Re: [RFC][PATCH] x86/mm: warn on W+x mappings

[Ingo Molnar <mingo@kernel.org>]

* Borislav Petkov <bp@alien8.de> wrote:

> On Thu, Oct 01, 2015 at 12:24:25PM -0700, Kees Cook wrote:
> > On Thu, Oct 1, 2015 at 9:28 AM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
> > > Warn on any residual W+x mappings if X86_PTDUMP is enabled.
> > >
> > > Sample dmesg output:
> > > Checking for W+x mappings
> > > 0xffffffff81755000-0xffffffff81800000         684K     RW                 GLB x  pte
> > > Found W+x mappings.  Please fix.
> > >
> > > Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
> > > ---
> > > Not sure if this is the best place to put this check.
> > > It must occur after free_init_pages() or it won't catch the
> > > W+x case for the gap between __ex_table and rodata.
> > 
> > Yeah. Hmm. I want this test for sure, but I'd like to be able to do with 
> > without needing PTDUMP, since that puts a very sensitive file in debugfs. I 
> > wonder if we can reuse the same code, but only expose the page tables to 
> > userspace with PTDUMP?
> 
> So make it a debugging option like CONFIG_EFI_PGT_DUMP and let it dump the 
> pagetable in dmesg during boot, at the exact point you want it to. Then one can 
> grep dmesg for W+x bits or whatever else...

It's better to generate a WARN()ing programmatically if the W+X condition occurs, 
that gets noticed by tools and people alike. I'd like to start treating that 
condition as a hard kernel bug.

A dump in dmesg is subject to random noise by printk crusaders and is also subject 
to general bitrot, nor does it provide any ready warning to act upon.

Adding an extra debug option is a good idea (just please don't put 'EFI' into the 
name - this isn't really EFI related), to not generate the debugfs node.

I'd even add this debug check as default-enabled in the x86 defconfigs, so that my 
own continuous kernel testing kit picks up any new warnings from it.

Thanks,

	Ingo