linux-kernel - Re: [PATCH v2 1/4] init: create cmdline param to disable readonly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20151126075130.GB18742@gmail.com>
Date:	Thu, 26 Nov 2015 08:51:30 +0100
From:	Ingo Molnar <mingo@...nel.org>
To:	Kees Cook <keescook@...omium.org>
Cc:	linux-kernel@...r.kernel.org,
	Andy Lutomirski <luto@...capital.net>,
	"H. Peter Anvin" <hpa@...or.com>,
	Michael Ellerman <mpe@...erman.id.au>,
	Mathias Krause <minipli@...glemail.com>,
	Ingo Molnar <mingo@...hat.com>,
	Thomas Gleixner <tglx@...utronix.de>, x86@...nel.org,
	Arnd Bergmann <arnd@...db.de>, PaX Team <pageexec@...email.hu>,
	Emese Revfy <re.emese@...il.com>,
	kernel-hardening@...ts.openwall.com,
	linux-arch <linux-arch@...r.kernel.org>
Subject: Re: [PATCH v2 1/4] init: create cmdline param to disable readonly


* Kees Cook <keescook@...omium.org> wrote:

> It may be useful to debug writes to the readonly sections of memory,
> so provide a cmdline "rodata=off" to allow for this.
> 
> Suggested-by: H. Peter Anvin <hpa@...or.com>
> Signed-off-by: Kees Cook <keescook@...omium.org>
> ---
>  Documentation/kernel-parameters.txt |  4 ++++
>  init/main.c                         | 31 +++++++++++++++++++++++++++----
>  2 files changed, 31 insertions(+), 4 deletions(-)
> 
> diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
> index 742f69d18fc8..21cf76dbba90 100644
> --- a/Documentation/kernel-parameters.txt
> +++ b/Documentation/kernel-parameters.txt
> @@ -3409,6 +3409,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
>  
>  	ro		[KNL] Mount root device read-only on boot
>  
> +	rodata=		[KNL]
> +		on	Mark read-only kernel memory as read-only (default).
> +		off	Leave read-only kernel memory writable for debugging.
> +
>  	root=		[KNL] Root filesystem
>  			See name_to_dev_t comment in init/do_mounts.c.
>  
> diff --git a/init/main.c b/init/main.c
> index 9e64d7097f1a..06200d2fbf08 100644
> --- a/init/main.c
> +++ b/init/main.c
> @@ -93,9 +93,6 @@ static int kernel_init(void *);
>  extern void init_IRQ(void);
>  extern void fork_init(void);
>  extern void radix_tree_init(void);
> -#ifndef CONFIG_DEBUG_RODATA
> -static inline void mark_rodata_ro(void) { }
> -#endif
>  
>  /*
>   * Debug helper: via this flag we know that we are in 'early bootup code'
> @@ -929,6 +926,32 @@ static int try_to_run_init_process(const char *init_filename)
>  
>  static noinline void __init kernel_init_freeable(void);
>  
> +#ifdef CONFIG_DEBUG_RODATA

Btw., could you please remove the Kconfig option altogether in an additional patch 
and make read-only sections an always-on feature? It has been default-y for years 
and all distros have it enabled.

The 'debug rodata' naming is purely historic: this started out as a simple 
debugging feature, but meanwhile it has spread and has become an essential kernel 
robustness feature.

The boot option you added can be used if anyone needs to disable it. (Never heard 
of such a case though.)

Thanks,

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/