linux-kernel - Re: [PATCH] ftrace/module: Allow ftrace to make only loaded module text read-write

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 10 Oct 2019 08:58:46 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     LKML <linux-kernel@...r.kernel.org>, Jessica Yu <jeyu@...nel.org>
Cc:     Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...nel.org>
Subject: Re: [PATCH] ftrace/module: Allow ftrace to make only loaded module
 text read-write

On Wed, 9 Oct 2019 22:36:38 -0400
Steven Rostedt <rostedt@...dmis.org> wrote:

> --- a/kernel/module.c
> +++ b/kernel/module.c
> @@ -2029,6 +2029,37 @@ static void module_enable_nx(const struct module *mod)
>  	frob_writable_data(&mod->init_layout, set_memory_nx);
>  }
>  

Also, if you are worried about these being used anywhere else, we can
add:

> +void set_module_text_rw(const struct module *mod)
> +{
> +	if (!rodata_enabled)
> +		return;
> +
> +	mutex_lock(&module_mutex);
> +	if (mod->state == MODULE_STATE_UNFORMED)

	if (mod->state == MODULE_STATE_UNFORMED ||
	    mod->state == MODULE_STATE_LIVE)

As this will keep it from being used on modules that are executing.

-- Steve


> +		goto out;
> +
> +	frob_text(&mod->core_layout, set_memory_rw);
> +	frob_text(&mod->init_layout, set_memory_rw);
> +out:
> +	mutex_unlock(&module_mutex);
> +}
> +
> +void set_module_text_ro(const struct module *mod)
> +{
> +	if (!rodata_enabled)
> +		return;
> +
> +	mutex_lock(&module_mutex);
> +	if (mod->state == MODULE_STATE_UNFORMED ||
> +	    mod->state == MODULE_STATE_GOING)
> +		goto out;
> +
> +	frob_text(&mod->core_layout, set_memory_ro);
> +	frob_text(&mod->init_layout, set_memory_ro);
> +out:
> +	mutex_unlock(&module_mutex);
> +}
> +