linux-kernel - Re: [PATCH] arm64: make CONFIG_DEBUG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGXu5j+94QqiZC-qbuHPTX-ERWG0-rSEEsP9g-b9wtQQE=E_Wg@mail.gmail.com>
Date:	Thu, 28 Jan 2016 07:17:04 -0800
From:	Kees Cook <keescook@...omium.org>
To:	Mark Rutland <mark.rutland@....com>
Cc:	David Brown <david.brown@...aro.org>,
	"kernel-hardening@...ts.openwall.com" 
	<kernel-hardening@...ts.openwall.com>,
	Ingo Molnar <mingo@...hat.com>,
	Andy Lutomirski <luto@...capital.net>,
	"H. Peter Anvin" <hpa@...or.com>,
	Michael Ellerman <mpe@...erman.id.au>,
	Mathias Krause <minipli@...glemail.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	"x86@...nel.org" <x86@...nel.org>, Arnd Bergmann <arnd@...db.de>,
	PaX Team <pageexec@...email.hu>,
	Emese Revfy <re.emese@...il.com>,
	LKML <linux-kernel@...r.kernel.org>,
	linux-arch <linux-arch@...r.kernel.org>,
	Catalin Marinas <catalin.marinas@....com>,
	Will Deacon <will.deacon@....com>,
	Marc Zyngier <marc.zyngier@....com>,
	yalin wang <yalin.wang2010@...il.com>,
	Zi Shen Lim <zlim.lnx@...il.com>,
	Yang Shi <yang.shi@...aro.org>,
	Ard Biesheuvel <ard.biesheuvel@...aro.org>,
	Laura Abbott <lauraa@...eaurora.org>,
	"Suzuki K. Poulose" <suzuki.poulose@....com>,
	Steve Capper <steve.capper@...aro.org>,
	Jeremy Linton <jeremy.linton@....com>,
	Mark Salter <msalter@...hat.com>,
	"linux-arm-kernel@...ts.infradead.org" 
	<linux-arm-kernel@...ts.infradead.org>
Subject: Re: [PATCH] arm64: make CONFIG_DEBUG_RODATA non-optional

On Thu, Jan 28, 2016 at 6:59 AM, Mark Rutland <mark.rutland@....com> wrote:
> On Thu, Jan 28, 2016 at 06:06:53AM -0800, Kees Cook wrote:
>> On Thu, Jan 28, 2016 at 3:06 AM, Mark Rutland <mark.rutland@....com> wrote:
>> > One thing I would like to do is to avoid the need for fixup_executable
>> > entirely, by mapping the kernel text RO from the outset. However, that
>> > requires rework of the alternatives patching (to use a temporary RW
>> > alias), and I haven't had the time to look into that yet.
>>
>> This makes perfect sense for the rodata section, but the (future)
>> postinit_rodata section we'll still want to mark RO after init
>> finishes. x86 and ARM cheat y marking both RO after init, and they
>> don't have to pad sections. parisc will need to solve this too.
>
> Depending on how many postinit_rodata variables there are, we might be
> able to drop those in .rodata, have them RO always, and initialise them
> via a temporary RW alias (e.g. something in the vmalloc area).
>
> The only requirement for that is that we use a helper to initialise any
> __postinit_ro variables via a temporary RW alias, e.g.
>
> #define SET_POST_INIT_RO(ptr, v) ({             \\
>         typeof(ptr) __ptr_rw = (ptr)            \\
>         BUG_ON(initcalls_done);                 \\
>         __ptr_rw = create_rw_alias(__ptr);      \\
>         __ptr_rw = v;                           \\
>         destroy_rw_alias(__ptr_rw);             \\
> })
>
> ...
>
> __postinit_ro void *thing;
>
> void __init some_init_func(void) {
>         void *__thing = some_ranodomized_allocator();
>         SET_POSTINIT_RO(thing, thing);
> }

Well, that certainly would make their usage explicit, but I'd really
like to avoid that, especially in the face of trying to const-ify as
much of the kernel as possible to reduce attack surface. I don't want
to have to both mark the variable and its writes, since that would
make the constification gcc plugin a bit more complex.

-Kees

-- 
Kees Cook
Chrome OS & Brillo Security