linux-kernel - Re: [PATCH v1 0/3] module: Don't fail module loading when setting ro_after

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Z37PLciJqq5xMvTf@bombadil.infradead.org>
Date: Wed, 8 Jan 2025 11:17:01 -0800
From: Luis Chamberlain <mcgrof@...nel.org>
To: Kees Cook <kees@...nel.org>
Cc: Petr Pavlu <petr.pavlu@...e.com>,
	Christophe Leroy <christophe.leroy@...roup.eu>,
	Sami Tolvanen <samitolvanen@...gle.com>,
	Daniel Gomez <da.gomez@...sung.com>, linux-modules@...r.kernel.org,
	linux-kernel@...r.kernel.org, Thomas Gleixner <tglx@...utronix.de>,
	Mike Rapoport <rppt@...nel.org>
Subject: Re: [PATCH v1 0/3] module: Don't fail module loading when setting
 ro_after_init section RO failed

On Mon, Jan 06, 2025 at 04:13:29PM -0800, Kees Cook wrote:
> On Fri, Jan 03, 2025 at 05:13:32PM +0100, Petr Pavlu wrote:
> > On 12/5/24 20:46, Christophe Leroy wrote:
> > > This series reworks module loading to avoid leaving the module in a
> > > stale state when protecting ro_after_init section fails.
> > > 
> > > Once module init has succeded it is too late to cancel loading.
> 
> Is there at least a big WARN about the ro failing? That should let more
> sensitive system owners react to the situation if it looks like an
> active attack on memory protections.
> 
> (And maybe we should set a TAINT flag, but perhaps this is too specific
> a failure mode for that?)

I don't see a taint flag too far fetched in value. I think its a
sensible compromise, and may be useful for other future set_memory_*()
failures.

 Luis