linux-kernel - Re: [PATCH v2] x86/mm: Do not verify W^X at boot up on ftrace trampolines

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20221024202407.44a3611b@gandalf.local.home>
Date:   Mon, 24 Oct 2022 20:24:07 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Kees Cook <keescook@...omium.org>,
        Dave Hansen <dave.hansen@...el.com>,
        Sean Christopherson <seanjc@...gle.com>,
        "x86@...nel.org" <x86@...nel.org>
Subject: Re: [PATCH v2] x86/mm: Do not verify W^X at boot up on ftrace
 trampolines

On Mon, 24 Oct 2022 16:58:58 -0700
Linus Torvalds <torvalds@...ux-foundation.org> wrote:

> On Mon, Oct 24, 2022 at 3:25 PM Steven Rostedt <rostedt@...dmis.org> wrote:
> >
> > From: "Steven Rostedt (Google)" <rostedt@...dmis.org>
> >
> > Adding on the kernel command line "ftrace=function" triggered:  
> 
> This one I *really* detest.
> 
> If we have to have a special case, make it just be the simple
> "system_state == SYSTEM_BOOTING", don't make it even nastier.
> 
> Special cases are bad. Making them these kinds of "this is
> super-magical and special" is even worse.
>

I was just trying to narrow down the one special case that allows the
one exception to get pass the security check. It's what they taught me in
security school. Only allow what you know is allowable and block everything
else.

But anyway, I'll just let anyone take the v1 patch. I'll add it to my tests
so that I can at least get my tests to finish.

-- Steve