* [kernel-hardening] [PATCH v5 1/7] asm-generic: consolidate mark_rodata_ro()
2016-02-17 22:41 [kernel-hardening] [PATCH v5 0/7] introduce post-init read-only memory Kees Cook
@ 2016-02-17 22:41 ` Kees Cook
2016-02-19 14:38 ` [kernel-hardening] " Will Deacon
2016-02-17 22:41 ` [kernel-hardening] [PATCH v5 2/7] init: create cmdline param to disable readonly Kees Cook
` (5 subsequent siblings)
6 siblings, 1 reply; 12+ messages in thread
From: Kees Cook @ 2016-02-17 22:41 UTC (permalink / raw)
To: Ingo Molnar
Cc: Kees Cook, Russell King, Catalin Marinas, Will Deacon,
James E.J. Bottomley, David Brown, Andy Lutomirski,
H. Peter Anvin, Michael Ellerman, Mathias Krause,
Thomas Gleixner, x86, Arnd Bergmann, PaX Team, Emese Revfy,
kernel-hardening, linux-kernel, linux-arch
Instead of defining mark_rodata_ro() in each architecture, consolidate it.
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Russell King <linux@arm.linux.org.uk>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: "James E.J. Bottomley" <jejb@parisc-linux.org>
---
arch/arm/include/asm/cacheflush.h | 1 -
arch/arm64/include/asm/cacheflush.h | 4 ----
arch/parisc/include/asm/cacheflush.h | 4 ----
arch/x86/include/asm/cacheflush.h | 1 -
include/linux/init.h | 4 ++++
5 files changed, 4 insertions(+), 10 deletions(-)
diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
index d5525bfc7e3e..9156fc303afd 100644
--- a/arch/arm/include/asm/cacheflush.h
+++ b/arch/arm/include/asm/cacheflush.h
@@ -491,7 +491,6 @@ static inline int set_memory_nx(unsigned long addr, int numpages) { return 0; }
#endif
#ifdef CONFIG_DEBUG_RODATA
-void mark_rodata_ro(void);
void set_kernel_text_rw(void);
void set_kernel_text_ro(void);
#else
diff --git a/arch/arm64/include/asm/cacheflush.h b/arch/arm64/include/asm/cacheflush.h
index 7fc294c3bc5b..22dda613f9c9 100644
--- a/arch/arm64/include/asm/cacheflush.h
+++ b/arch/arm64/include/asm/cacheflush.h
@@ -156,8 +156,4 @@ int set_memory_rw(unsigned long addr, int numpages);
int set_memory_x(unsigned long addr, int numpages);
int set_memory_nx(unsigned long addr, int numpages);
-#ifdef CONFIG_DEBUG_RODATA
-void mark_rodata_ro(void);
-#endif
-
#endif
diff --git a/arch/parisc/include/asm/cacheflush.h b/arch/parisc/include/asm/cacheflush.h
index 845272ce9cc5..7bd69bd43a01 100644
--- a/arch/parisc/include/asm/cacheflush.h
+++ b/arch/parisc/include/asm/cacheflush.h
@@ -121,10 +121,6 @@ flush_anon_page(struct vm_area_struct *vma, struct page *page, unsigned long vma
}
}
-#ifdef CONFIG_DEBUG_RODATA
-void mark_rodata_ro(void);
-#endif
-
#include <asm/kmap_types.h>
#define ARCH_HAS_KMAP
diff --git a/arch/x86/include/asm/cacheflush.h b/arch/x86/include/asm/cacheflush.h
index e63aa38e85fb..c8cff75c5b21 100644
--- a/arch/x86/include/asm/cacheflush.h
+++ b/arch/x86/include/asm/cacheflush.h
@@ -92,7 +92,6 @@ void clflush_cache_range(void *addr, unsigned int size);
#define mmio_flush_range(addr, size) clflush_cache_range(addr, size)
#ifdef CONFIG_DEBUG_RODATA
-void mark_rodata_ro(void);
extern const int rodata_test_data;
extern int kernel_set_to_readonly;
void set_kernel_text_rw(void);
diff --git a/include/linux/init.h b/include/linux/init.h
index b449f378f995..aedb254abc37 100644
--- a/include/linux/init.h
+++ b/include/linux/init.h
@@ -142,6 +142,10 @@ void prepare_namespace(void);
void __init load_default_modules(void);
int __init init_rootfs(void);
+#ifdef CONFIG_DEBUG_RODATA
+void mark_rodata_ro(void);
+#endif
+
extern void (*late_time_init)(void);
extern bool initcall_debug;
--
2.6.3
^ permalink raw reply related [flat|nested] 12+ messages in thread* [kernel-hardening] Re: [PATCH v5 1/7] asm-generic: consolidate mark_rodata_ro()
2016-02-17 22:41 ` [kernel-hardening] [PATCH v5 1/7] asm-generic: consolidate mark_rodata_ro() Kees Cook
@ 2016-02-19 14:38 ` Will Deacon
0 siblings, 0 replies; 12+ messages in thread
From: Will Deacon @ 2016-02-19 14:38 UTC (permalink / raw)
To: Kees Cook
Cc: Ingo Molnar, Russell King, Catalin Marinas, James E.J. Bottomley,
David Brown, Andy Lutomirski, H. Peter Anvin, Michael Ellerman,
Mathias Krause, Thomas Gleixner, x86, Arnd Bergmann, PaX Team,
Emese Revfy, kernel-hardening, linux-kernel, linux-arch
On Wed, Feb 17, 2016 at 02:41:12PM -0800, Kees Cook wrote:
> Instead of defining mark_rodata_ro() in each architecture, consolidate it.
>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> Cc: Russell King <linux@arm.linux.org.uk>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: Will Deacon <will.deacon@arm.com>
> Cc: "James E.J. Bottomley" <jejb@parisc-linux.org>
> ---
> arch/arm/include/asm/cacheflush.h | 1 -
> arch/arm64/include/asm/cacheflush.h | 4 ----
> arch/parisc/include/asm/cacheflush.h | 4 ----
> arch/x86/include/asm/cacheflush.h | 1 -
> include/linux/init.h | 4 ++++
> 5 files changed, 4 insertions(+), 10 deletions(-)
If you need it:
Acked-by: Will Deacon <will.deacon@arm.com>
Will
^ permalink raw reply [flat|nested] 12+ messages in thread
* [kernel-hardening] [PATCH v5 2/7] init: create cmdline param to disable readonly
2016-02-17 22:41 [kernel-hardening] [PATCH v5 0/7] introduce post-init read-only memory Kees Cook
2016-02-17 22:41 ` [kernel-hardening] [PATCH v5 1/7] asm-generic: consolidate mark_rodata_ro() Kees Cook
@ 2016-02-17 22:41 ` Kees Cook
2016-02-17 22:41 ` [kernel-hardening] [PATCH v5 3/7] x86: make CONFIG_DEBUG_RODATA non-optional Kees Cook
` (4 subsequent siblings)
6 siblings, 0 replies; 12+ messages in thread
From: Kees Cook @ 2016-02-17 22:41 UTC (permalink / raw)
To: Ingo Molnar
Cc: Kees Cook, David Brown, Andy Lutomirski, H. Peter Anvin,
Michael Ellerman, Mathias Krause, Thomas Gleixner, x86,
Arnd Bergmann, PaX Team, Emese Revfy, kernel-hardening,
linux-kernel, linux-arch
It may be useful to debug writes to the readonly sections of memory,
so provide a cmdline "rodata=off" to allow for this. This can be
expanded in the future to support "log" and "write" modes, but that
will need to be architecture-specific.
Suggested-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
---
Documentation/kernel-parameters.txt | 4 ++++
init/main.c | 27 +++++++++++++++++++++++----
kernel/debug/kdb/kdb_bp.c | 4 +---
3 files changed, 28 insertions(+), 7 deletions(-)
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index e3a9b5863424..3fcbd7a80b27 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -3554,6 +3554,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
ro [KNL] Mount root device read-only on boot
+ rodata= [KNL]
+ on Mark read-only kernel memory as read-only (default).
+ off Leave read-only kernel memory writable for debugging.
+
root= [KNL] Root filesystem
See name_to_dev_t comment in init/do_mounts.c.
diff --git a/init/main.c b/init/main.c
index 5db3a3ab493f..bbc8214a0129 100644
--- a/init/main.c
+++ b/init/main.c
@@ -93,9 +93,6 @@ static int kernel_init(void *);
extern void init_IRQ(void);
extern void fork_init(void);
extern void radix_tree_init(void);
-#ifndef CONFIG_DEBUG_RODATA
-static inline void mark_rodata_ro(void) { }
-#endif
/*
* Debug helper: via this flag we know that we are in 'early bootup code'
@@ -923,6 +920,28 @@ static int try_to_run_init_process(const char *init_filename)
static noinline void __init kernel_init_freeable(void);
+#ifdef CONFIG_DEBUG_RODATA
+static bool rodata_enabled = true;
+static int __init set_debug_rodata(char *str)
+{
+ return strtobool(str, &rodata_enabled);
+}
+__setup("rodata=", set_debug_rodata);
+
+static void mark_readonly(void)
+{
+ if (rodata_enabled)
+ mark_rodata_ro();
+ else
+ pr_info("Kernel memory protection disabled.\n");
+}
+#else
+static inline void mark_readonly(void)
+{
+ pr_warn("This architecture does not have kernel memory protection.\n");
+}
+#endif
+
static int __ref kernel_init(void *unused)
{
int ret;
@@ -931,7 +950,7 @@ static int __ref kernel_init(void *unused)
/* need to finish all async __init code before freeing the memory */
async_synchronize_full();
free_initmem();
- mark_rodata_ro();
+ mark_readonly();
system_state = SYSTEM_RUNNING;
numa_default_policy();
diff --git a/kernel/debug/kdb/kdb_bp.c b/kernel/debug/kdb/kdb_bp.c
index e1dbf4a2c69e..90ff129c88a2 100644
--- a/kernel/debug/kdb/kdb_bp.c
+++ b/kernel/debug/kdb/kdb_bp.c
@@ -153,13 +153,11 @@ static int _kdb_bp_install(struct pt_regs *regs, kdb_bp_t *bp)
} else {
kdb_printf("%s: failed to set breakpoint at 0x%lx\n",
__func__, bp->bp_addr);
-#ifdef CONFIG_DEBUG_RODATA
if (!bp->bp_type) {
kdb_printf("Software breakpoints are unavailable.\n"
- " Change the kernel CONFIG_DEBUG_RODATA=n\n"
+ " Boot the kernel with rodata=off\n"
" OR use hw breaks: help bph\n");
}
-#endif
return 1;
}
return 0;
--
2.6.3
^ permalink raw reply related [flat|nested] 12+ messages in thread* [kernel-hardening] [PATCH v5 3/7] x86: make CONFIG_DEBUG_RODATA non-optional
2016-02-17 22:41 [kernel-hardening] [PATCH v5 0/7] introduce post-init read-only memory Kees Cook
2016-02-17 22:41 ` [kernel-hardening] [PATCH v5 1/7] asm-generic: consolidate mark_rodata_ro() Kees Cook
2016-02-17 22:41 ` [kernel-hardening] [PATCH v5 2/7] init: create cmdline param to disable readonly Kees Cook
@ 2016-02-17 22:41 ` Kees Cook
2016-02-17 22:41 ` [kernel-hardening] [PATCH v5 4/7] introduce post-init read-only memory Kees Cook
` (3 subsequent siblings)
6 siblings, 0 replies; 12+ messages in thread
From: Kees Cook @ 2016-02-17 22:41 UTC (permalink / raw)
To: Ingo Molnar
Cc: Kees Cook, David Brown, Andy Lutomirski, H. Peter Anvin,
Michael Ellerman, Mathias Krause, Thomas Gleixner, x86,
Arnd Bergmann, PaX Team, Emese Revfy, kernel-hardening,
linux-kernel, linux-arch
This removes the CONFIG_DEBUG_RODATA option and makes it always enabled.
Suggested-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/x86/Kconfig | 3 +++
arch/x86/Kconfig.debug | 18 +++---------------
arch/x86/include/asm/cacheflush.h | 5 -----
arch/x86/include/asm/kvm_para.h | 7 -------
arch/x86/include/asm/sections.h | 2 +-
arch/x86/kernel/ftrace.c | 6 +++---
arch/x86/kernel/kgdb.c | 8 ++------
arch/x86/kernel/test_nx.c | 2 --
arch/x86/kernel/test_rodata.c | 2 +-
arch/x86/kernel/vmlinux.lds.S | 25 +++++++++++--------------
arch/x86/mm/init_32.c | 3 ---
arch/x86/mm/init_64.c | 3 ---
arch/x86/mm/pageattr.c | 2 +-
13 files changed, 25 insertions(+), 61 deletions(-)
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index e8f82cc760f7..f1146060d78c 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -305,6 +305,9 @@ config ARCH_SUPPORTS_UPROBES
config FIX_EARLYCON_MEM
def_bool y
+config DEBUG_RODATA
+ def_bool y
+
config PGTABLE_LEVELS
int
default 4 if X86_64
diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
index 68a2d1f0a683..67eec55093a5 100644
--- a/arch/x86/Kconfig.debug
+++ b/arch/x86/Kconfig.debug
@@ -74,28 +74,16 @@ config EFI_PGT_DUMP
issues with the mapping of the EFI runtime regions into that
table.
-config DEBUG_RODATA
- bool "Write protect kernel read-only data structures"
- default y
- depends on DEBUG_KERNEL
- ---help---
- Mark the kernel read-only data as write-protected in the pagetables,
- in order to catch accidental (and incorrect) writes to such const
- data. This is recommended so that we can catch kernel bugs sooner.
- If in doubt, say "Y".
-
config DEBUG_RODATA_TEST
- bool "Testcase for the DEBUG_RODATA feature"
- depends on DEBUG_RODATA
+ bool "Testcase for the marking rodata read-only"
default y
---help---
- This option enables a testcase for the DEBUG_RODATA
- feature as well as for the change_page_attr() infrastructure.
+ This option enables a testcase for the setting rodata read-only
+ as well as for the change_page_attr() infrastructure.
If in doubt, say "N"
config DEBUG_WX
bool "Warn on W+X mappings at boot"
- depends on DEBUG_RODATA
select X86_PTDUMP_CORE
---help---
Generate a warning if any W+X mappings are found at boot.
diff --git a/arch/x86/include/asm/cacheflush.h b/arch/x86/include/asm/cacheflush.h
index c8cff75c5b21..61518cf79437 100644
--- a/arch/x86/include/asm/cacheflush.h
+++ b/arch/x86/include/asm/cacheflush.h
@@ -91,15 +91,10 @@ void clflush_cache_range(void *addr, unsigned int size);
#define mmio_flush_range(addr, size) clflush_cache_range(addr, size)
-#ifdef CONFIG_DEBUG_RODATA
extern const int rodata_test_data;
extern int kernel_set_to_readonly;
void set_kernel_text_rw(void);
void set_kernel_text_ro(void);
-#else
-static inline void set_kernel_text_rw(void) { }
-static inline void set_kernel_text_ro(void) { }
-#endif
#ifdef CONFIG_DEBUG_RODATA_TEST
int rodata_test(void);
diff --git a/arch/x86/include/asm/kvm_para.h b/arch/x86/include/asm/kvm_para.h
index c1adf33fdd0d..bc62e7cbf1b1 100644
--- a/arch/x86/include/asm/kvm_para.h
+++ b/arch/x86/include/asm/kvm_para.h
@@ -17,15 +17,8 @@ static inline bool kvm_check_and_clear_guest_paused(void)
}
#endif /* CONFIG_KVM_GUEST */
-#ifdef CONFIG_DEBUG_RODATA
#define KVM_HYPERCALL \
ALTERNATIVE(".byte 0x0f,0x01,0xc1", ".byte 0x0f,0x01,0xd9", X86_FEATURE_VMMCALL)
-#else
-/* On AMD processors, vmcall will generate a trap that we will
- * then rewrite to the appropriate instruction.
- */
-#define KVM_HYPERCALL ".byte 0x0f,0x01,0xc1"
-#endif
/* For KVM hypercalls, a three-byte sequence of either the vmcall or the vmmcall
* instruction. The hypervisor may replace it with something else but only the
diff --git a/arch/x86/include/asm/sections.h b/arch/x86/include/asm/sections.h
index 0a5242428659..13b6cdd0af57 100644
--- a/arch/x86/include/asm/sections.h
+++ b/arch/x86/include/asm/sections.h
@@ -7,7 +7,7 @@
extern char __brk_base[], __brk_limit[];
extern struct exception_table_entry __stop___ex_table[];
-#if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
+#if defined(CONFIG_X86_64)
extern char __end_rodata_hpage_align[];
#endif
diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
index 29408d6d6626..05c9e3f5b6d7 100644
--- a/arch/x86/kernel/ftrace.c
+++ b/arch/x86/kernel/ftrace.c
@@ -81,9 +81,9 @@ within(unsigned long addr, unsigned long start, unsigned long end)
static unsigned long text_ip_addr(unsigned long ip)
{
/*
- * On x86_64, kernel text mappings are mapped read-only with
- * CONFIG_DEBUG_RODATA. So we use the kernel identity mapping instead
- * of the kernel text mapping to modify the kernel text.
+ * On x86_64, kernel text mappings are mapped read-only, so we use
+ * the kernel identity mapping instead of the kernel text mapping
+ * to modify the kernel text.
*
* For 32bit kernels, these mappings are same and we can use
* kernel identity mapping to modify code.
diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
index 44256a62702b..ed15cd486d06 100644
--- a/arch/x86/kernel/kgdb.c
+++ b/arch/x86/kernel/kgdb.c
@@ -750,9 +750,7 @@ void kgdb_arch_set_pc(struct pt_regs *regs, unsigned long ip)
int kgdb_arch_set_breakpoint(struct kgdb_bkpt *bpt)
{
int err;
-#ifdef CONFIG_DEBUG_RODATA
char opc[BREAK_INSTR_SIZE];
-#endif /* CONFIG_DEBUG_RODATA */
bpt->type = BP_BREAKPOINT;
err = probe_kernel_read(bpt->saved_instr, (char *)bpt->bpt_addr,
@@ -761,7 +759,6 @@ int kgdb_arch_set_breakpoint(struct kgdb_bkpt *bpt)
return err;
err = probe_kernel_write((char *)bpt->bpt_addr,
arch_kgdb_ops.gdb_bpt_instr, BREAK_INSTR_SIZE);
-#ifdef CONFIG_DEBUG_RODATA
if (!err)
return err;
/*
@@ -778,13 +775,12 @@ int kgdb_arch_set_breakpoint(struct kgdb_bkpt *bpt)
if (memcmp(opc, arch_kgdb_ops.gdb_bpt_instr, BREAK_INSTR_SIZE))
return -EINVAL;
bpt->type = BP_POKE_BREAKPOINT;
-#endif /* CONFIG_DEBUG_RODATA */
+
return err;
}
int kgdb_arch_remove_breakpoint(struct kgdb_bkpt *bpt)
{
-#ifdef CONFIG_DEBUG_RODATA
int err;
char opc[BREAK_INSTR_SIZE];
@@ -801,8 +797,8 @@ int kgdb_arch_remove_breakpoint(struct kgdb_bkpt *bpt)
if (err || memcmp(opc, bpt->saved_instr, BREAK_INSTR_SIZE))
goto knl_write;
return err;
+
knl_write:
-#endif /* CONFIG_DEBUG_RODATA */
return probe_kernel_write((char *)bpt->bpt_addr,
(char *)bpt->saved_instr, BREAK_INSTR_SIZE);
}
diff --git a/arch/x86/kernel/test_nx.c b/arch/x86/kernel/test_nx.c
index 3f92ce07e525..27538f183c3b 100644
--- a/arch/x86/kernel/test_nx.c
+++ b/arch/x86/kernel/test_nx.c
@@ -142,7 +142,6 @@ static int test_NX(void)
* by the error message
*/
-#ifdef CONFIG_DEBUG_RODATA
/* Test 3: Check if the .rodata section is executable */
if (rodata_test_data != 0xC3) {
printk(KERN_ERR "test_nx: .rodata marker has invalid value\n");
@@ -151,7 +150,6 @@ static int test_NX(void)
printk(KERN_ERR "test_nx: .rodata section is executable\n");
ret = -ENODEV;
}
-#endif
#if 0
/* Test 4: Check if the .data section of a module is executable */
diff --git a/arch/x86/kernel/test_rodata.c b/arch/x86/kernel/test_rodata.c
index 5ecbfe5099da..cb4a01b41e27 100644
--- a/arch/x86/kernel/test_rodata.c
+++ b/arch/x86/kernel/test_rodata.c
@@ -76,5 +76,5 @@ int rodata_test(void)
}
MODULE_LICENSE("GPL");
-MODULE_DESCRIPTION("Testcase for the DEBUG_RODATA infrastructure");
+MODULE_DESCRIPTION("Testcase for marking rodata as read-only");
MODULE_AUTHOR("Arjan van de Ven <arjan@linux.intel.com>");
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 04afe9b7e52a..afdfcc5d93bd 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -41,29 +41,28 @@ ENTRY(phys_startup_64)
jiffies_64 = jiffies;
#endif
-#if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
+#if defined(CONFIG_X86_64)
/*
- * On 64-bit, align RODATA to 2MB so that even with CONFIG_DEBUG_RODATA
- * we retain large page mappings for boundaries spanning kernel text, rodata
- * and data sections.
+ * On 64-bit, align RODATA to 2MB so we retain large page mappings for
+ * boundaries spanning kernel text, rodata and data sections.
*
* However, kernel identity mappings will have different RWX permissions
* to the pages mapping to text and to the pages padding (which are freed) the
* text section. Hence kernel identity mappings will be broken to smaller
* pages. For 64-bit, kernel text and kernel identity mappings are different,
- * so we can enable protection checks that come with CONFIG_DEBUG_RODATA,
- * as well as retain 2MB large page mappings for kernel text.
+ * so we can enable protection checks as well as retain 2MB large page
+ * mappings for kernel text.
*/
-#define X64_ALIGN_DEBUG_RODATA_BEGIN . = ALIGN(HPAGE_SIZE);
+#define X64_ALIGN_RODATA_BEGIN . = ALIGN(HPAGE_SIZE);
-#define X64_ALIGN_DEBUG_RODATA_END \
+#define X64_ALIGN_RODATA_END \
. = ALIGN(HPAGE_SIZE); \
__end_rodata_hpage_align = .;
#else
-#define X64_ALIGN_DEBUG_RODATA_BEGIN
-#define X64_ALIGN_DEBUG_RODATA_END
+#define X64_ALIGN_RODATA_BEGIN
+#define X64_ALIGN_RODATA_END
#endif
@@ -112,13 +111,11 @@ SECTIONS
EXCEPTION_TABLE(16) :text = 0x9090
-#if defined(CONFIG_DEBUG_RODATA)
/* .text should occupy whole number of pages */
. = ALIGN(PAGE_SIZE);
-#endif
- X64_ALIGN_DEBUG_RODATA_BEGIN
+ X64_ALIGN_RODATA_BEGIN
RO_DATA(PAGE_SIZE)
- X64_ALIGN_DEBUG_RODATA_END
+ X64_ALIGN_RODATA_END
/* Data */
.data : AT(ADDR(.data) - LOAD_OFFSET) {
diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
index a4bb1c7ab65e..bd7a9b9e2e14 100644
--- a/arch/x86/mm/init_32.c
+++ b/arch/x86/mm/init_32.c
@@ -868,7 +868,6 @@ static noinline int do_test_wp_bit(void)
return flag;
}
-#ifdef CONFIG_DEBUG_RODATA
const int rodata_test_data = 0xC3;
EXPORT_SYMBOL_GPL(rodata_test_data);
@@ -957,5 +956,3 @@ void mark_rodata_ro(void)
if (__supported_pte_mask & _PAGE_NX)
debug_checkwx();
}
-#endif
-
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 9686535edfb5..214afda97911 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -1075,7 +1075,6 @@ void __init mem_init(void)
mem_init_print_info(NULL);
}
-#ifdef CONFIG_DEBUG_RODATA
const int rodata_test_data = 0xC3;
EXPORT_SYMBOL_GPL(rodata_test_data);
@@ -1167,8 +1166,6 @@ void mark_rodata_ro(void)
debug_checkwx();
}
-#endif
-
int kern_addr_valid(unsigned long addr)
{
unsigned long above = ((long)addr) >> __VIRTUAL_MASK_SHIFT;
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index f6b206fb6403..926f804d7e7e 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -277,7 +277,7 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
__pa_symbol(__end_rodata) >> PAGE_SHIFT))
pgprot_val(forbidden) |= _PAGE_RW;
-#if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
+#if defined(CONFIG_X86_64)
/*
* Once the kernel maps the text as RO (kernel_set_to_readonly is set),
* kernel text mappings for the large page aligned text, rodata sections
--
2.6.3
^ permalink raw reply related [flat|nested] 12+ messages in thread* [kernel-hardening] [PATCH v5 4/7] introduce post-init read-only memory
2016-02-17 22:41 [kernel-hardening] [PATCH v5 0/7] introduce post-init read-only memory Kees Cook
` (2 preceding siblings ...)
2016-02-17 22:41 ` [kernel-hardening] [PATCH v5 3/7] x86: make CONFIG_DEBUG_RODATA non-optional Kees Cook
@ 2016-02-17 22:41 ` Kees Cook
2016-03-07 13:00 ` [kernel-hardening] " Christian Borntraeger
2016-02-17 22:41 ` [kernel-hardening] [PATCH v5 5/7] lkdtm: verify that __ro_after_init works correctly Kees Cook
` (2 subsequent siblings)
6 siblings, 1 reply; 12+ messages in thread
From: Kees Cook @ 2016-02-17 22:41 UTC (permalink / raw)
To: Ingo Molnar
Cc: Kees Cook, David Brown, Andy Lutomirski, H. Peter Anvin,
Michael Ellerman, Mathias Krause, Thomas Gleixner, x86,
Arnd Bergmann, PaX Team, Emese Revfy, kernel-hardening,
linux-kernel, linux-arch
One of the easiest ways to protect the kernel from attack is to reduce
the internal attack surface exposed when a "write" flaw is available. By
making as much of the kernel read-only as possible, we reduce the
attack surface.
Many things are written to only during __init, and never changed
again. These cannot be made "const" since the compiler will do the wrong
thing (we do actually need to write to them). Instead, move these items
into a memory region that will be made read-only during mark_rodata_ro()
which happens after all kernel __init code has finished.
This introduces __ro_after_init as a way to mark such memory, and adds
some documentation about the existing __read_mostly marking.
Based on work by PaX Team and Brad Spengler.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/parisc/include/asm/cache.h | 3 +++
include/asm-generic/vmlinux.lds.h | 1 +
include/linux/cache.h | 14 ++++++++++++++
3 files changed, 18 insertions(+)
diff --git a/arch/parisc/include/asm/cache.h b/arch/parisc/include/asm/cache.h
index 3d0e17bcc8e9..df0f52bd18b4 100644
--- a/arch/parisc/include/asm/cache.h
+++ b/arch/parisc/include/asm/cache.h
@@ -22,6 +22,9 @@
#define __read_mostly __attribute__((__section__(".data..read_mostly")))
+/* Read-only memory is marked before mark_rodata_ro() is called. */
+#define __ro_after_init __read_mostly
+
void parisc_cache_init(void); /* initializes cache-flushing */
void disable_sr_hashing_asm(int); /* low level support for above */
void disable_sr_hashing(void); /* turns off space register hashing */
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index e9a81a6a109f..8f5a12ab2f2b 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -255,6 +255,7 @@
.rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
VMLINUX_SYMBOL(__start_rodata) = .; \
*(.rodata) *(.rodata.*) \
+ *(.data..ro_after_init) /* Read only after init */ \
*(__vermagic) /* Kernel version magic */ \
. = ALIGN(8); \
VMLINUX_SYMBOL(__start___tracepoints_ptrs) = .; \
diff --git a/include/linux/cache.h b/include/linux/cache.h
index 17e7e82d2aa7..1be04f8c563a 100644
--- a/include/linux/cache.h
+++ b/include/linux/cache.h
@@ -12,10 +12,24 @@
#define SMP_CACHE_BYTES L1_CACHE_BYTES
#endif
+/*
+ * __read_mostly is used to keep rarely changing variables out of frequently
+ * updated cachelines. If an architecture doesn't support it, ignore the
+ * hint.
+ */
#ifndef __read_mostly
#define __read_mostly
#endif
+/*
+ * __ro_after_init is used to mark things that are read-only after init (i.e.
+ * after mark_rodata_ro() has been called). These are effectively read-only,
+ * but may get written to during init, so can't live in .rodata (via "const").
+ */
+#ifndef __ro_after_init
+#define __ro_after_init __attribute__((__section__(".data..ro_after_init")))
+#endif
+
#ifndef ____cacheline_aligned
#define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
#endif
--
2.6.3
^ permalink raw reply related [flat|nested] 12+ messages in thread* [kernel-hardening] Re: [PATCH v5 4/7] introduce post-init read-only memory
2016-02-17 22:41 ` [kernel-hardening] [PATCH v5 4/7] introduce post-init read-only memory Kees Cook
@ 2016-03-07 13:00 ` Christian Borntraeger
2016-03-08 0:16 ` Kees Cook
0 siblings, 1 reply; 12+ messages in thread
From: Christian Borntraeger @ 2016-03-07 13:00 UTC (permalink / raw)
To: Kees Cook, Ingo Molnar
Cc: David Brown, Andy Lutomirski, H. Peter Anvin, Michael Ellerman,
Mathias Krause, Thomas Gleixner, x86, Arnd Bergmann, PaX Team,
Emese Revfy, kernel-hardening, linux-kernel, linux-arch,
linux-s390, Heiko Carstens, Martin Schwidefsky
On 02/17/2016 11:41 PM, Kees Cook wrote:
> One of the easiest ways to protect the kernel from attack is to reduce
> the internal attack surface exposed when a "write" flaw is available. By
> making as much of the kernel read-only as possible, we reduce the
> attack surface.
>
> Many things are written to only during __init, and never changed
> again. These cannot be made "const" since the compiler will do the wrong
> thing (we do actually need to write to them). Instead, move these items
> into a memory region that will be made read-only during mark_rodata_ro()
> which happens after all kernel __init code has finished.
>
> This introduces __ro_after_init as a way to mark such memory, and adds
> some documentation about the existing __read_mostly marking.
>
> Based on work by PaX Team and Brad Spengler.
This seems to crash in the lkdtm module on s390, if the module
is compiled in.
[ 0.360571] Unable to handle kernel pointer dereference in virtual kernel address space
[ 0.360574] Failing address: 0000000000996000 TEID: 0000000000996407
[ 0.360575] Fault in home space mode while using kernel ASCE.
[ 0.360577] AS:0000000000cac007 R3:000000003ffd1007 S:0000000000901600
[ 0.360665] Oops: 0004 ilc:3 [#1] SMP
[ 0.360668] Modules linked in:
[ 0.360674] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.5.0-rc6-next-20160304+ #165
[ 0.360676] task: 000000003de40000 ti: 000000003de48000 task.ti: 000000003de48000
[ 0.360678] Krnl PSW : 0704d00180000000 0000000000c480e8 (lkdtm_module_init+0x28/0x278)
[ 0.360680] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 RI:0 EA:3
Krnl GPRS: ffffffffffffffee 0000000055aa55aa 00000000016503a0 00000000000004ef
[ 0.360682] 00000000001001ca 00000000000004f0 0000000000c93370 0000000000000000
[ 0.360683] 0000000000c57008 000000000000006a 0000000000000002 0000000000000000
[ 0.360685] 0000000000c480c0 0000000001650380 000000003de4bd88 000000003de4bd28
[ 0.360698] Krnl Code: 0000000000c480d8: a51b00aa oill %r1,170
0000000000c480dc: e3f0ffa0ff71 lay %r15,-96(%r15)
#0000000000c480e2: e3e0f0980024 stg %r14,152(%r15)
>0000000000c480e8: c41bffea76c8 stgrl %r1,996e78
0000000000c480ee: c020ffe95e5c larl %r2,973da6
0000000000c480f4: a7390000 lghi %r3,0
0000000000c480f8: c0d0ffdee974 larl %r13,8253e0
0000000000c480fe: a7c90009 lghi %r12,9
[ 0.360710] Call Trace:
[ 0.360713] ([<000000003de4be28>] 0x3de4be28)
[ 0.360718] ([<00000000001001da>] do_one_initcall+0xa2/0x1b0)
[ 0.360724] ([<0000000000c0dcf4>] kernel_init_freeable+0x1e4/0x298)
[ 0.360729] ([<00000000007b3cda>] kernel_init+0x2a/0x128)
[ 0.360731] ([<00000000007bcc8e>] kernel_thread_starter+0x6/0xc)
[ 0.360733] ([<00000000007bcc88>] kernel_thread_starter+0x0/0xc)
[ 0.360733] Last Breaking-Event-Address:
[ 0.360735] [<00000000001001d8>] do_one_initcall+0xa0/0x1b0
[ 0.360735]
[ 0.360738] Kernel panic - not syncing: Fatal exception: panic_on_oops
The code in question is
/* Make sure we can write to __ro_after_init values during __init */
ro_after_init |= 0xAA;
The problem is that s390 does not call mark_rodata_ro, instead sections are
marked read-only earlier. Maybe we should change that. Heiko, Martin?
>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> arch/parisc/include/asm/cache.h | 3 +++
> include/asm-generic/vmlinux.lds.h | 1 +
> include/linux/cache.h | 14 ++++++++++++++
> 3 files changed, 18 insertions(+)
>
> diff --git a/arch/parisc/include/asm/cache.h b/arch/parisc/include/asm/cache.h
> index 3d0e17bcc8e9..df0f52bd18b4 100644
> --- a/arch/parisc/include/asm/cache.h
> +++ b/arch/parisc/include/asm/cache.h
> @@ -22,6 +22,9 @@
>
> #define __read_mostly __attribute__((__section__(".data..read_mostly")))
>
> +/* Read-only memory is marked before mark_rodata_ro() is called. */
> +#define __ro_after_init __read_mostly
> +
> void parisc_cache_init(void); /* initializes cache-flushing */
> void disable_sr_hashing_asm(int); /* low level support for above */
> void disable_sr_hashing(void); /* turns off space register hashing */
> diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
> index e9a81a6a109f..8f5a12ab2f2b 100644
> --- a/include/asm-generic/vmlinux.lds.h
> +++ b/include/asm-generic/vmlinux.lds.h
> @@ -255,6 +255,7 @@
> .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
> VMLINUX_SYMBOL(__start_rodata) = .; \
> *(.rodata) *(.rodata.*) \
> + *(.data..ro_after_init) /* Read only after init */ \
> *(__vermagic) /* Kernel version magic */ \
> . = ALIGN(8); \
> VMLINUX_SYMBOL(__start___tracepoints_ptrs) = .; \
> diff --git a/include/linux/cache.h b/include/linux/cache.h
> index 17e7e82d2aa7..1be04f8c563a 100644
> --- a/include/linux/cache.h
> +++ b/include/linux/cache.h
> @@ -12,10 +12,24 @@
> #define SMP_CACHE_BYTES L1_CACHE_BYTES
> #endif
>
> +/*
> + * __read_mostly is used to keep rarely changing variables out of frequently
> + * updated cachelines. If an architecture doesn't support it, ignore the
> + * hint.
> + */
> #ifndef __read_mostly
> #define __read_mostly
> #endif
>
> +/*
> + * __ro_after_init is used to mark things that are read-only after init (i.e.
> + * after mark_rodata_ro() has been called). These are effectively read-only,
> + * but may get written to during init, so can't live in .rodata (via "const").
> + */
> +#ifndef __ro_after_init
> +#define __ro_after_init __attribute__((__section__(".data..ro_after_init")))
> +#endif
> +
> #ifndef ____cacheline_aligned
> #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
> #endif
>
^ permalink raw reply [flat|nested] 12+ messages in thread* [kernel-hardening] Re: [PATCH v5 4/7] introduce post-init read-only memory
2016-03-07 13:00 ` [kernel-hardening] " Christian Borntraeger
@ 2016-03-08 0:16 ` Kees Cook
2016-03-08 0:23 ` Andy Lutomirski
0 siblings, 1 reply; 12+ messages in thread
From: Kees Cook @ 2016-03-08 0:16 UTC (permalink / raw)
To: Christian Borntraeger
Cc: Ingo Molnar, David Brown, Andy Lutomirski, H. Peter Anvin,
Michael Ellerman, Mathias Krause, Thomas Gleixner, x86,
Arnd Bergmann, PaX Team, Emese Revfy, kernel-hardening, LKML,
linux-arch, linux-s390, Heiko Carstens, Martin Schwidefsky
On Mon, Mar 7, 2016 at 5:00 AM, Christian Borntraeger
<borntraeger@de.ibm.com> wrote:
> On 02/17/2016 11:41 PM, Kees Cook wrote:
>> One of the easiest ways to protect the kernel from attack is to reduce
>> the internal attack surface exposed when a "write" flaw is available. By
>> making as much of the kernel read-only as possible, we reduce the
>> attack surface.
>>
>> Many things are written to only during __init, and never changed
>> again. These cannot be made "const" since the compiler will do the wrong
>> thing (we do actually need to write to them). Instead, move these items
>> into a memory region that will be made read-only during mark_rodata_ro()
>> which happens after all kernel __init code has finished.
>>
>> This introduces __ro_after_init as a way to mark such memory, and adds
>> some documentation about the existing __read_mostly marking.
>>
>> Based on work by PaX Team and Brad Spengler.
>
> This seems to crash in the lkdtm module on s390, if the module
> is compiled in.
>
> [ 0.360571] Unable to handle kernel pointer dereference in virtual kernel address space
> [ 0.360574] Failing address: 0000000000996000 TEID: 0000000000996407
> [ 0.360575] Fault in home space mode while using kernel ASCE.
> [ 0.360577] AS:0000000000cac007 R3:000000003ffd1007 S:0000000000901600
> [ 0.360665] Oops: 0004 ilc:3 [#1] SMP
> [ 0.360668] Modules linked in:
> [ 0.360674] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.5.0-rc6-next-20160304+ #165
> [ 0.360676] task: 000000003de40000 ti: 000000003de48000 task.ti: 000000003de48000
> [ 0.360678] Krnl PSW : 0704d00180000000 0000000000c480e8 (lkdtm_module_init+0x28/0x278)
> [ 0.360680] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 RI:0 EA:3
> Krnl GPRS: ffffffffffffffee 0000000055aa55aa 00000000016503a0 00000000000004ef
> [ 0.360682] 00000000001001ca 00000000000004f0 0000000000c93370 0000000000000000
> [ 0.360683] 0000000000c57008 000000000000006a 0000000000000002 0000000000000000
> [ 0.360685] 0000000000c480c0 0000000001650380 000000003de4bd88 000000003de4bd28
> [ 0.360698] Krnl Code: 0000000000c480d8: a51b00aa oill %r1,170
> 0000000000c480dc: e3f0ffa0ff71 lay %r15,-96(%r15)
> #0000000000c480e2: e3e0f0980024 stg %r14,152(%r15)
> >0000000000c480e8: c41bffea76c8 stgrl %r1,996e78
> 0000000000c480ee: c020ffe95e5c larl %r2,973da6
> 0000000000c480f4: a7390000 lghi %r3,0
> 0000000000c480f8: c0d0ffdee974 larl %r13,8253e0
> 0000000000c480fe: a7c90009 lghi %r12,9
> [ 0.360710] Call Trace:
> [ 0.360713] ([<000000003de4be28>] 0x3de4be28)
> [ 0.360718] ([<00000000001001da>] do_one_initcall+0xa2/0x1b0)
> [ 0.360724] ([<0000000000c0dcf4>] kernel_init_freeable+0x1e4/0x298)
> [ 0.360729] ([<00000000007b3cda>] kernel_init+0x2a/0x128)
> [ 0.360731] ([<00000000007bcc8e>] kernel_thread_starter+0x6/0xc)
> [ 0.360733] ([<00000000007bcc88>] kernel_thread_starter+0x0/0xc)
> [ 0.360733] Last Breaking-Event-Address:
> [ 0.360735] [<00000000001001d8>] do_one_initcall+0xa0/0x1b0
> [ 0.360735]
> [ 0.360738] Kernel panic - not syncing: Fatal exception: panic_on_oops
>
>
> The code in question is
> /* Make sure we can write to __ro_after_init values during __init */
> ro_after_init |= 0xAA;
>
>
> The problem is that s390 does not call mark_rodata_ro, instead sections are
> marked read-only earlier. Maybe we should change that. Heiko, Martin?
Since you've got rodata starting life as rodata, perhaps s390 could
use a different section for __ro_after_init and only mark that section
as RO during mark_rodata_ro()? It'd be nice to have that level of
granularity, actually.
I'll send an utterly untested patch... :P
-Kees
>
>>
>> Signed-off-by: Kees Cook <keescook@chromium.org>
>> ---
>> arch/parisc/include/asm/cache.h | 3 +++
>> include/asm-generic/vmlinux.lds.h | 1 +
>> include/linux/cache.h | 14 ++++++++++++++
>> 3 files changed, 18 insertions(+)
>>
>> diff --git a/arch/parisc/include/asm/cache.h b/arch/parisc/include/asm/cache.h
>> index 3d0e17bcc8e9..df0f52bd18b4 100644
>> --- a/arch/parisc/include/asm/cache.h
>> +++ b/arch/parisc/include/asm/cache.h
>> @@ -22,6 +22,9 @@
>>
>> #define __read_mostly __attribute__((__section__(".data..read_mostly")))
>>
>> +/* Read-only memory is marked before mark_rodata_ro() is called. */
>> +#define __ro_after_init __read_mostly
>> +
>> void parisc_cache_init(void); /* initializes cache-flushing */
>> void disable_sr_hashing_asm(int); /* low level support for above */
>> void disable_sr_hashing(void); /* turns off space register hashing */
>> diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
>> index e9a81a6a109f..8f5a12ab2f2b 100644
>> --- a/include/asm-generic/vmlinux.lds.h
>> +++ b/include/asm-generic/vmlinux.lds.h
>> @@ -255,6 +255,7 @@
>> .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
>> VMLINUX_SYMBOL(__start_rodata) = .; \
>> *(.rodata) *(.rodata.*) \
>> + *(.data..ro_after_init) /* Read only after init */ \
>> *(__vermagic) /* Kernel version magic */ \
>> . = ALIGN(8); \
>> VMLINUX_SYMBOL(__start___tracepoints_ptrs) = .; \
>> diff --git a/include/linux/cache.h b/include/linux/cache.h
>> index 17e7e82d2aa7..1be04f8c563a 100644
>> --- a/include/linux/cache.h
>> +++ b/include/linux/cache.h
>> @@ -12,10 +12,24 @@
>> #define SMP_CACHE_BYTES L1_CACHE_BYTES
>> #endif
>>
>> +/*
>> + * __read_mostly is used to keep rarely changing variables out of frequently
>> + * updated cachelines. If an architecture doesn't support it, ignore the
>> + * hint.
>> + */
>> #ifndef __read_mostly
>> #define __read_mostly
>> #endif
>>
>> +/*
>> + * __ro_after_init is used to mark things that are read-only after init (i.e.
>> + * after mark_rodata_ro() has been called). These are effectively read-only,
>> + * but may get written to during init, so can't live in .rodata (via "const").
>> + */
>> +#ifndef __ro_after_init
>> +#define __ro_after_init __attribute__((__section__(".data..ro_after_init")))
>> +#endif
>> +
>> #ifndef ____cacheline_aligned
>> #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
>> #endif
>>
>
--
Kees Cook
Chrome OS & Brillo Security
^ permalink raw reply [flat|nested] 12+ messages in thread* [kernel-hardening] Re: [PATCH v5 4/7] introduce post-init read-only memory
2016-03-08 0:16 ` Kees Cook
@ 2016-03-08 0:23 ` Andy Lutomirski
0 siblings, 0 replies; 12+ messages in thread
From: Andy Lutomirski @ 2016-03-08 0:23 UTC (permalink / raw)
To: Kees Cook
Cc: Christian Borntraeger, Ingo Molnar, David Brown, H. Peter Anvin,
Michael Ellerman, Mathias Krause, Thomas Gleixner, x86,
Arnd Bergmann, PaX Team, Emese Revfy, kernel-hardening, LKML,
linux-arch, linux-s390, Heiko Carstens, Martin Schwidefsky
On Mon, Mar 7, 2016 at 4:16 PM, Kees Cook <keescook@chromium.org> wrote:
> On Mon, Mar 7, 2016 at 5:00 AM, Christian Borntraeger
> <borntraeger@de.ibm.com> wrote:
>> On 02/17/2016 11:41 PM, Kees Cook wrote:
>>> One of the easiest ways to protect the kernel from attack is to reduce
>>> the internal attack surface exposed when a "write" flaw is available. By
>>> making as much of the kernel read-only as possible, we reduce the
>>> attack surface.
>>>
>>> Many things are written to only during __init, and never changed
>>> again. These cannot be made "const" since the compiler will do the wrong
>>> thing (we do actually need to write to them). Instead, move these items
>>> into a memory region that will be made read-only during mark_rodata_ro()
>>> which happens after all kernel __init code has finished.
>>>
>>> This introduces __ro_after_init as a way to mark such memory, and adds
>>> some documentation about the existing __read_mostly marking.
>>>
>>> Based on work by PaX Team and Brad Spengler.
>>
>> This seems to crash in the lkdtm module on s390, if the module
>> is compiled in.
>>
>> [ 0.360571] Unable to handle kernel pointer dereference in virtual kernel address space
>> [ 0.360574] Failing address: 0000000000996000 TEID: 0000000000996407
>> [ 0.360575] Fault in home space mode while using kernel ASCE.
>> [ 0.360577] AS:0000000000cac007 R3:000000003ffd1007 S:0000000000901600
>> [ 0.360665] Oops: 0004 ilc:3 [#1] SMP
>> [ 0.360668] Modules linked in:
>> [ 0.360674] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.5.0-rc6-next-20160304+ #165
>> [ 0.360676] task: 000000003de40000 ti: 000000003de48000 task.ti: 000000003de48000
>> [ 0.360678] Krnl PSW : 0704d00180000000 0000000000c480e8 (lkdtm_module_init+0x28/0x278)
>> [ 0.360680] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 RI:0 EA:3
>> Krnl GPRS: ffffffffffffffee 0000000055aa55aa 00000000016503a0 00000000000004ef
>> [ 0.360682] 00000000001001ca 00000000000004f0 0000000000c93370 0000000000000000
>> [ 0.360683] 0000000000c57008 000000000000006a 0000000000000002 0000000000000000
>> [ 0.360685] 0000000000c480c0 0000000001650380 000000003de4bd88 000000003de4bd28
>> [ 0.360698] Krnl Code: 0000000000c480d8: a51b00aa oill %r1,170
>> 0000000000c480dc: e3f0ffa0ff71 lay %r15,-96(%r15)
>> #0000000000c480e2: e3e0f0980024 stg %r14,152(%r15)
>> >0000000000c480e8: c41bffea76c8 stgrl %r1,996e78
>> 0000000000c480ee: c020ffe95e5c larl %r2,973da6
>> 0000000000c480f4: a7390000 lghi %r3,0
>> 0000000000c480f8: c0d0ffdee974 larl %r13,8253e0
>> 0000000000c480fe: a7c90009 lghi %r12,9
>> [ 0.360710] Call Trace:
>> [ 0.360713] ([<000000003de4be28>] 0x3de4be28)
>> [ 0.360718] ([<00000000001001da>] do_one_initcall+0xa2/0x1b0)
>> [ 0.360724] ([<0000000000c0dcf4>] kernel_init_freeable+0x1e4/0x298)
>> [ 0.360729] ([<00000000007b3cda>] kernel_init+0x2a/0x128)
>> [ 0.360731] ([<00000000007bcc8e>] kernel_thread_starter+0x6/0xc)
>> [ 0.360733] ([<00000000007bcc88>] kernel_thread_starter+0x0/0xc)
>> [ 0.360733] Last Breaking-Event-Address:
>> [ 0.360735] [<00000000001001d8>] do_one_initcall+0xa0/0x1b0
>> [ 0.360735]
>> [ 0.360738] Kernel panic - not syncing: Fatal exception: panic_on_oops
>>
>>
>> The code in question is
>> /* Make sure we can write to __ro_after_init values during __init */
>> ro_after_init |= 0xAA;
>>
>>
>> The problem is that s390 does not call mark_rodata_ro, instead sections are
>> marked read-only earlier. Maybe we should change that. Heiko, Martin?
>
> Since you've got rodata starting life as rodata, perhaps s390 could
> use a different section for __ro_after_init and only mark that section
> as RO during mark_rodata_ro()? It'd be nice to have that level of
> granularity, actually.
>
> I'll send an utterly untested patch... :P
virtme-defconfig --arch=s390x
make [arch that virtme-defconfig tells you]
virtme-run --kdir=. --arch=s390x
:)
--Andy
>
> -Kees
>
>>
>>>
>>> Signed-off-by: Kees Cook <keescook@chromium.org>
>>> ---
>>> arch/parisc/include/asm/cache.h | 3 +++
>>> include/asm-generic/vmlinux.lds.h | 1 +
>>> include/linux/cache.h | 14 ++++++++++++++
>>> 3 files changed, 18 insertions(+)
>>>
>>> diff --git a/arch/parisc/include/asm/cache.h b/arch/parisc/include/asm/cache.h
>>> index 3d0e17bcc8e9..df0f52bd18b4 100644
>>> --- a/arch/parisc/include/asm/cache.h
>>> +++ b/arch/parisc/include/asm/cache.h
>>> @@ -22,6 +22,9 @@
>>>
>>> #define __read_mostly __attribute__((__section__(".data..read_mostly")))
>>>
>>> +/* Read-only memory is marked before mark_rodata_ro() is called. */
>>> +#define __ro_after_init __read_mostly
>>> +
>>> void parisc_cache_init(void); /* initializes cache-flushing */
>>> void disable_sr_hashing_asm(int); /* low level support for above */
>>> void disable_sr_hashing(void); /* turns off space register hashing */
>>> diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
>>> index e9a81a6a109f..8f5a12ab2f2b 100644
>>> --- a/include/asm-generic/vmlinux.lds.h
>>> +++ b/include/asm-generic/vmlinux.lds.h
>>> @@ -255,6 +255,7 @@
>>> .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
>>> VMLINUX_SYMBOL(__start_rodata) = .; \
>>> *(.rodata) *(.rodata.*) \
>>> + *(.data..ro_after_init) /* Read only after init */ \
>>> *(__vermagic) /* Kernel version magic */ \
>>> . = ALIGN(8); \
>>> VMLINUX_SYMBOL(__start___tracepoints_ptrs) = .; \
>>> diff --git a/include/linux/cache.h b/include/linux/cache.h
>>> index 17e7e82d2aa7..1be04f8c563a 100644
>>> --- a/include/linux/cache.h
>>> +++ b/include/linux/cache.h
>>> @@ -12,10 +12,24 @@
>>> #define SMP_CACHE_BYTES L1_CACHE_BYTES
>>> #endif
>>>
>>> +/*
>>> + * __read_mostly is used to keep rarely changing variables out of frequently
>>> + * updated cachelines. If an architecture doesn't support it, ignore the
>>> + * hint.
>>> + */
>>> #ifndef __read_mostly
>>> #define __read_mostly
>>> #endif
>>>
>>> +/*
>>> + * __ro_after_init is used to mark things that are read-only after init (i.e.
>>> + * after mark_rodata_ro() has been called). These are effectively read-only,
>>> + * but may get written to during init, so can't live in .rodata (via "const").
>>> + */
>>> +#ifndef __ro_after_init
>>> +#define __ro_after_init __attribute__((__section__(".data..ro_after_init")))
>>> +#endif
>>> +
>>> #ifndef ____cacheline_aligned
>>> #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
>>> #endif
>>>
>>
>
>
>
> --
> Kees Cook
> Chrome OS & Brillo Security
--
Andy Lutomirski
AMA Capital Management, LLC
^ permalink raw reply [flat|nested] 12+ messages in thread
* [kernel-hardening] [PATCH v5 5/7] lkdtm: verify that __ro_after_init works correctly
2016-02-17 22:41 [kernel-hardening] [PATCH v5 0/7] introduce post-init read-only memory Kees Cook
` (3 preceding siblings ...)
2016-02-17 22:41 ` [kernel-hardening] [PATCH v5 4/7] introduce post-init read-only memory Kees Cook
@ 2016-02-17 22:41 ` Kees Cook
2016-02-17 22:41 ` [kernel-hardening] [PATCH v5 6/7] x86, vdso: mark vDSO read-only after init Kees Cook
2016-02-17 22:41 ` [kernel-hardening] [PATCH v5 7/7] ARM: vdso: Mark vDSO code as read-only Kees Cook
6 siblings, 0 replies; 12+ messages in thread
From: Kees Cook @ 2016-02-17 22:41 UTC (permalink / raw)
To: Ingo Molnar
Cc: Kees Cook, David Brown, Andy Lutomirski, H. Peter Anvin,
Michael Ellerman, Mathias Krause, Thomas Gleixner, x86,
Arnd Bergmann, PaX Team, Emese Revfy, kernel-hardening,
linux-kernel, linux-arch
The new __ro_after_init section should be writable before init, but
not after. Validate that it gets updated at init and can't be written
to afterwards.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
drivers/misc/lkdtm.c | 29 ++++++++++++++++++++++++++---
1 file changed, 26 insertions(+), 3 deletions(-)
diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
index 5c1351b19029..a77799d227ee 100644
--- a/drivers/misc/lkdtm.c
+++ b/drivers/misc/lkdtm.c
@@ -103,6 +103,7 @@ enum ctype {
CT_EXEC_USERSPACE,
CT_ACCESS_USERSPACE,
CT_WRITE_RO,
+ CT_WRITE_RO_AFTER_INIT,
CT_WRITE_KERN,
};
@@ -140,6 +141,7 @@ static char* cp_type[] = {
"EXEC_USERSPACE",
"ACCESS_USERSPACE",
"WRITE_RO",
+ "WRITE_RO_AFTER_INIT",
"WRITE_KERN",
};
@@ -162,6 +164,7 @@ static DEFINE_SPINLOCK(lock_me_up);
static u8 data_area[EXEC_SIZE];
static const unsigned long rodata = 0xAA55AA55;
+static unsigned long ro_after_init __ro_after_init = 0x55AA5500;
module_param(recur_count, int, 0644);
MODULE_PARM_DESC(recur_count, " Recursion level for the stack overflow test");
@@ -503,11 +506,28 @@ static void lkdtm_do_action(enum ctype which)
break;
}
case CT_WRITE_RO: {
- unsigned long *ptr;
+ /* Explicitly cast away "const" for the test. */
+ unsigned long *ptr = (unsigned long *)&rodata;
- ptr = (unsigned long *)&rodata;
+ pr_info("attempting bad rodata write at %p\n", ptr);
+ *ptr ^= 0xabcd1234;
- pr_info("attempting bad write at %p\n", ptr);
+ break;
+ }
+ case CT_WRITE_RO_AFTER_INIT: {
+ unsigned long *ptr = &ro_after_init;
+
+ /*
+ * Verify we were written to during init. Since an Oops
+ * is considered a "success", a failure is to just skip the
+ * real test.
+ */
+ if ((*ptr & 0xAA) != 0xAA) {
+ pr_info("%p was NOT written during init!?\n", ptr);
+ break;
+ }
+
+ pr_info("attempting bad ro_after_init write at %p\n", ptr);
*ptr ^= 0xabcd1234;
break;
@@ -817,6 +837,9 @@ static int __init lkdtm_module_init(void)
int n_debugfs_entries = 1; /* Assume only the direct entry */
int i;
+ /* Make sure we can write to __ro_after_init values during __init */
+ ro_after_init |= 0xAA;
+
/* Register debugfs interface */
lkdtm_debugfs_root = debugfs_create_dir("provoke-crash", NULL);
if (!lkdtm_debugfs_root) {
--
2.6.3
^ permalink raw reply related [flat|nested] 12+ messages in thread* [kernel-hardening] [PATCH v5 6/7] x86, vdso: mark vDSO read-only after init
2016-02-17 22:41 [kernel-hardening] [PATCH v5 0/7] introduce post-init read-only memory Kees Cook
` (4 preceding siblings ...)
2016-02-17 22:41 ` [kernel-hardening] [PATCH v5 5/7] lkdtm: verify that __ro_after_init works correctly Kees Cook
@ 2016-02-17 22:41 ` Kees Cook
2016-02-17 22:41 ` [kernel-hardening] [PATCH v5 7/7] ARM: vdso: Mark vDSO code as read-only Kees Cook
6 siblings, 0 replies; 12+ messages in thread
From: Kees Cook @ 2016-02-17 22:41 UTC (permalink / raw)
To: Ingo Molnar
Cc: Kees Cook, David Brown, Andy Lutomirski, H. Peter Anvin,
Michael Ellerman, Mathias Krause, Thomas Gleixner, x86,
Arnd Bergmann, PaX Team, Emese Revfy, kernel-hardening,
linux-kernel, linux-arch
The vDSO does not need to be writable after __init, so mark it as
__ro_after_init. The result kills the exploit method of writing to the
vDSO from kernel space resulting in userspace executing the modified code,
as shown here to bypass SMEP restrictions: http://itszn.com/blog/?p=21
The memory map (with added vDSO address reporting) shows the vDSO moving
into read-only memory:
Before:
[ 0.143067] vDSO @ ffffffff82004000
[ 0.143551] vDSO @ ffffffff82006000
---[ High Kernel Mapping ]---
0xffffffff80000000-0xffffffff81000000 16M pmd
0xffffffff81000000-0xffffffff81800000 8M ro PSE GLB x pmd
0xffffffff81800000-0xffffffff819f3000 1996K ro GLB x pte
0xffffffff819f3000-0xffffffff81a00000 52K ro NX pte
0xffffffff81a00000-0xffffffff81e00000 4M ro PSE GLB NX pmd
0xffffffff81e00000-0xffffffff81e05000 20K ro GLB NX pte
0xffffffff81e05000-0xffffffff82000000 2028K ro NX pte
0xffffffff82000000-0xffffffff8214f000 1340K RW GLB NX pte
0xffffffff8214f000-0xffffffff82281000 1224K RW NX pte
0xffffffff82281000-0xffffffff82400000 1532K RW GLB NX pte
0xffffffff82400000-0xffffffff83200000 14M RW PSE GLB NX pmd
0xffffffff83200000-0xffffffffc0000000 974M pmd
After:
[ 0.145062] vDSO @ ffffffff81da1000
[ 0.146057] vDSO @ ffffffff81da4000
---[ High Kernel Mapping ]---
0xffffffff80000000-0xffffffff81000000 16M pmd
0xffffffff81000000-0xffffffff81800000 8M ro PSE GLB x pmd
0xffffffff81800000-0xffffffff819f3000 1996K ro GLB x pte
0xffffffff819f3000-0xffffffff81a00000 52K ro NX pte
0xffffffff81a00000-0xffffffff81e00000 4M ro PSE GLB NX pmd
0xffffffff81e00000-0xffffffff81e0b000 44K ro GLB NX pte
0xffffffff81e0b000-0xffffffff82000000 2004K ro NX pte
0xffffffff82000000-0xffffffff8214c000 1328K RW GLB NX pte
0xffffffff8214c000-0xffffffff8227e000 1224K RW NX pte
0xffffffff8227e000-0xffffffff82400000 1544K RW GLB NX pte
0xffffffff82400000-0xffffffff83200000 14M RW PSE GLB NX pmd
0xffffffff83200000-0xffffffffc0000000 974M pmd
Based on work by PaX Team and Brad Spengler.
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Andy Lutomirski <luto@kernel.org>
Acked-by: H. Peter Anvin <hpa@linux.intel.com>
---
arch/x86/entry/vdso/vdso2c.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/entry/vdso/vdso2c.h b/arch/x86/entry/vdso/vdso2c.h
index abe961c7c71c..63a03bb91497 100644
--- a/arch/x86/entry/vdso/vdso2c.h
+++ b/arch/x86/entry/vdso/vdso2c.h
@@ -140,7 +140,7 @@ static void BITSFUNC(go)(void *raw_addr, size_t raw_len,
fprintf(outfile, "#include <asm/vdso.h>\n");
fprintf(outfile, "\n");
fprintf(outfile,
- "static unsigned char raw_data[%lu] __page_aligned_data = {",
+ "static unsigned char raw_data[%lu] __ro_after_init __aligned(PAGE_SIZE) = {",
mapping_size);
for (j = 0; j < stripped_len; j++) {
if (j % 10 == 0)
--
2.6.3
^ permalink raw reply related [flat|nested] 12+ messages in thread* [kernel-hardening] [PATCH v5 7/7] ARM: vdso: Mark vDSO code as read-only
2016-02-17 22:41 [kernel-hardening] [PATCH v5 0/7] introduce post-init read-only memory Kees Cook
` (5 preceding siblings ...)
2016-02-17 22:41 ` [kernel-hardening] [PATCH v5 6/7] x86, vdso: mark vDSO read-only after init Kees Cook
@ 2016-02-17 22:41 ` Kees Cook
6 siblings, 0 replies; 12+ messages in thread
From: Kees Cook @ 2016-02-17 22:41 UTC (permalink / raw)
To: Ingo Molnar
Cc: Kees Cook, David Brown, Andy Lutomirski, H. Peter Anvin,
Michael Ellerman, Mathias Krause, Thomas Gleixner, x86,
Arnd Bergmann, PaX Team, Emese Revfy, kernel-hardening,
linux-kernel, linux-arch
From: David Brown <david.brown@linaro.org>
Although the arm vDSO is cleanly separated by code/data with the code
being read-only in userspace mappings, the code page is still writable
from the kernel. There have been exploits (such as
http://itszn.com/blog/?p=21) that take advantage of this on x86 to go
from a bad kernel write to full root.
Prevent this specific exploit on arm by putting the vDSO code page in
post-init read-only memory as well.
Before:
vdso: 1 text pages at base 80927000
root@Vexpress:/ cat /sys/kernel/debug/kernel_page_tables
---[ Modules ]---
---[ Kernel Mapping ]---
0x80000000-0x80100000 1M RW NX SHD
0x80100000-0x80600000 5M ro x SHD
0x80600000-0x80800000 2M ro NX SHD
0x80800000-0xbe000000 984M RW NX SHD
After:
vdso: 1 text pages at base 8072b000
root@Vexpress:/ cat /sys/kernel/debug/kernel_page_tables
---[ Modules ]---
---[ Kernel Mapping ]---
0x80000000-0x80100000 1M RW NX SHD
0x80100000-0x80600000 5M ro x SHD
0x80600000-0x80800000 2M ro NX SHD
0x80800000-0xbe000000 984M RW NX SHD
Inspired by https://lkml.org/lkml/2016/1/19/494 based on work by the
PaX Team, Brad Spengler, and Kees Cook.
Signed-off-by: David Brown <david.brown@linaro.org>
Acked-by: Kees Cook <keescook@chromium.org>
---
arch/arm/vdso/vdso.S | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/arm/vdso/vdso.S b/arch/arm/vdso/vdso.S
index b2b97e3e7bab..a62a7b64f49c 100644
--- a/arch/arm/vdso/vdso.S
+++ b/arch/arm/vdso/vdso.S
@@ -23,9 +23,8 @@
#include <linux/const.h>
#include <asm/page.h>
- __PAGE_ALIGNED_DATA
-
.globl vdso_start, vdso_end
+ .section .data..ro_after_init
.balign PAGE_SIZE
vdso_start:
.incbin "arch/arm/vdso/vdso.so"
--
2.6.3
^ permalink raw reply related [flat|nested] 12+ messages in thread