Re: [Ksummit-discuss] [TECH TOPIC] Kernel Hardening

From: Dan Carpenter <dan.carpenter@oracle.com>
To: Kees Cook <keescook@chromium.org>
Cc: Emily Ratliff <eratliff@linuxfoundation.org>,
	"ksummit-discuss@lists.linuxfoundation.org"
	<ksummit-discuss@lists.linuxfoundation.org>
Subject: Re: [Ksummit-discuss] [TECH TOPIC] Kernel Hardening
Date: Tue, 22 Sep 2015 15:24:09 +0300	[thread overview]
Message-ID: <20150922122409.GC4953@mwanda> (raw)
In-Reply-To: <CAGXu5j+XR7TJSgbTNYhCP0YhvvNwA5HtEL=xKCR9GUttzb06Uw@mail.gmail.com>

On Mon, Aug 24, 2015 at 09:35:50AM -0700, Kees Cook wrote:
> As an example, making the kernel code memory read-only means an
> attacker cannot just directly change the kernel's execution path when
> they use an arbitrary memory-writing flaw.

Part of the problem is that C defaults to writable and you have to
explicitly add a const if you want it read only.  Then when you are
reading the code and you see:

static struct uvc_format_desc uvc_fmts[] = {

You can't immediately tell if it is writeable because it needs to be or
because that's just the default.  We should make a new keyword that
means non constant then we could grep for structs which have a function
pointer and complain if they weren't specified as const or __writable.

Maybe there is a way to do this with GCC attributes but I have never
used them before and I couldn't immediately see how to do it.

regards,
dan carpenter