linux-kernel - [PATCH v1 0/3] module: Don't fail module loading when setting ro_after

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <cover.1733427536.git.christophe.leroy@csgroup.eu>
Date: Thu,  5 Dec 2024 20:46:14 +0100
From: Christophe Leroy <christophe.leroy@...roup.eu>
To: Luis Chamberlain <mcgrof@...nel.org>,
	Petr Pavlu <petr.pavlu@...e.com>,
	Sami Tolvanen <samitolvanen@...gle.com>,
	Daniel Gomez <da.gomez@...sung.com>,
	Kees Cook <kees@...nel.org>,
	linux-modules@...r.kernel.org
Cc: Christophe Leroy <christophe.leroy@...roup.eu>,
	linux-kernel@...r.kernel.org,
	Thomas Gleixner <tglx@...utronix.de>
Subject: [PATCH v1 0/3] module: Don't fail module loading when setting ro_after_init section RO failed

This series reworks module loading to avoid leaving the module in a
stale state when protecting ro_after_init section fails.

Once module init has succeded it is too late to cancel loading.
If setting ro_after_init data section to read-only fails, all we can
do is to inform the user through a warning. This is what patch 2 does.

Then patch 3 tries to go a bit further by testing the ability to write
protect ro-after-init section prior to initialising the module.

Changes between RFC and v1:
- Patch 2: Fixed comment from Petr about __func__
- Patch 3: Expanded the commit message based on feedback from RFC series

Christophe Leroy (3):
  module: Split module_enable_rodata_ro()
  module: Don't fail module loading when setting ro_after_init section
    RO failed
  module: pre-test setting ro_after_init data read-only

 kernel/module/internal.h   |  3 ++-
 kernel/module/main.c       | 13 +++++++------
 kernel/module/strict_rwx.c | 16 ++++++++++++----
 3 files changed, 21 insertions(+), 11 deletions(-)

-- 
2.47.0