[PATCH 0/3] taint: Add taint for randstruct

[PATCH 0/3] taint: Add taint for randstruct

[Kees Cook]

This cleans up the taint flags and documentation before adding a new
one for randstruct. Patch 3/3 reads:

Since the randstruct plugin can intentionally produce extremely unusual
kernel structure layouts (even performance pathological ones), some
maintainers want to be able to trivially determine if an Oops is coming
from a randstruct-built kernel, so as to keep their sanity when debugging.
This adds the new flag and initializes taint_mask immediately when built
with randstruct.

Thanks,

-Kees

[PATCH 1/3] taint: Convert to enum and indexed initialization

[Kees Cook]

This converts the taint bit defines to an enum, uses indexed initializers
instead of comments, and make sure that no one forgets to update the
taint_flags when adding new bits.

Signed-off-by: Kees Cook <keescook@chromium.org>
---
 include/linux/kernel.h | 40 ++++++++++++++++++++++------------------
 kernel/panic.c         | 36 +++++++++++++++++++-----------------
 2 files changed, 41 insertions(+), 35 deletions(-)

diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index ce51455e2adf..0d2a2dd507b7 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -533,24 +533,28 @@ extern enum system_states {
 	SYSTEM_RESTART,
 } system_state;
 
-#define TAINT_PROPRIETARY_MODULE	0
-#define TAINT_FORCED_MODULE		1
-#define TAINT_CPU_OUT_OF_SPEC		2
-#define TAINT_FORCED_RMMOD		3
-#define TAINT_MACHINE_CHECK		4
-#define TAINT_BAD_PAGE			5
-#define TAINT_USER			6
-#define TAINT_DIE			7
-#define TAINT_OVERRIDDEN_ACPI_TABLE	8
-#define TAINT_WARN			9
-#define TAINT_CRAP			10
-#define TAINT_FIRMWARE_WORKAROUND	11
-#define TAINT_OOT_MODULE		12
-#define TAINT_UNSIGNED_MODULE		13
-#define TAINT_SOFTLOCKUP		14
-#define TAINT_LIVEPATCH			15
-#define TAINT_AUX			16
-#define TAINT_FLAGS_COUNT		17
+enum taint_enum {
+	TAINT_PROPRIETARY_MODULE = 0,
+	TAINT_FORCED_MODULE,
+	TAINT_CPU_OUT_OF_SPEC,
+	TAINT_FORCED_RMMOD,
+	TAINT_MACHINE_CHECK,
+	TAINT_BAD_PAGE,
+	TAINT_USER,
+	TAINT_DIE,
+	TAINT_OVERRIDDEN_ACPI_TABLE,
+	TAINT_WARN,
+	TAINT_CRAP,
+	TAINT_FIRMWARE_WORKAROUND,
+	TAINT_OOT_MODULE,
+	TAINT_UNSIGNED_MODULE,
+	TAINT_SOFTLOCKUP,
+	TAINT_LIVEPATCH,
+	TAINT_AUX,
+
+	/* End of taint bits */
+	TAINT_FLAGS_COUNT
+};
 
 struct taint_flag {
 	char c_true;	/* character printed when tainted */
diff --git a/kernel/panic.c b/kernel/panic.c
index 2cfef408fec9..c5e0fd5a188e 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -308,23 +308,23 @@ EXPORT_SYMBOL(panic);
  * is being removed anyway.
  */
 const struct taint_flag taint_flags[TAINT_FLAGS_COUNT] = {
-	{ 'P', 'G', true },	/* TAINT_PROPRIETARY_MODULE */
-	{ 'F', ' ', true },	/* TAINT_FORCED_MODULE */
-	{ 'S', ' ', false },	/* TAINT_CPU_OUT_OF_SPEC */
-	{ 'R', ' ', false },	/* TAINT_FORCED_RMMOD */
-	{ 'M', ' ', false },	/* TAINT_MACHINE_CHECK */
-	{ 'B', ' ', false },	/* TAINT_BAD_PAGE */
-	{ 'U', ' ', false },	/* TAINT_USER */
-	{ 'D', ' ', false },	/* TAINT_DIE */
-	{ 'A', ' ', false },	/* TAINT_OVERRIDDEN_ACPI_TABLE */
-	{ 'W', ' ', false },	/* TAINT_WARN */
-	{ 'C', ' ', true },	/* TAINT_CRAP */
-	{ 'I', ' ', false },	/* TAINT_FIRMWARE_WORKAROUND */
-	{ 'O', ' ', true },	/* TAINT_OOT_MODULE */
-	{ 'E', ' ', true },	/* TAINT_UNSIGNED_MODULE */
-	{ 'L', ' ', false },	/* TAINT_SOFTLOCKUP */
-	{ 'K', ' ', true },	/* TAINT_LIVEPATCH */
-	{ 'X', ' ', true },	/* TAINT_AUX */
+	[ TAINT_PROPRIETARY_MODULE ]	= { 'P', 'G', true },
+	[ TAINT_FORCED_MODULE ]		= { 'F', ' ', true },
+	[ TAINT_CPU_OUT_OF_SPEC ]	= { 'S', ' ', false },
+	[ TAINT_FORCED_RMMOD ]		= { 'R', ' ', false },
+	[ TAINT_MACHINE_CHECK ]		= { 'M', ' ', false },
+	[ TAINT_BAD_PAGE ]		= { 'B', ' ', false },
+	[ TAINT_USER ]			= { 'U', ' ', false },
+	[ TAINT_DIE ]			= { 'D', ' ', false },
+	[ TAINT_OVERRIDDEN_ACPI_TABLE ]	= { 'A', ' ', false },
+	[ TAINT_WARN ]			= { 'W', ' ', false },
+	[ TAINT_CRAP ]			= { 'C', ' ', true },
+	[ TAINT_FIRMWARE_WORKAROUND ]	= { 'I', ' ', false },
+	[ TAINT_OOT_MODULE ]		= { 'O', ' ', true },
+	[ TAINT_UNSIGNED_MODULE ]	= { 'E', ' ', true },
+	[ TAINT_SOFTLOCKUP ]		= { 'L', ' ', false },
+	[ TAINT_LIVEPATCH ]		= { 'K', ' ', true },
+	[ TAINT_AUX ]			= { 'X', ' ', true },
 };
 
 /**
@@ -354,6 +354,8 @@ const char *print_tainted(void)
 {
 	static char buf[TAINT_FLAGS_COUNT + sizeof("Tainted: ")];
 
+	BUILD_BUG_ON(ARRAY_SIZE(taint_flags) != TAINT_FLAGS_COUNT);
+
 	if (tainted_mask) {
 		char *s;
 		int i;
-- 
2.7.4

Re: [PATCH 1/3] taint: Convert to enum and indexed initialization

[kbuild test robot]

[-- Attachment #1: Type: text/plain, Size: 1187 bytes --]

Hi Kees,

I love your patch! Yet something to improve:

[auto build test ERROR on linus/master]
[also build test ERROR on v4.16-rc1 next-20180216]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]

url:    https://github.com/0day-ci/linux/commits/Kees-Cook/taint-Add-taint-for-randstruct/20180218-100113
config: arm64-defconfig (attached as .config)
compiler: aarch64-linux-gnu-gcc (Debian 7.2.0-11) 7.2.0
reproduce:
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # save the attached .config to linux build tree
        make.cross ARCH=arm64 

All errors (new ones prefixed by >>):

   /tmp/ccUwVEny.s: Assembler messages:
>> /tmp/ccUwVEny.s:897: Error: invalid operands (*UND* and *ABS* sections) for `<<'
   /tmp/ccUwVEny.s:932: Error: invalid operands (*UND* and *ABS* sections) for `<<'
   /tmp/ccUwVEny.s:1116: Error: invalid operands (*UND* and *ABS* sections) for `<<'

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 37708 bytes --]

Re: [PATCH 1/3] taint: Convert to enum and indexed initialization

[Kees Cook]

On Sat, Feb 17, 2018 at 9:03 PM, kbuild test robot <lkp@intel.com> wrote:
> Hi Kees,
>
> I love your patch! Yet something to improve:
>
> [auto build test ERROR on linus/master]
> [also build test ERROR on v4.16-rc1 next-20180216]
> [if your patch is applied to the wrong git tree, please drop us a note to help improve the system]
>
> url:    https://github.com/0day-ci/linux/commits/Kees-Cook/taint-Add-taint-for-randstruct/20180218-100113
> config: arm64-defconfig (attached as .config)
> compiler: aarch64-linux-gnu-gcc (Debian 7.2.0-11) 7.2.0
> reproduce:
>         wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
>         chmod +x ~/bin/make.cross
>         # save the attached .config to linux build tree
>         make.cross ARCH=arm64
>
> All errors (new ones prefixed by >>):
>
>    /tmp/ccUwVEny.s: Assembler messages:
>>> /tmp/ccUwVEny.s:897: Error: invalid operands (*UND* and *ABS* sections) for `<<'
>    /tmp/ccUwVEny.s:932: Error: invalid operands (*UND* and *ABS* sections) for `<<'
>    /tmp/ccUwVEny.s:1116: Error: invalid operands (*UND* and *ABS* sections) for `<<'

Ugh, it looks like an enum can't be used here because of assembly
files? I'll try to figure this out...

-Kees

>
> ---
> 0-DAY kernel test infrastructure                Open Source Technology Center
> https://lists.01.org/pipermail/kbuild-all                   Intel Corporation



-- 
Kees Cook
Pixel Security

[PATCH 2/3] taint: Consolidate documentation

[Kees Cook]

This consolidates the taint bit documentation into a single place with
both numeric and letter values. Additionally adds the missing TAINT_AUX
documentation.

Signed-off-by: Kees Cook <keescook@chromium.org>
---
 Documentation/sysctl/kernel.txt | 53 +++++++++++++++++++++--------------------
 kernel/panic.c                  | 23 ++++--------------
 2 files changed, 31 insertions(+), 45 deletions(-)

diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
index 412314eebda6..4a890c7fb6c3 100644
--- a/Documentation/sysctl/kernel.txt
+++ b/Documentation/sysctl/kernel.txt
@@ -964,32 +964,33 @@ detect a hard lockup condition.
 
 tainted:
 
-Non-zero if the kernel has been tainted.  Numeric values, which
-can be ORed together:
-
-   1 - A module with a non-GPL license has been loaded, this
-       includes modules with no license.
-       Set by modutils >= 2.4.9 and module-init-tools.
-   2 - A module was force loaded by insmod -f.
-       Set by modutils >= 2.4.9 and module-init-tools.
-   4 - Unsafe SMP processors: SMP with CPUs not designed for SMP.
-   8 - A module was forcibly unloaded from the system by rmmod -f.
-  16 - A hardware machine check error occurred on the system.
-  32 - A bad page was discovered on the system.
-  64 - The user has asked that the system be marked "tainted".  This
-       could be because they are running software that directly modifies
-       the hardware, or for other reasons.
- 128 - The system has died.
- 256 - The ACPI DSDT has been overridden with one supplied by the user
-        instead of using the one provided by the hardware.
- 512 - A kernel warning has occurred.
-1024 - A module from drivers/staging was loaded.
-2048 - The system is working around a severe firmware bug.
-4096 - An out-of-tree module has been loaded.
-8192 - An unsigned module has been loaded in a kernel supporting module
-       signature.
-16384 - A soft lockup has previously occurred on the system.
-32768 - The kernel has been live patched.
+Non-zero if the kernel has been tainted. Numeric values, which can be
+ORed together. The letters are seen in "Tainted" line of Oops reports.
+
+     1 (P):  A module with a non-GPL license has been loaded, this
+             includes modules with no license.
+             Set by modutils >= 2.4.9 and module-init-tools.
+     2 (F): A module was force loaded by insmod -f.
+            Set by modutils >= 2.4.9 and module-init-tools.
+     4 (S): Unsafe SMP processors: SMP with CPUs not designed for SMP.
+     8 (R): A module was forcibly unloaded from the system by rmmod -f.
+    16 (M): A hardware machine check error occurred on the system.
+    32 (B): A bad page was discovered on the system.
+    64 (U): The user has asked that the system be marked "tainted". This
+            could be because they are running software that directly modifies
+            the hardware, or for other reasons.
+   128 (D): The system has died.
+   256 (A): The ACPI DSDT has been overridden with one supplied by the user
+            instead of using the one provided by the hardware.
+   512 (W): A kernel warning has occurred.
+  1024 (C): A module from drivers/staging was loaded.
+  2048 (I): The system is working around a severe firmware bug.
+  4096 (O): An out-of-tree module has been loaded.
+  8192 (E): An unsigned module has been loaded in a kernel supporting module
+            signature.
+ 16384 (L): A soft lockup has previously occurred on the system.
+ 32768 (K): The kernel has been live patched.
+ 65536 (X): Auxiliary taint, defined and used by for distros.
 
 ==============================================================
 
diff --git a/kernel/panic.c b/kernel/panic.c
index c5e0fd5a188e..15d333a54ece 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -328,27 +328,12 @@ const struct taint_flag taint_flags[TAINT_FLAGS_COUNT] = {
 };
 
 /**
- *	print_tainted - return a string to represent the kernel taint state.
+ * print_tainted - return a string to represent the kernel taint state.
  *
- *  'P' - Proprietary module has been loaded.
- *  'F' - Module has been forcibly loaded.
- *  'S' - SMP with CPUs not designed for SMP.
- *  'R' - User forced a module unload.
- *  'M' - System experienced a machine check exception.
- *  'B' - System has hit bad_page.
- *  'U' - Userspace-defined naughtiness.
- *  'D' - Kernel has oopsed before
- *  'A' - ACPI table overridden.
- *  'W' - Taint on warning.
- *  'C' - modules from drivers/staging are loaded.
- *  'I' - Working around severe firmware bug.
- *  'O' - Out-of-tree module has been loaded.
- *  'E' - Unsigned module has been loaded.
- *  'L' - A soft lockup has previously occurred.
- *  'K' - Kernel has been live patched.
- *  'X' - Auxiliary taint, for distros' use.
+ * For individual taint flag meanings, see Documentation/sysctl/kernel.txt
  *
- *	The string is overwritten by the next call to print_tainted().
+ * The string is overwritten by the next call to print_tainted(),
+ * but is always NULL terminated.
  */
 const char *print_tainted(void)
 {
-- 
2.7.4

[PATCH 3/3] taint: Add taint for randstruct

[Kees Cook]

Since the randstruct plugin can intentionally produce extremely unusual
kernel structure layouts (even performance pathological ones), some
maintainers want to be able to trivially determine if an Oops is coming
from a randstruct-built kernel, so as to keep their sanity when debugging.
This adds the new flag and initializes taint_mask immediately when built
with randstruct.

Signed-off-by: Kees Cook <keescook@chromium.org>
---
 Documentation/sysctl/kernel.txt | 1 +
 include/linux/kernel.h          | 1 +
 kernel/panic.c                  | 4 +++-
 3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
index 4a890c7fb6c3..eded671d55eb 100644
--- a/Documentation/sysctl/kernel.txt
+++ b/Documentation/sysctl/kernel.txt
@@ -991,6 +991,7 @@ ORed together. The letters are seen in "Tainted" line of Oops reports.
  16384 (L): A soft lockup has previously occurred on the system.
  32768 (K): The kernel has been live patched.
  65536 (X): Auxiliary taint, defined and used by for distros.
+131072 (T): The kernel was built with the struct randomization plugin.
 
 ==============================================================
 
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 0d2a2dd507b7..9e93ab8358d0 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -551,6 +551,7 @@ enum taint_enum {
 	TAINT_SOFTLOCKUP,
 	TAINT_LIVEPATCH,
 	TAINT_AUX,
+	TAINT_RANDSTRUCT,
 
 	/* End of taint bits */
 	TAINT_FLAGS_COUNT
diff --git a/kernel/panic.c b/kernel/panic.c
index 15d333a54ece..0153cae0d330 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -34,7 +34,8 @@
 #define PANIC_BLINK_SPD 18
 
 int panic_on_oops = CONFIG_PANIC_ON_OOPS_VALUE;
-static unsigned long tainted_mask;
+static unsigned long tainted_mask =
+	IS_ENABLED(CONFIG_GCC_PLUGIN_RANDSTRUCT) ? (1 << TAINT_RANDSTRUCT) : 0;
 static int pause_on_oops;
 static int pause_on_oops_flag;
 static DEFINE_SPINLOCK(pause_on_oops_lock);
@@ -325,6 +326,7 @@ const struct taint_flag taint_flags[TAINT_FLAGS_COUNT] = {
 	[ TAINT_SOFTLOCKUP ]		= { 'L', ' ', false },
 	[ TAINT_LIVEPATCH ]		= { 'K', ' ', true },
 	[ TAINT_AUX ]			= { 'X', ' ', true },
+	[ TAINT_RANDSTRUCT ]		= { 'T', ' ', true },
 };
 
 /**
-- 
2.7.4

Re: [PATCH 3/3] taint: Add taint for randstruct

[Alexey Dobriyan]

On Thu, Feb 15, 2018 at 07:37:44PM -0800, Kees Cook wrote:
> +	[ TAINT_RANDSTRUCT ]		= { 'T', ' ', true },

Something like this, yeah.

Re: [PATCH 3/3] taint: Add taint for randstruct

[Andrew Morton]

On Thu, 15 Feb 2018 19:37:44 -0800 Kees Cook <keescook@chromium.org> wrote:

> --- a/Documentation/sysctl/kernel.txt
> +++ b/Documentation/sysctl/kernel.txt
> @@ -991,6 +991,7 @@ ORed together. The letters are seen in "Tainted" line of Oops reports.
>   16384 (L): A soft lockup has previously occurred on the system.
>   32768 (K): The kernel has been live patched.
>   65536 (X): Auxiliary taint, defined and used by for distros.
> +131072 (T): The kernel was built with the struct randomization plugin.

Uncle.


From: Andrew Morton <akpm@linux-foundation.org>
Subject: Documentation/sysctl/kernel.txt: show taint codes in hex

The decimal representation is getting a bit hard to follow.

Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 Documentation/sysctl/kernel.txt |   50 +++++++++++++++---------------
 1 file changed, 25 insertions(+), 25 deletions(-)

diff -puN Documentation/sysctl/kernel.txt~a Documentation/sysctl/kernel.txt
--- a/Documentation/sysctl/kernel.txt~a
+++ a/Documentation/sysctl/kernel.txt
@@ -967,31 +967,31 @@ tainted:
 Non-zero if the kernel has been tainted. Numeric values, which can be
 ORed together. The letters are seen in "Tainted" line of Oops reports.
 
-     1 (P):  A module with a non-GPL license has been loaded, this
-             includes modules with no license.
-             Set by modutils >= 2.4.9 and module-init-tools.
-     2 (F): A module was force loaded by insmod -f.
-            Set by modutils >= 2.4.9 and module-init-tools.
-     4 (S): Unsafe SMP processors: SMP with CPUs not designed for SMP.
-     8 (R): A module was forcibly unloaded from the system by rmmod -f.
-    16 (M): A hardware machine check error occurred on the system.
-    32 (B): A bad page was discovered on the system.
-    64 (U): The user has asked that the system be marked "tainted". This
-            could be because they are running software that directly modifies
-            the hardware, or for other reasons.
-   128 (D): The system has died.
-   256 (A): The ACPI DSDT has been overridden with one supplied by the user
-            instead of using the one provided by the hardware.
-   512 (W): A kernel warning has occurred.
-  1024 (C): A module from drivers/staging was loaded.
-  2048 (I): The system is working around a severe firmware bug.
-  4096 (O): An out-of-tree module has been loaded.
-  8192 (E): An unsigned module has been loaded in a kernel supporting module
-            signature.
- 16384 (L): A soft lockup has previously occurred on the system.
- 32768 (K): The kernel has been live patched.
- 65536 (X): Auxiliary taint, defined and used by for distros.
-131072 (T): The kernel was built with the struct randomization plugin.
+0x00000001 (P):  A module with a non-GPL license has been loaded, this
+                 includes modules with no license.
+                 Set by modutils >= 2.4.9 and module-init-tools.
+0x00000002 (F): A module was force loaded by insmod -f.
+                Set by modutils >= 2.4.9 and module-init-tools.
+0x00000004 (S): Unsafe SMP processors: SMP with CPUs not designed for SMP.
+0x00000008 (R): A module was forcibly unloaded from the system by rmmod -f.
+0x00000010 (M): A hardware machine check error occurred on the system.
+0x00000020 (B): A bad page was discovered on the system.
+0x00000040 (U): The user has asked that the system be marked "tainted". This
+                could be because they are running software that directly
+                modifies the hardware, or for other reasons.
+0x00000080 (D): The system has died.
+0x00000100 (A): The ACPI DSDT has been overridden with one supplied by the user
+                instead of using the one provided by the hardware.
+0x00000200 (W): A kernel warning has occurred.
+0x00000400 (C): A module from drivers/staging was loaded.
+0x00000400 (I): The system is working around a severe firmware bug.
+0x00000800 (O): An out-of-tree module has been loaded.
+0x00020000 (E): An unsigned module has been loaded in a kernel supporting module
+                signature.
+0x00040000 (L): A soft lockup has previously occurred on the system.
+0x00080000 (K): The kernel has been live patched.
+0x00100000 (X): Auxiliary taint, defined and used by for distros.
+0x00200000 (T): The kernel was built with the struct randomization plugin.
 
 ==============================================================
 
_

Re: [PATCH 3/3] taint: Add taint for randstruct

[Kees Cook]

On Fri, Feb 16, 2018 at 1:02 PM, Andrew Morton
<akpm@linux-foundation.org> wrote:
> On Thu, 15 Feb 2018 19:37:44 -0800 Kees Cook <keescook@chromium.org> wrote:
>
>> --- a/Documentation/sysctl/kernel.txt
>> +++ b/Documentation/sysctl/kernel.txt
>> @@ -991,6 +991,7 @@ ORed together. The letters are seen in "Tainted" line of Oops reports.
>>   16384 (L): A soft lockup has previously occurred on the system.
>>   32768 (K): The kernel has been live patched.
>>   65536 (X): Auxiliary taint, defined and used by for distros.
>> +131072 (T): The kernel was built with the struct randomization plugin.
>
> Uncle.
>
>
> From: Andrew Morton <akpm@linux-foundation.org>
> Subject: Documentation/sysctl/kernel.txt: show taint codes in hex
>
> The decimal representation is getting a bit hard to follow.

The rationale, AIUI, is that /proc/sys/kernel/tainted prints the
values in decimal. If we change the docs to be hex and leave the
output decimal, that makes it even harder to examine.

If we change the proc output, will we break userspace? And if we
change it, maybe avoid numbers at all, and proc should bring the same
thing that Oops does (the letter codes)? (But then the sysctl would
need to parse the letters...)

-Kees

-- 
Kees Cook
Pixel Security