linux-hardening - Re: [PATCH v4 00/26] arm64: refactor boot flow and add support for WXN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 24 Jun 2022 16:40:18 +0200
From:   Ard Biesheuvel <ardb@...nel.org>
To:     Will Deacon <will@...nel.org>
Cc:     Linux ARM <linux-arm-kernel@...ts.infradead.org>,
        linux-hardening@...r.kernel.org, Marc Zyngier <maz@...nel.org>,
        Mark Rutland <mark.rutland@....com>,
        Kees Cook <keescook@...omium.org>,
        Catalin Marinas <catalin.marinas@....com>,
        Mark Brown <broonie@...nel.org>,
        Anshuman Khandual <anshuman.khandual@....com>
Subject: Re: [PATCH v4 00/26] arm64: refactor boot flow and add support for WXN

On Fri, 24 Jun 2022 at 15:20, Will Deacon <will@...nel.org> wrote:
>
> Hi Ard,
>
> On Mon, Jun 13, 2022 at 04:45:24PM +0200, Ard Biesheuvel wrote:
> > [ TL;DR this series does the following:
> >   - move variable definitions and assignments out of early asm code
> >     where possible, and get rid of explicit cache maintenance;
> >   - convert initial ID map so it covers the entire loaded image as well
> >     as the DT blob;
> >   - create the kernel mapping only once instead of twice (for KASLR),
> >     and do it with the MMU and caches on;
> >   - avoid mappings that are both writable and executable entirely;
> >   - avoid parsing the DT while the kernel text and rodata are still
> >     mapped writable;
> >   - allow WXN to be enabled (with an opt-out) so writable mappings are
> >     never executable. ]
>
> I really like this series -- it removes quite a few ugly warts from our
> boot assembly that we've collected over the years and, while functional,
> they have never been particularly satisfactory. Thank you for putting it
> together.
>
> I've left a handful of minor comments on some of the patches and if you
> can address those then I'd like to queue the first 21 patches ASAP to
> give them some more exposure before the next merge window.
>

I'll spin a v5 with just those patches, and we can revisit the
remaining work at a later time.

> The remaining patches are the WXN pieces, which I'd like to give others
> a chance to chime in on first.
>
> Cheers,
>
> Will