From: Rusty Russell <rusty@rustcorp.com.au>
To: Jessica Yu <jeyu@redhat.com>,
AKASHI Takahiro <takahiro.akashi@linaro.org>
Cc: mark.rutland@arm.com, keescook@chromium.org,
kernel-hardening@lists.openwall.com,
linux-kernel@vger.kernel.org
Subject: [kernel-hardening] Re: module: extend 'rodata=off' boot cmdline parameter to module mappings
Date: Mon, 28 Nov 2016 10:30:53 +1030 [thread overview]
Message-ID: <8760n88ocq.fsf@rustcorp.com.au> (raw)
In-Reply-To: <20161125054822.GA2793@packer-debian-8-amd64.digitalocean.com>
Jessica Yu <jeyu@redhat.com> writes:
> +++ AKASHI Takahiro [14/11/16 15:15 +0900]:
>>The current "rodata=off" parameter disables read-only kernel mappings
>>under CONFIG_DEBUG_RODATA:
>> commit d2aa1acad22f ("mm/init: Add 'rodata=off' boot cmdline parameter
>> to disable read-only kernel mappings")
>>
>>This patch is a logical extension to module mappings ie. read-only mappings
>>at module loading can be disabled even if CONFIG_DEBUG_SET_MODULE_RONX
>>(mainly for debug use). Please note, however, that it only affects RO/RW
>>permissions, keeping NX set.
>>
>>This is the first step to make CONFIG_DEBUG_SET_MODULE_RONX mandatory
>>(always-on) in the future as CONFIG_DEBUG_RODATA on x86 and arm64.
>>
>>Suggested-by: and Acked-by: Mark Rutland <mark.rutland@arm.com>
>>Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
>>Reviewed-by: Kees Cook <keescook@chromium.org>
>>Cc: Rusty Russell <rusty@rustcorp.com.au>
>
> Hi Rusty, could I get an (n)ack for this patch? :-)
Acked-by: Rusty Russell <rusty@rustcorp.com.au>
Cheers,
Rusty.
WARNING: multiple messages have this Message-ID (diff)
From: Rusty Russell <rusty@rustcorp.com.au>
To: Jessica Yu <jeyu@redhat.com>,
AKASHI Takahiro <takahiro.akashi@linaro.org>
Cc: mark.rutland@arm.com, keescook@chromium.org,
kernel-hardening@lists.openwall.com,
linux-kernel@vger.kernel.org
Subject: Re: module: extend 'rodata=off' boot cmdline parameter to module mappings
Date: Mon, 28 Nov 2016 10:30:53 +1030 [thread overview]
Message-ID: <8760n88ocq.fsf@rustcorp.com.au> (raw)
In-Reply-To: <20161125054822.GA2793@packer-debian-8-amd64.digitalocean.com>
Jessica Yu <jeyu@redhat.com> writes:
> +++ AKASHI Takahiro [14/11/16 15:15 +0900]:
>>The current "rodata=off" parameter disables read-only kernel mappings
>>under CONFIG_DEBUG_RODATA:
>> commit d2aa1acad22f ("mm/init: Add 'rodata=off' boot cmdline parameter
>> to disable read-only kernel mappings")
>>
>>This patch is a logical extension to module mappings ie. read-only mappings
>>at module loading can be disabled even if CONFIG_DEBUG_SET_MODULE_RONX
>>(mainly for debug use). Please note, however, that it only affects RO/RW
>>permissions, keeping NX set.
>>
>>This is the first step to make CONFIG_DEBUG_SET_MODULE_RONX mandatory
>>(always-on) in the future as CONFIG_DEBUG_RODATA on x86 and arm64.
>>
>>Suggested-by: and Acked-by: Mark Rutland <mark.rutland@arm.com>
>>Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
>>Reviewed-by: Kees Cook <keescook@chromium.org>
>>Cc: Rusty Russell <rusty@rustcorp.com.au>
>
> Hi Rusty, could I get an (n)ack for this patch? :-)
Acked-by: Rusty Russell <rusty@rustcorp.com.au>
Cheers,
Rusty.
next prev parent reply other threads:[~2016-11-28 0:00 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-14 6:15 [kernel-hardening] [PATCH v3] module: extend 'rodata=off' boot cmdline parameter to module mappings AKASHI Takahiro
2016-11-14 6:15 ` AKASHI Takahiro
2016-11-25 5:48 ` [kernel-hardening] " Jessica Yu
2016-11-25 5:48 ` Jessica Yu
2016-11-28 0:00 ` Rusty Russell [this message]
2016-11-28 0:00 ` Rusty Russell
-- strict thread matches above, loose matches on Subject: below --
2016-11-28 7:59 [PATCH v3] " Andreas Ziegler
2016-11-28 9:18 ` [kernel-hardening] " AKASHI Takahiro
2016-11-28 19:50 ` [kernel-hardening] " Jessica Yu
2016-10-21 1:13 [kernel-hardening] [PATCH v2] " AKASHI Takahiro
2016-11-13 3:04 ` [kernel-hardening] " Jessica Yu
2016-11-14 6:12 ` AKASHI Takahiro
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8760n88ocq.fsf@rustcorp.com.au \
--to=rusty@rustcorp.com.au \
--cc=jeyu@redhat.com \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=takahiro.akashi@linaro.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.