Re: [kernel-hardening] Merge in PAX_MEMORY_SANITIZE work from grsec to linux-next

Kaiwan N Billimoria
2017-02-14T03:01:08Z

[-- Attachment #1: Type: text/plain, Size: 2386 bytes --]

​Thanks for your response...​

>
>
> +config MEMORY_SANITIZE
> > + bool "Enable memory sanitization features"
> > + select SLUB_DEBUG
> > + select PAGE_POISONING
> > + select PAGE_POISONING_NO_SANITY if HIBERNATION
> > + ---help---
> > + This option enables ...
>
> Good start! Why the "if HIBERNATION" bit? It seems like sanity checks
> are very expensive, so we'd not want it as part of this config?
>
> ​Okay, I wasn't sure. So would it be (more) correct to retain the first
two configs plus
​PAGE_POISONING_NO_SANITY (without the if)?

>
> > +#ifdef CONFIG_MEMORY_SANITIZE
> > +static int __init memory_sanitize_init(void)
> > +{
> > + /* With 'memory sanitize' On, page poisoning Must be turned on */
> > + if (IS_ENABLED(CONFIG_MEMORY_SANITIZE)) {
> > + want_page_poisoning = true;
> > + __page_poisoning_enabled = true;
> > + }
> > + return 0;
> > +}
> > +early_initcall(memory_sanitize_init);
> > +#endif
>
> The ifdef and the IS_ENABLED seem redundant to me. I'd drop the ifdef.
>
> ​Agree on the redundancy, will do.

> > #if defined(CONFIG_SLUB_DEBUG_ON)
> > +#if defined(CONFIG_MEMORY_SANITIZE)
> > +/* With 'memory sanitize' On, slub_debug should be 'P' */
> > +static int slub_debug = SLAB_POISON;
> > +#else
> > static int slub_debug = DEBUG_DEFAULT_FLAGS;
> > +#endif /* CONFIG_MEMORY_SANITIZE */
> > #else
> > static int slub_debug;
> > -#endif
> > +#endif /* CONFIG_SLUB_DEBUG_ON */
>
> Could the definition of DEBUG_DEFAULT_FLAGS be adjusted instead of
> doing the ifdefs here in the .c file? Or, perhaps do a slub_debug |=
> SLAB_POISON in memory_sanitize_init()?
>
> Yes, the latter sounds good but the init function is in mm/page_poison.c
and the slub_debug var is a static in mm/slub.c . Any suggestions?
​

>
> > +#ifdef CONFIG_MEMORY_SANITIZE
> > + pr_info("[CONFIG_MEMORY_SANITIZE]: slub_debug = P? %s [0x%x]\n",
> > + slub_debug & SLAB_POISON ? "yes" : "no", slub_debug);
> > +#endif
> > +
> > mutex_lock(&slab_mutex);
> >
> > slab_kset = kset_create_and_add("slab", &slab_uevent_ops,
> kernel_kobj);
>
> Good first step to getting the CONFIG to do something meaningful, thanks!
>
> -Kees
>
> ​Thanks, happy to help!
- Kaiwan.​

> --
> Kees Cook
> Pixel Security
>
>

[-- Attachment #2: Type: text/html, Size: 4655 bytes --]