linux-kernel - Re: [RFC PATCH 2/2] livepatch: Clear relocation targets on a module removal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5c649320-a9bf-ae7f-5102-483bc34d219f@redhat.com>
Date:   Mon, 2 Sep 2019 13:05:02 -0400
From:   Joe Lawrence <joe.lawrence@...hat.com>
To:     Miroslav Benes <mbenes@...e.cz>,
        Josh Poimboeuf <jpoimboe@...hat.com>
Cc:     Petr Mladek <pmladek@...e.com>, jikos@...nel.org,
        linux-kernel@...r.kernel.org, live-patching@...r.kernel.org
Subject: Re: [RFC PATCH 2/2] livepatch: Clear relocation targets on a module
 removal

On 9/2/19 12:13 PM, Miroslav Benes wrote:
>> I can easily foresee more problems like those in the future.  Going
>> forward we have to always keep track of which special sections are
>> needed for which architectures.  Those special sections can change over
>> time, or can simply be overlooked for a given architecture.  It's
>> fragile.
> 
> Indeed. It bothers me a lot. Even x86 "port" is not feature complete in
> this regard (jump labels, alternatives,...) and who knows what lurks in
> the corners of the other architectures we support.
> 
> So it is in itself reason enough to do something about late module
> patching.
> 

Hi Miroslav,

I was tinkering with the "blue-sky" ideas that I mentioned to Josh the 
other day.  I dunno if you had a chance to look at what removing that 
code looks like, but I can continue to flesh out that idea if it looks 
interesting:

   https://github.com/joe-lawrence/linux/tree/blue-sky

A full demo would require packaging up replacement .ko's with a 
livepatch, as well as "blacklisting" those deprecated .kos, etc.  But 
that's all I had time to cook up last week before our holiday weekend here.

Regards,

-- Joe