linux-kernel - Re: [RFC][PATCH] x86/mm: warn on W+x mappings

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20151002073708.GB5035@gmail.com>
Date:	Fri, 2 Oct 2015 09:37:09 +0200
From:	Ingo Molnar <mingo@...nel.org>
To:	Stephen Smalley <sds@...ho.nsa.gov>
Cc:	x86@...nel.org, linux-kernel@...r.kernel.org,
	keescook@...omium.org, Borislav Petkov <bp@...en8.de>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Andy Lutomirski <luto@...nel.org>,
	Denys Vlasenko <dvlasenk@...hat.com>,
	Brian Gerst <brgerst@...il.com>
Subject: Re: [RFC][PATCH] x86/mm: warn on W+x mappings


* Stephen Smalley <sds@...ho.nsa.gov> wrote:

> +	st.check_wx = checkwx;
> +	if (checkwx) {
> +		pr_info("Checking for W+x mappings\n");
> +		st.found_wx = false;
> +	}
> +
>  	for (i = 0; i < PTRS_PER_PGD; i++) {
>  		st.current_address = normalize_addr(i * PGD_LEVEL_MULT);
>  		if (!pgd_none(*start)) {
> @@ -378,6 +395,18 @@ void ptdump_walk_pgd_level(struct seq_file *m, pgd_t *pgd)
>  	/* Flush out the last page */
>  	st.current_address = normalize_addr(PTRS_PER_PGD*PGD_LEVEL_MULT);
>  	note_page(m, &st, __pgprot(0), 0);
> +	if (checkwx && st.found_wx)
> +		pr_warn("Found W+x mappings.  Please fix.\n");

So I like the patch, except the way it presents failures:

please generate any printks() only after the check has been performed, not before 
it. There should be a single line printed in the 'test successful' case:

	pr_info("x86/mm: Checked W+X mappings: passed, no W+X pages found.\n");

In the failure case there should be printk()s generated at the first point of 
violation:

+               pgprotval_t pr = pgprot_val(st->current_prot);
+               bool savedmesg = st->to_dmesg;
+
+               if (st->check_wx && (pr & _PAGE_RW) && !(pr & _PAGE_NX)) {
+                       st->to_dmesg = true;
+                       st->found_wx = true;
+               }

via something like:

	WARN_ONCE(1, "x86/mm: Found insecure W+X mapping at address %p/%pS\n", addr, addr);

i.e. output the address and the symbolic name as well. Only generate a single 
warning - we expect the normal kernel to be entirely warnings-free.

and then print the number of pages with bad mappings in the 'result' line:

	pr_info("x86/mm: Checked W+X mappings: FAILED, %ld W+X pages found.\n", nr_failures);

Thanks,

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/