lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 10 Nov 2009 11:43:04 -0800 From: Kees Cook <kees.cook@...onical.com> To: "H. Peter Anvin" <hpa@...or.com> Cc: Arjan van de Ven <arjan@...radead.org>, Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>, x86@...nel.org, Pekka Enberg <penberg@...helsinki.fi>, Jan Beulich <jbeulich@...ell.com>, Vegard Nossum <vegardno@....uio.no>, Yinghai Lu <yinghai@...nel.org>, Jeremy Fitzhardinge <jeremy.fitzhardinge@...rix.com>, linux-kernel@...r.kernel.org Subject: Re: [PATCH v4] [x86] detect and report lack of NX protections On Tue, Nov 10, 2009 at 10:53:33AM -0800, H. Peter Anvin wrote: > On 11/10/2009 09:46 AM, Kees Cook wrote: > > > > The kernel as-is does not set nx_enabled for 64-bit, so this message is > > skipped completely: > > > > if (nx_enabled) > > printk(KERN_INFO "NX (Execute Disable) protection: active\n"); > > > > The only time this printk is shown is on 32-bit with PAE (with NX). > > There is no "else" currently. > > > > The structure you have is: > > if (nx_enabled) > else if (cpu_has_pae) > > The test for cpu_has_pae is unconditional (you only #ifdef the message) > -- in fact, this should cause a compile-time error on 64 bits: > > #undef cpu_has_pae > #define cpu_has_pae ___BUG___ This is fun. CONFIG_X86_PAE isn't defined for 64-bit, and using cpu_has_pae on 64-bit is considered a bug. :) Here is the matrix of what I want to see reported about NX at boot time. How do you recommend this be implemented? kernel cpu -> | CPU has PAE | CPU lacks PAE | | | CPU has NX | CPU lacks NX | | V +-------------------+-------------------+-----------------+ 32-bit non-PAE | missing in kernel | missing in kernel | no message | +-------------------+-------------------+-----------------+ 32-bit PAE | active * | missing in CPU | no message | +-------------------+-------------------+-----------------+ 64-bit | active | missing in CPU | impossible | +-------------------+-------------------+-----------------+ The box with the "*" is the only message currently reported by the kernel. this looks ugly, but does it: #if defined(CONFIG_X86_32) else if (cpu_has_pae) #else else #endif #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE) /* PAE kernel, PAE CPU, without NX */ printk(KERN_NOTICE "Notice: NX (Execute Disable) protection " "missing in CPU or disabled in BIOS!\n"); #else /* 32bit non-PAE kernel, PAE CPU */ printk(KERN_NOTICE "Notice: NX (Execute Disable) protection " "cannot be enabled: non-PAE kernel!\n"); #endif -- Kees Cook Ubuntu Security Team -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists