* [PATCH] hardening: Refresh KCFI options, add some more
@ 2024-04-26 22:29 Kees Cook
2024-04-29 22:16 ` Nathan Chancellor
2024-04-30 9:21 ` Peter Zijlstra
0 siblings, 2 replies; 10+ messages in thread
From: Kees Cook @ 2024-04-26 22:29 UTC (permalink / raw)
To: Gustavo A. R. Silva
Cc: Kees Cook, Catalin Marinas, Will Deacon, Thomas Gleixner,
Ingo Molnar, Borislav Petkov, Dave Hansen, x86, H. Peter Anvin,
Nathan Chancellor, Nick Desaulniers, Bill Wendling, Justin Stitt,
linux-hardening, linux-arm-kernel, llvm, linux-kernel
Add some stuff that got missed along the way:
- CONFIG_UNWIND_PATCH_PAC_INTO_SCS=y so SCS vs PAC is hardware
selectable.
- CONFIG_X86_KERNEL_IBT=y while a default, just be sure.
- CONFIG_CFI_CLANG=y for x86 and arm64. (And disable FINEIBT since
it isn't as secure as straight KCFI.)
- CONFIG_PAGE_TABLE_CHECK=y for userspace mapping sanity.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: x86@kernel.org
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Bill Wendling <morbo@google.com>
Cc: Justin Stitt <justinstitt@google.com>
Cc: linux-hardening@vger.kernel.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: llvm@lists.linux.dev
---
arch/arm64/configs/hardening.config | 5 +++++
arch/x86/configs/hardening.config | 9 +++++++++
kernel/configs/hardening.config | 4 ++++
3 files changed, 18 insertions(+)
diff --git a/arch/arm64/configs/hardening.config b/arch/arm64/configs/hardening.config
index b0e795208998..e8a18fec7a3e 100644
--- a/arch/arm64/configs/hardening.config
+++ b/arch/arm64/configs/hardening.config
@@ -5,6 +5,7 @@ CONFIG_ARM64_SW_TTBR0_PAN=y
# Software Shadow Stack or PAC
CONFIG_SHADOW_CALL_STACK=y
+CONFIG_UNWIND_PATCH_PAC_INTO_SCS=y
# Pointer authentication (ARMv8.3 and later). If hardware actually supports
# it, one can turn off CONFIG_STACKPROTECTOR_STRONG with this enabled.
@@ -20,3 +21,7 @@ CONFIG_ARM64_E0PD=y
# Available in ARMv8.7 and later.
CONFIG_ARM64_EPAN=y
+
+# Enable Kernel Control Flow Integrity (currently Clang only).
+CONFIG_CFI_CLANG=y
+# CONFIG_CFI_PERMISSIVE is not set
diff --git a/arch/x86/configs/hardening.config b/arch/x86/configs/hardening.config
index 7b497f3b7bc3..b47e5f411dd3 100644
--- a/arch/x86/configs/hardening.config
+++ b/arch/x86/configs/hardening.config
@@ -10,5 +10,14 @@ CONFIG_INTEL_IOMMU_DEFAULT_ON=y
CONFIG_INTEL_IOMMU_SVM=y
CONFIG_AMD_IOMMU=y
+# Enforce CET Indirect Branch Tracking in the kernel.
+CONFIG_X86_KERNEL_IBT=y
+
+# Enable Kernel Control Flow Integrity (currently Clang only), but disable
+# weaker FINEIBT landing pads.
+CONFIG_CFI_CLANG=y
+# CONFIG_CFI_PERMISSIVE is not set
+# CONFIG_FINEIBT is not set
+
# Enable CET Shadow Stack for userspace.
CONFIG_X86_USER_SHADOW_STACK=y
diff --git a/kernel/configs/hardening.config b/kernel/configs/hardening.config
index 7a5bbfc024b7..4be0de1f085c 100644
--- a/kernel/configs/hardening.config
+++ b/kernel/configs/hardening.config
@@ -23,6 +23,10 @@ CONFIG_SLAB_FREELIST_HARDENED=y
CONFIG_SHUFFLE_PAGE_ALLOCATOR=y
CONFIG_RANDOM_KMALLOC_CACHES=y
+# Sanity check userspace page table mappings.
+CONFIG_PAGE_TABLE_CHECK=y
+CONFIG_PAGE_TABLE_CHECK_ENFORCED=y
+
# Randomize kernel stack offset on syscall entry.
CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT=y
--
2.34.1
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [PATCH] hardening: Refresh KCFI options, add some more
2024-04-26 22:29 [PATCH] hardening: Refresh KCFI options, add some more Kees Cook
@ 2024-04-29 22:16 ` Nathan Chancellor
2024-04-30 5:35 ` Kees Cook
2024-04-30 9:21 ` Peter Zijlstra
1 sibling, 1 reply; 10+ messages in thread
From: Nathan Chancellor @ 2024-04-29 22:16 UTC (permalink / raw)
To: Kees Cook
Cc: Gustavo A. R. Silva, Catalin Marinas, Will Deacon,
Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen, x86,
H. Peter Anvin, Nick Desaulniers, Bill Wendling, Justin Stitt,
linux-hardening, linux-arm-kernel, llvm, linux-kernel
On Fri, Apr 26, 2024 at 03:29:44PM -0700, Kees Cook wrote:
> Add some stuff that got missed along the way:
>
> - CONFIG_UNWIND_PATCH_PAC_INTO_SCS=y so SCS vs PAC is hardware
> selectable.
>
> - CONFIG_X86_KERNEL_IBT=y while a default, just be sure.
>
> - CONFIG_CFI_CLANG=y for x86 and arm64. (And disable FINEIBT since
> it isn't as secure as straight KCFI.)
>
> - CONFIG_PAGE_TABLE_CHECK=y for userspace mapping sanity.
>
> Signed-off-by: Kees Cook <keescook@chromium.org>
Seems reasonable to me.
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
One comment below.
> ---
> Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: Will Deacon <will@kernel.org>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: Borislav Petkov <bp@alien8.de>
> Cc: Dave Hansen <dave.hansen@linux.intel.com>
> Cc: x86@kernel.org
> Cc: "H. Peter Anvin" <hpa@zytor.com>
> Cc: Nathan Chancellor <nathan@kernel.org>
> Cc: Nick Desaulniers <ndesaulniers@google.com>
> Cc: Bill Wendling <morbo@google.com>
> Cc: Justin Stitt <justinstitt@google.com>
> Cc: linux-hardening@vger.kernel.org
> Cc: linux-arm-kernel@lists.infradead.org
> Cc: llvm@lists.linux.dev
> ---
> arch/arm64/configs/hardening.config | 5 +++++
> arch/x86/configs/hardening.config | 9 +++++++++
> kernel/configs/hardening.config | 4 ++++
> 3 files changed, 18 insertions(+)
>
> diff --git a/arch/arm64/configs/hardening.config b/arch/arm64/configs/hardening.config
> index b0e795208998..e8a18fec7a3e 100644
> --- a/arch/arm64/configs/hardening.config
> +++ b/arch/arm64/configs/hardening.config
> @@ -5,6 +5,7 @@ CONFIG_ARM64_SW_TTBR0_PAN=y
>
> # Software Shadow Stack or PAC
> CONFIG_SHADOW_CALL_STACK=y
> +CONFIG_UNWIND_PATCH_PAC_INTO_SCS=y
>
> # Pointer authentication (ARMv8.3 and later). If hardware actually supports
> # it, one can turn off CONFIG_STACKPROTECTOR_STRONG with this enabled.
> @@ -20,3 +21,7 @@ CONFIG_ARM64_E0PD=y
>
> # Available in ARMv8.7 and later.
> CONFIG_ARM64_EPAN=y
> +
> +# Enable Kernel Control Flow Integrity (currently Clang only).
> +CONFIG_CFI_CLANG=y
> +# CONFIG_CFI_PERMISSIVE is not set
Should this be a part of kernel/configs/hardening.config because RISC-V
supports it (and 32-bit ARM will soon too)?
> diff --git a/arch/x86/configs/hardening.config b/arch/x86/configs/hardening.config
> index 7b497f3b7bc3..b47e5f411dd3 100644
> --- a/arch/x86/configs/hardening.config
> +++ b/arch/x86/configs/hardening.config
> @@ -10,5 +10,14 @@ CONFIG_INTEL_IOMMU_DEFAULT_ON=y
> CONFIG_INTEL_IOMMU_SVM=y
> CONFIG_AMD_IOMMU=y
>
> +# Enforce CET Indirect Branch Tracking in the kernel.
> +CONFIG_X86_KERNEL_IBT=y
> +
> +# Enable Kernel Control Flow Integrity (currently Clang only), but disable
> +# weaker FINEIBT landing pads.
> +CONFIG_CFI_CLANG=y
> +# CONFIG_CFI_PERMISSIVE is not set
> +# CONFIG_FINEIBT is not set
> +
> # Enable CET Shadow Stack for userspace.
> CONFIG_X86_USER_SHADOW_STACK=y
> diff --git a/kernel/configs/hardening.config b/kernel/configs/hardening.config
> index 7a5bbfc024b7..4be0de1f085c 100644
> --- a/kernel/configs/hardening.config
> +++ b/kernel/configs/hardening.config
> @@ -23,6 +23,10 @@ CONFIG_SLAB_FREELIST_HARDENED=y
> CONFIG_SHUFFLE_PAGE_ALLOCATOR=y
> CONFIG_RANDOM_KMALLOC_CACHES=y
>
> +# Sanity check userspace page table mappings.
> +CONFIG_PAGE_TABLE_CHECK=y
> +CONFIG_PAGE_TABLE_CHECK_ENFORCED=y
> +
> # Randomize kernel stack offset on syscall entry.
> CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT=y
>
> --
> 2.34.1
>
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] hardening: Refresh KCFI options, add some more
2024-04-29 22:16 ` Nathan Chancellor
@ 2024-04-30 5:35 ` Kees Cook
2024-04-30 15:12 ` Nathan Chancellor
0 siblings, 1 reply; 10+ messages in thread
From: Kees Cook @ 2024-04-30 5:35 UTC (permalink / raw)
To: Nathan Chancellor
Cc: Gustavo A. R. Silva, Catalin Marinas, Will Deacon,
Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen, x86,
H. Peter Anvin, Nick Desaulniers, Bill Wendling, Justin Stitt,
linux-hardening, linux-arm-kernel, llvm, linux-kernel
On Mon, Apr 29, 2024 at 03:16:50PM -0700, Nathan Chancellor wrote:
> On Fri, Apr 26, 2024 at 03:29:44PM -0700, Kees Cook wrote:
> [...]
> > +# Enable Kernel Control Flow Integrity (currently Clang only).
> > +CONFIG_CFI_CLANG=y
> > +# CONFIG_CFI_PERMISSIVE is not set
>
> Should this be a part of kernel/configs/hardening.config because RISC-V
> supports it (and 32-bit ARM will soon too)?
Probably yes. I was worried it might be "noisy" for archs that don't
support it, but frankly if someone is using "make hardening.config" they
probably want to know about unsupported options. :)
--
Kees Cook
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] hardening: Refresh KCFI options, add some more
2024-04-30 5:35 ` Kees Cook
@ 2024-04-30 15:12 ` Nathan Chancellor
0 siblings, 0 replies; 10+ messages in thread
From: Nathan Chancellor @ 2024-04-30 15:12 UTC (permalink / raw)
To: Kees Cook
Cc: Gustavo A. R. Silva, Catalin Marinas, Will Deacon,
Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen, x86,
H. Peter Anvin, Nick Desaulniers, Bill Wendling, Justin Stitt,
linux-hardening, linux-arm-kernel, llvm, linux-kernel
On Mon, Apr 29, 2024 at 10:35:03PM -0700, Kees Cook wrote:
> On Mon, Apr 29, 2024 at 03:16:50PM -0700, Nathan Chancellor wrote:
> > On Fri, Apr 26, 2024 at 03:29:44PM -0700, Kees Cook wrote:
> > [...]
> > > +# Enable Kernel Control Flow Integrity (currently Clang only).
> > > +CONFIG_CFI_CLANG=y
> > > +# CONFIG_CFI_PERMISSIVE is not set
> >
> > Should this be a part of kernel/configs/hardening.config because RISC-V
> > supports it (and 32-bit ARM will soon too)?
>
> Probably yes. I was worried it might be "noisy" for archs that don't
> support it, but frankly if someone is using "make hardening.config" they
> probably want to know about unsupported options. :)
It would be potentially noisy as it is currently written since someone
building with GCC for arm64 or x86_64 could merge hardening.config into
their configuration and they would see CONFIG_CFI_CLANG get enabled by
merge_config.sh but on oldconfig or olddefconfig, it would get flipped
off again because the toolchain dependencies are not met. Might as well
make it architecture agnostic at that point :)
Cheers,
Nathan
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] hardening: Refresh KCFI options, add some more
2024-04-26 22:29 [PATCH] hardening: Refresh KCFI options, add some more Kees Cook
2024-04-29 22:16 ` Nathan Chancellor
@ 2024-04-30 9:21 ` Peter Zijlstra
2024-04-30 17:48 ` Kees Cook
1 sibling, 1 reply; 10+ messages in thread
From: Peter Zijlstra @ 2024-04-30 9:21 UTC (permalink / raw)
To: Kees Cook
Cc: Gustavo A. R. Silva, Catalin Marinas, Will Deacon,
Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen, x86,
H. Peter Anvin, Nathan Chancellor, Nick Desaulniers,
Bill Wendling, Justin Stitt, linux-hardening, linux-arm-kernel,
llvm, linux-kernel
On Fri, Apr 26, 2024 at 03:29:44PM -0700, Kees Cook wrote:
> - CONFIG_CFI_CLANG=y for x86 and arm64. (And disable FINEIBT since
> it isn't as secure as straight KCFI.)
Oi ?
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] hardening: Refresh KCFI options, add some more
2024-04-30 9:21 ` Peter Zijlstra
@ 2024-04-30 17:48 ` Kees Cook
2024-04-30 21:15 ` Kees Cook
2024-05-01 11:06 ` Peter Zijlstra
0 siblings, 2 replies; 10+ messages in thread
From: Kees Cook @ 2024-04-30 17:48 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Gustavo A. R. Silva, Catalin Marinas, Will Deacon,
Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen, x86,
H. Peter Anvin, Nathan Chancellor, Nick Desaulniers,
Bill Wendling, Justin Stitt, linux-hardening, linux-arm-kernel,
llvm, linux-kernel
On Tue, Apr 30, 2024 at 11:21:40AM +0200, Peter Zijlstra wrote:
> On Fri, Apr 26, 2024 at 03:29:44PM -0700, Kees Cook wrote:
>
> > - CONFIG_CFI_CLANG=y for x86 and arm64. (And disable FINEIBT since
> > it isn't as secure as straight KCFI.)
>
> Oi ?
Same objection I always had[1]: moving the check into the destination
means attacks with control over executable memory contents can just omit
the check.
But now that I went to go look I see 0c3e806ec0f9 ("x86/cfi: Add boot
time hash randomization") is only enabled under FINEIBT... seems better
if that were always enabled...
-Kees
[1] https://lore.kernel.org/all/202210181020.79AF7F7@keescook/
--
Kees Cook
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [PATCH] hardening: Refresh KCFI options, add some more
2024-04-30 17:48 ` Kees Cook
@ 2024-04-30 21:15 ` Kees Cook
2024-04-30 21:25 ` Kees Cook
2024-05-01 11:06 ` Peter Zijlstra
1 sibling, 1 reply; 10+ messages in thread
From: Kees Cook @ 2024-04-30 21:15 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Gustavo A. R. Silva, Catalin Marinas, Will Deacon,
Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen, x86,
H. Peter Anvin, Nathan Chancellor, Nick Desaulniers,
Bill Wendling, Justin Stitt, linux-hardening, linux-arm-kernel,
llvm, linux-kernel
On Tue, Apr 30, 2024 at 10:48:36AM -0700, Kees Cook wrote:
> On Tue, Apr 30, 2024 at 11:21:40AM +0200, Peter Zijlstra wrote:
> > On Fri, Apr 26, 2024 at 03:29:44PM -0700, Kees Cook wrote:
> >
> > > - CONFIG_CFI_CLANG=y for x86 and arm64. (And disable FINEIBT since
> > > it isn't as secure as straight KCFI.)
> >
> > Oi ?
>
> Same objection I always had[1]: moving the check into the destination
> means attacks with control over executable memory contents can just omit
> the check.
>
> But now that I went to go look I see 0c3e806ec0f9 ("x86/cfi: Add boot
> time hash randomization") is only enabled under FINEIBT... seems better
> if that were always enabled...
And FINEIBT actually can't be disabled... :|
And as it turns out CFI_CLANG doesn't work at all on v6.9...
[ 0.587220] no CFI hash found at: __call_sites+0x339a8/0x34450 ffffffffac20cef8 00 00 00 00 00
[ 0.588226] WARNING: CPU: 0 PID: 0 at arch/x86/kernel/alternative.c:1182 __apply_fineibt+0x7a9/0x820
...
[ 0.619220] SMP alternatives: Something went horribly wrong trying to rewrite the CFI implementation.
*hang*
--
Kees Cook
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [PATCH] hardening: Refresh KCFI options, add some more
2024-04-30 21:15 ` Kees Cook
@ 2024-04-30 21:25 ` Kees Cook
0 siblings, 0 replies; 10+ messages in thread
From: Kees Cook @ 2024-04-30 21:25 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Gustavo A. R. Silva, Catalin Marinas, Will Deacon,
Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen, x86,
H. Peter Anvin, Nathan Chancellor, Nick Desaulniers,
Bill Wendling, Justin Stitt, linux-hardening, linux-arm-kernel,
llvm, linux-kernel
On Tue, Apr 30, 2024 at 02:15:53PM -0700, Kees Cook wrote:
> On Tue, Apr 30, 2024 at 10:48:36AM -0700, Kees Cook wrote:
> > On Tue, Apr 30, 2024 at 11:21:40AM +0200, Peter Zijlstra wrote:
> > > On Fri, Apr 26, 2024 at 03:29:44PM -0700, Kees Cook wrote:
> > >
> > > > - CONFIG_CFI_CLANG=y for x86 and arm64. (And disable FINEIBT since
> > > > it isn't as secure as straight KCFI.)
> > >
> > > Oi ?
> >
> > Same objection I always had[1]: moving the check into the destination
> > means attacks with control over executable memory contents can just omit
> > the check.
> >
> > But now that I went to go look I see 0c3e806ec0f9 ("x86/cfi: Add boot
> > time hash randomization") is only enabled under FINEIBT... seems better
> > if that were always enabled...
>
> And FINEIBT actually can't be disabled... :|
>
> And as it turns out CFI_CLANG doesn't work at all on v6.9...
>
> [ 0.587220] no CFI hash found at: __call_sites+0x339a8/0x34450 ffffffffac20cef8 00 00 00 00 00
> [ 0.588226] WARNING: CPU: 0 PID: 0 at arch/x86/kernel/alternative.c:1182 __apply_fineibt+0x7a9/0x820
> ...
> [ 0.619220] SMP alternatives: Something went horribly wrong trying to rewrite the CFI implementation.
> *hang*
Welcome to my TED talk.
I'll keep debugging this: boots fine on v6.8, but booting v6.9 with
defconfig+CFI_CLANG _does_ work, so something in my .config broke it...
--
Kees Cook
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] hardening: Refresh KCFI options, add some more
2024-04-30 17:48 ` Kees Cook
2024-04-30 21:15 ` Kees Cook
@ 2024-05-01 11:06 ` Peter Zijlstra
2024-05-01 19:27 ` Kees Cook
1 sibling, 1 reply; 10+ messages in thread
From: Peter Zijlstra @ 2024-05-01 11:06 UTC (permalink / raw)
To: Kees Cook
Cc: Gustavo A. R. Silva, Catalin Marinas, Will Deacon,
Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen, x86,
H. Peter Anvin, Nathan Chancellor, Nick Desaulniers,
Bill Wendling, Justin Stitt, linux-hardening, linux-arm-kernel,
llvm, linux-kernel
On Tue, Apr 30, 2024 at 10:48:36AM -0700, Kees Cook wrote:
> On Tue, Apr 30, 2024 at 11:21:40AM +0200, Peter Zijlstra wrote:
> > On Fri, Apr 26, 2024 at 03:29:44PM -0700, Kees Cook wrote:
> >
> > > - CONFIG_CFI_CLANG=y for x86 and arm64. (And disable FINEIBT since
> > > it isn't as secure as straight KCFI.)
> >
> > Oi ?
>
> Same objection I always had[1]: moving the check into the destination
> means attacks with control over executable memory contents can just omit
> the check.
I thought it was game over if you could write arbitrary test anyway?
The whole CFI thing was about clobbering data (function pointers to be
more specific), and both are robust against that.
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] hardening: Refresh KCFI options, add some more
2024-05-01 11:06 ` Peter Zijlstra
@ 2024-05-01 19:27 ` Kees Cook
0 siblings, 0 replies; 10+ messages in thread
From: Kees Cook @ 2024-05-01 19:27 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Gustavo A. R. Silva, Catalin Marinas, Will Deacon,
Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen, x86,
H. Peter Anvin, Nathan Chancellor, Nick Desaulniers,
Bill Wendling, Justin Stitt, linux-hardening, linux-arm-kernel,
llvm, linux-kernel
On Wed, May 01, 2024 at 01:06:14PM +0200, Peter Zijlstra wrote:
> On Tue, Apr 30, 2024 at 10:48:36AM -0700, Kees Cook wrote:
> > On Tue, Apr 30, 2024 at 11:21:40AM +0200, Peter Zijlstra wrote:
> > > On Fri, Apr 26, 2024 at 03:29:44PM -0700, Kees Cook wrote:
> > >
> > > > - CONFIG_CFI_CLANG=y for x86 and arm64. (And disable FINEIBT since
> > > > it isn't as secure as straight KCFI.)
> > >
> > > Oi ?
> >
> > Same objection I always had[1]: moving the check into the destination
> > means attacks with control over executable memory contents can just omit
> > the check.
>
> I thought it was game over if you could write arbitrary test anyway?
Yes, an attack having arbitrary write control over an executable memory
area is the place where CFI does get much weaker. But presently, there's
no reason to make it easier. With the hash randomization we have, an
attack needs to locate and read the kcfi_seed, otherwise everything else
is a fixed value.
In the future, when we have viable X^R kernel text, then the trade-off
becomes much more clear: we want FineIBT very very much. :)
> The whole CFI thing was about clobbering data (function pointers to be
> more specific), and both are robust against that.
Yes, if the threat model is limited to arbitrary writes to function
pointers, we're totally good with FineIBT.
-Kees
--
Kees Cook
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2024-05-01 19:27 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-04-26 22:29 [PATCH] hardening: Refresh KCFI options, add some more Kees Cook
2024-04-29 22:16 ` Nathan Chancellor
2024-04-30 5:35 ` Kees Cook
2024-04-30 15:12 ` Nathan Chancellor
2024-04-30 9:21 ` Peter Zijlstra
2024-04-30 17:48 ` Kees Cook
2024-04-30 21:15 ` Kees Cook
2024-04-30 21:25 ` Kees Cook
2024-05-01 11:06 ` Peter Zijlstra
2024-05-01 19:27 ` Kees Cook
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).