From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mark Rutland Subject: Re: [PATCH] arm64: make CONFIG_DEBUG_RODATA non-optional Date: Thu, 28 Jan 2016 14:59:01 +0000 Message-ID: <20160128145900.GN17123@leverpostej> References: <1453226922-16831-1-git-send-email-keescook@chromium.org> <1453226922-16831-4-git-send-email-keescook@chromium.org> <20160127211105.GA41450@davidb.org> <20160128000906.GA42530@davidb.org> <20160128110622.GF17123@leverpostej> Reply-To: kernel-hardening@lists.openwall.com Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: List-Post: List-Help: List-Unsubscribe: List-Subscribe: Content-Disposition: inline In-Reply-To: To: Kees Cook Cc: David Brown , "kernel-hardening@lists.openwall.com" , Ingo Molnar , Andy Lutomirski , "H. Peter Anvin" , Michael Ellerman , Mathias Krause , Thomas Gleixner , "x86@kernel.org" , Arnd Bergmann , PaX Team , Emese Revfy , LKML , linux-arch , Catalin Marinas , Will Deacon , Marc Zyngier , yalin wang , Zi Shen Lim , Yang Shi , Ard Biesheuvel , Laura Abbott , "Suzuki K. Poulose" List-Id: linux-arch.vger.kernel.org On Thu, Jan 28, 2016 at 06:06:53AM -0800, Kees Cook wrote: > On Thu, Jan 28, 2016 at 3:06 AM, Mark Rutland wrote: > > One thing I would like to do is to avoid the need for fixup_executable > > entirely, by mapping the kernel text RO from the outset. However, that > > requires rework of the alternatives patching (to use a temporary RW > > alias), and I haven't had the time to look into that yet. > > This makes perfect sense for the rodata section, but the (future) > postinit_rodata section we'll still want to mark RO after init > finishes. x86 and ARM cheat by marking both RO after init, and they > don't have to pad sections. parisc will need to solve this too. Depending on how many postinit_rodata variables there are, we might be able to drop those in .rodata, have them RO always, and initialise them via a temporary RW alias (e.g. something in the vmalloc area). The only requirement for that is that we use a helper to initialise any __postinit_ro variables via a temporary RW alias, e.g. #define SET_POST_INIT_RO(ptr, v) ({ \\ typeof(ptr) __ptr_rw = (ptr) \\ BUG_ON(initcalls_done); \\ __ptr_rw = create_rw_alias(__ptr); \\ __ptr_rw = v; \\ destroy_rw_alias(__ptr_rw); \\ }) ... __postinit_ro void *thing; void __init some_init_func(void) { void *__thing = some_ranodomized_allocator(); SET_POSTINIT_RO(thing, thing); } Mark. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from foss.arm.com ([217.140.101.70]:60865 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965438AbcA1O7a (ORCPT ); Thu, 28 Jan 2016 09:59:30 -0500 Date: Thu, 28 Jan 2016 14:59:01 +0000 From: Mark Rutland Subject: Re: [PATCH] arm64: make CONFIG_DEBUG_RODATA non-optional Message-ID: <20160128145900.GN17123@leverpostej> References: <1453226922-16831-1-git-send-email-keescook@chromium.org> <1453226922-16831-4-git-send-email-keescook@chromium.org> <20160127211105.GA41450@davidb.org> <20160128000906.GA42530@davidb.org> <20160128110622.GF17123@leverpostej> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Sender: linux-arch-owner@vger.kernel.org List-ID: To: Kees Cook Cc: David Brown , "kernel-hardening@lists.openwall.com" , Ingo Molnar , Andy Lutomirski , "H. Peter Anvin" , Michael Ellerman , Mathias Krause , Thomas Gleixner , "x86@kernel.org" , Arnd Bergmann , PaX Team , Emese Revfy , LKML , linux-arch , Catalin Marinas , Will Deacon , Marc Zyngier , yalin wang , Zi Shen Lim , Yang Shi , Ard Biesheuvel , Laura Abbott , "Suzuki K. Poulose" , Steve Capper , Jeremy Linton , Mark Salter , "linux-arm-kernel@lists.infradead.org" Message-ID: <20160128145901.voDgfyAEgcavVY4ufH3cugGevB-3F4bW723edSfWwuw@z> On Thu, Jan 28, 2016 at 06:06:53AM -0800, Kees Cook wrote: > On Thu, Jan 28, 2016 at 3:06 AM, Mark Rutland wrote: > > One thing I would like to do is to avoid the need for fixup_executable > > entirely, by mapping the kernel text RO from the outset. However, that > > requires rework of the alternatives patching (to use a temporary RW > > alias), and I haven't had the time to look into that yet. > > This makes perfect sense for the rodata section, but the (future) > postinit_rodata section we'll still want to mark RO after init > finishes. x86 and ARM cheat by marking both RO after init, and they > don't have to pad sections. parisc will need to solve this too. Depending on how many postinit_rodata variables there are, we might be able to drop those in .rodata, have them RO always, and initialise them via a temporary RW alias (e.g. something in the vmalloc area). The only requirement for that is that we use a helper to initialise any __postinit_ro variables via a temporary RW alias, e.g. #define SET_POST_INIT_RO(ptr, v) ({ \\ typeof(ptr) __ptr_rw = (ptr) \\ BUG_ON(initcalls_done); \\ __ptr_rw = create_rw_alias(__ptr); \\ __ptr_rw = v; \\ destroy_rw_alias(__ptr_rw); \\ }) ... __postinit_ro void *thing; void __init some_init_func(void) { void *__thing = some_ranodomized_allocator(); SET_POSTINIT_RO(thing, thing); } Mark.