linux-hardening - Re: [RFC PATCH v2 16/19] x86/mm: Protect page tables with PKS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 31 Aug 2021 17:55:54 +0000
From:   "Edgecombe, Rick P" <rick.p.edgecombe@...el.com>
To:     "rppt@...nel.org" <rppt@...nel.org>
CC:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "peterz@...radead.org" <peterz@...radead.org>,
        "keescook@...omium.org" <keescook@...omium.org>,
        "Weiny, Ira" <ira.weiny@...el.com>,
        "linux-hardening@...r.kernel.org" <linux-hardening@...r.kernel.org>,
        "linux-mm@...ck.org" <linux-mm@...ck.org>,
        "vbabka@...e.cz" <vbabka@...e.cz>,
        "x86@...nel.org" <x86@...nel.org>,
        "akpm@...ux-foundation.org" <akpm@...ux-foundation.org>,
        "Williams, Dan J" <dan.j.williams@...el.com>,
        "Lutomirski, Andy" <luto@...nel.org>,
        "kernel-hardening@...ts.openwall.com" 
        <kernel-hardening@...ts.openwall.com>,
        "Hansen, Dave" <dave.hansen@...el.com>,
        "shakeelb@...gle.com" <shakeelb@...gle.com>
Subject: Re: [RFC PATCH v2 16/19] x86/mm: Protect page tables with PKS

On Tue, 2021-08-31 at 11:56 +0300, Mike Rapoport wrote:
> On Mon, Aug 30, 2021 at 04:59:24PM -0700, Rick Edgecombe wrote:
> > Write protect page tables with PKS. Toggle writeability inside the
> > pgtable.h defined page table modifiction functions.
> > 
> > Do not protect the direct map page tables as it is more complicated
> > and
> > will come in a later patch.
> > 
> > Signed-off-by: Rick Edgecombe <rick.p.edgecombe@...el.com>
> > ---
> >  arch/x86/boot/compressed/ident_map_64.c |  5 ++
> >  arch/x86/include/asm/pgtable.h          | 18 ++++++-
> >  arch/x86/include/asm/pgtable_64.h       | 33 ++++++++++--
> >  arch/x86/include/asm/pkeys_common.h     |  1 -
> >  arch/x86/mm/pgtable.c                   | 71
> > ++++++++++++++++++++++---
> >  arch/x86/mm/pkeys.c                     |  1 +
> >  include/linux/pkeys.h                   |  1 +
> >  mm/Kconfig                              |  6 +++
> >  8 files changed, 123 insertions(+), 13 deletions(-)
> 
>  
> ...
> 
> > diff --git a/mm/Kconfig b/mm/Kconfig
> > index 4184d0a7531d..0f8e8595a396 100644
> > --- a/mm/Kconfig
> > +++ b/mm/Kconfig
> > @@ -845,6 +845,12 @@ config ARCH_ENABLE_SUPERVISOR_PKEYS
> >  	def_bool y
> >  	depends on PKS_TEST || GENERAL_PKS_USER
> >  
> > +config PKS_PG_TABLES
> > +	bool "PKS write protected page tables"
> > +	select GENERAL_PKS_USER
> > +	depends on !HIGHMEM && !X86_PAE && SPARSEMEM_VMEMMAP
> 
> Hmm, why is this x86-only feature is in mm/Kconfig?
> 
Yes, this should move, thanks. Ira did some Kconfig re-arranging in pks
core v7 that should make this easy now.

> > +	depends on ARCH_HAS_SUPERVISOR_PKEYS
> > +
> >  config PERCPU_STATS
> >  	bool "Collect percpu memory statistics"
> >  	help
> > -- 
> > 2.17.1
> > 
> 
>