright , Alok Kataria , Rusty Russell , Tejun Heo , Christoph Lameter Bor Cc: linux-arch@vger.kernel.org, kvm@vger.kernel.org, linux-pm@vger.kernel.org, x86@kernel.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, virtualization@lists.linux-foundation.org, linux-sparse@vger.kernel.org, linux-crypto@vger.kernel.org, kernel-hardening@lists.openwall.com, xen-devel@lists.xenproject.org List-Id: linux-pm@vger.kernel.org VGhlIEdPVCBpcyBjaGFuZ2VkIGR1cmluZyBlYXJseSBib290IHdoZW4gcmVsb2NhdGlvbnMgYXJl IGFwcGxpZWQuIE1ha2UKaXQgcmVhZC1vbmx5IGRpcmVjdGx5LiBUaGlzIHRhYmxlIGV4aXN0cyBv bmx5IGZvciBQSUUgYmluYXJ5LgoKUG9zaXRpb24gSW5kZXBlbmRlbnQgRXhlY3V0YWJsZSAoUElF KSBzdXBwb3J0IHdpbGwgYWxsb3cgdG8gZXh0ZW5kZWQgdGhlCktBU0xSIHJhbmRvbWl6YXRpb24g cmFuZ2UgYmVsb3cgdGhlIC0yRyBtZW1vcnkgbGltaXQuCgpTaWduZWQtb2ZmLWJ5OiBUaG9tYXMg R2FybmllciA8dGhnYXJuaWVAZ29vZ2xlLmNvbT4KLS0tCiBpbmNsdWRlL2FzbS1nZW5lcmljL3Zt bGludXgubGRzLmggfCAxMiArKysrKysrKysrKysKIDEgZmlsZSBjaGFuZ2VkLCAxMiBpbnNlcnRp b25zKCspCgpkaWZmIC0tZ2l0IGEvaW5jbHVkZS9hc20tZ2VuZXJpYy92bWxpbnV4Lmxkcy5oIGIv aW5jbHVkZS9hc20tZ2VuZXJpYy92bWxpbnV4Lmxkcy5oCmluZGV4IGU1NDliZmY4N2M1Yi4uYTIz MDFjMjkyZTI2IDEwMDY0NAotLS0gYS9pbmNsdWRlL2FzbS1nZW5lcmljL3ZtbGludXgubGRzLmgK KysrIGIvaW5jbHVkZS9hc20tZ2VuZXJpYy92bWxpbnV4Lmxkcy5oCkBAIC0yNzksNiArMjc5LDE3 IEBACiAJVk1MSU5VWF9TWU1CT0woX19lbmRfcm9fYWZ0ZXJfaW5pdCkgPSAuOwogI2VuZGlmCiAK KyNpZmRlZiBDT05GSUdfWDg2X1BJRQorI2RlZmluZSBST19HT1RfWDg2CQkJCQkJCVwKKwkuZ290 ICAgICAgICA6IEFUKEFERFIoLmdvdCkgLSBMT0FEX09GRlNFVCkgewkJCVwKKwkJVk1MSU5VWF9T WU1CT0woX19zdGFydF9nb3QpID0gLjsJCQlcCisJCSooLmdvdCk7CQkJCQkJXAorCQlWTUxJTlVY X1NZTUJPTChfX2VuZF9nb3QpID0gLjsJCQkJXAorCX0KKyNlbHNlCisjZGVmaW5lIFJPX0dPVF9Y ODYKKyNlbmRpZgorCiAvKgogICogUmVhZCBvbmx5IERhdGEKICAqLwpAQCAtMzM1LDYgKzM0Niw3 IEBACiAJCVZNTElOVVhfU1lNQk9MKF9fZW5kX2J1aWx0aW5fZncpID0gLjsJCQlcCiAJfQkJCQkJ CQkJXAogCQkJCQkJCQkJXAorCVJPX0dPVF9YODYJCQkJCQkJXAogCVRSQUNFREFUQQkJCQkJCQlc CiAJCQkJCQkJCQlcCiAJLyogS2VybmVsIHN5bWJvbCB0YWJsZTogTm9ybWFsIHN5bWJvbHMgKi8J CQlcCi0tIAoyLjE0LjIuOTIwLmdjZjBjNjc5NzljLWdvb2cKCgpfX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fXwpYZW4tZGV2ZWwgbWFpbGluZyBsaXN0Clhlbi1k ZXZlbEBsaXN0cy54ZW4ub3JnCmh0dHBzOi8vbGlzdHMueGVuLm9yZy94ZW4tZGV2ZWwK From mboxrd@z Thu Jan 1 00:00:00 1970 From: Thomas Garnier Subject: [RFC v3 24/27] x86/mm: Make the x86 GOT read-only Date: Wed, 4 Oct 2017 14:20:00 -0700 Message-ID: <20171004212003.28296-25-thgarnie@google.com> References: <20171004212003.28296-1-thgarnie@google.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Cc: linux-arch@vger.kernel.org, kvm@vger.kernel.org, linux-pm@vger.kernel.org, x86@kernel.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, virtualization@lists.linux-foundation.org, linux-sparse@vger.kernel.org, linux-crypto@vger.kernel.org, kernel-hardening@lists.openwall.com, xen-devel@lists.xenproject.org To: Herbert Xu , "David S . Miller" , Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , Peter Zijlstra , Josh Poimboeuf , Thomas Garnier , Arnd Bergmann , Kees Cook , Matthias Kaehlcke , Tom Lendacky , Andy Lutomirski , "Kirill A . Shutemov" , Borislav Petkov , "Rafael J . Wysocki" , Len Brown , Pavel Machek , Juergen Gross , Chris Wright , Alok Kataria , Rusty Russell , Tejun Heo , Christoph Lameter , Bor Return-path: In-Reply-To: <20171004212003.28296-1-thgarnie@google.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" List-Id: linux-crypto.vger.kernel.org VGhlIEdPVCBpcyBjaGFuZ2VkIGR1cmluZyBlYXJseSBib290IHdoZW4gcmVsb2NhdGlvbnMgYXJl IGFwcGxpZWQuIE1ha2UKaXQgcmVhZC1vbmx5IGRpcmVjdGx5LiBUaGlzIHRhYmxlIGV4aXN0cyBv bmx5IGZvciBQSUUgYmluYXJ5LgoKUG9zaXRpb24gSW5kZXBlbmRlbnQgRXhlY3V0YWJsZSAoUElF KSBzdXBwb3J0IHdpbGwgYWxsb3cgdG8gZXh0ZW5kZWQgdGhlCktBU0xSIHJhbmRvbWl6YXRpb24g cmFuZ2UgYmVsb3cgdGhlIC0yRyBtZW1vcnkgbGltaXQuCgpTaWduZWQtb2ZmLWJ5OiBUaG9tYXMg R2FybmllciA8dGhnYXJuaWVAZ29vZ2xlLmNvbT4KLS0tCiBpbmNsdWRlL2FzbS1nZW5lcmljL3Zt bGludXgubGRzLmggfCAxMiArKysrKysrKysrKysKIDEgZmlsZSBjaGFuZ2VkLCAxMiBpbnNlcnRp b25zKCspCgpkaWZmIC0tZ2l0IGEvaW5jbHVkZS9hc20tZ2VuZXJpYy92bWxpbnV4Lmxkcy5oIGIv aW5jbHVkZS9hc20tZ2VuZXJpYy92bWxpbnV4Lmxkcy5oCmluZGV4IGU1NDliZmY4N2M1Yi4uYTIz MDFjMjkyZTI2IDEwMDY0NAotLS0gYS9pbmNsdWRlL2FzbS1nZW5lcmljL3ZtbGludXgubGRzLmgK KysrIGIvaW5jbHVkZS9hc20tZ2VuZXJpYy92bWxpbnV4Lmxkcy5oCkBAIC0yNzksNiArMjc5LDE3 IEBACiAJVk1MSU5VWF9TWU1CT0woX19lbmRfcm9fYWZ0ZXJfaW5pdCkgPSAuOwogI2VuZGlmCiAK KyNpZmRlZiBDT05GSUdfWDg2X1BJRQorI2RlZmluZSBST19HT1RfWDg2CQkJCQkJCVwKKwkuZ290 ICAgICAgICA6IEFUKEFERFIoLmdvdCkgLSBMT0FEX09GRlNFVCkgewkJCVwKKwkJVk1MSU5VWF9T WU1CT0woX19zdGFydF9nb3QpID0gLjsJCQlcCisJCSooLmdvdCk7CQkJCQkJXAorCQlWTUxJTlVY X1NZTUJPTChfX2VuZF9nb3QpID0gLjsJCQkJXAorCX0KKyNlbHNlCisjZGVmaW5lIFJPX0dPVF9Y ODYKKyNlbmRpZgorCiAvKgogICogUmVhZCBvbmx5IERhdGEKICAqLwpAQCAtMzM1LDYgKzM0Niw3 IEBACiAJCVZNTElOVVhfU1lNQk9MKF9fZW5kX2J1aWx0aW5fZncpID0gLjsJCQlcCiAJfQkJCQkJ CQkJXAogCQkJCQkJCQkJXAorCVJPX0dPVF9YODYJCQkJCQkJXAogCVRSQUNFREFUQQkJCQkJCQlc CiAJCQkJCQkJCQlcCiAJLyogS2VybmVsIHN5bWJvbCB0YWJsZTogTm9ybWFsIHN5bWJvbHMgKi8J CQlcCi0tIAoyLjE0LjIuOTIwLmdjZjBjNjc5NzljLWdvb2cKCgpfX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fXwpYZW4tZGV2ZWwgbWFpbGluZyBsaXN0Clhlbi1k ZXZlbEBsaXN0cy54ZW4ub3JnCmh0dHBzOi8vbGlzdHMueGVuLm9yZy94ZW4tZGV2ZWwK From mboxrd@z Thu Jan 1 00:00:00 1970 From: Thomas Garnier Date: Wed, 4 Oct 2017 14:20:00 -0700 Message-Id: <20171004212003.28296-25-thgarnie@google.com> In-Reply-To: <20171004212003.28296-1-thgarnie@google.com> References: <20171004212003.28296-1-thgarnie@google.com> Subject: [kernel-hardening] [RFC v3 24/27] x86/mm: Make the x86 GOT read-only To: Herbert Xu , "David S . Miller" , Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , Peter Zijlstra , Josh Poimboeuf , Thomas Garnier , Arnd Bergmann , Kees Cook , Matthias Kaehlcke , Tom Lendacky , Andy Lutomirski , "Kirill A . Shutemov" , Borislav Petkov , "Rafael J . Wysocki" , Len Brown , Pavel Machek , Juergen Gross , Chris Wright , Alok Kataria , Rusty Russell , Tejun Heo , Christoph Lameter , Boris Ostrovsky , Alexey Dobriyan , Andrew Morton , Paul Gortmaker , Chris Metcalf , "Paul E . McKenney" , Nicolas Pitre , Borislav Petkov , "Luis R . Rodriguez" , Greg Kroah-Hartman , Christopher Li , Steven Rostedt , Jason Baron , Dou Liyang , "Rafael J . Wysocki" , Mika Westerberg , Lukas Wunner , Masahiro Yamada , Alexei Starovoitov , Daniel Borkmann , Markus Trippelsdorf , Paolo Bonzini , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= , Joerg Roedel , Rik van Riel , David Howells , Ard Biesheuvel , Waiman Long , Kyle Huey , Andrey Ryabinin , Jonathan Corbet , Matthew Wilcox , Michal Hocko , Peter Foley , Paul Bolle , Jiri Kosina , Rob Landley , "H . J . Lu" , Baoquan He , =?UTF-8?q?Jan=20H=20=2E=20Sch=C3=B6nherr?= , Daniel Micay Cc: x86@kernel.org, linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, linux-pm@vger.kernel.org, virtualization@lists.linux-foundation.org, xen-devel@lists.xenproject.org, linux-arch@vger.kernel.org, linux-sparse@vger.kernel.org, kvm@vger.kernel.org, linux-doc@vger.kernel.org, kernel-hardening@lists.openwall.com List-ID: The GOT is changed during early boot when relocations are applied. Make it read-only directly. This table exists only for PIE binary. Position Independent Executable (PIE) support will allow to extended the KASLR randomization range below the -2G memory limit. Signed-off-by: Thomas Garnier --- include/asm-generic/vmlinux.lds.h | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h index e549bff87c5b..a2301c292e26 100644 --- a/include/asm-generic/vmlinux.lds.h +++ b/include/asm-generic/vmlinux.lds.h @@ -279,6 +279,17 @@ VMLINUX_SYMBOL(__end_ro_after_init) = .; #endif +#ifdef CONFIG_X86_PIE +#define RO_GOT_X86 \ + .got : AT(ADDR(.got) - LOAD_OFFSET) { \ + VMLINUX_SYMBOL(__start_got) = .; \ + *(.got); \ + VMLINUX_SYMBOL(__end_got) = .; \ + } +#else +#define RO_GOT_X86 +#endif + /* * Read only Data */ @@ -335,6 +346,7 @@ VMLINUX_SYMBOL(__end_builtin_fw) = .; \ } \ \ + RO_GOT_X86 \ TRACEDATA \ \ /* Kernel symbol table: Normal symbols */ \ -- 2.14.2.920.gcf0c67979c-goog