From: Jordan Niethe <jniethe5@gmail.com>
To: Christophe Leroy <christophe.leroy@csgroup.eu>
Cc: Christophe Leroy <christophe.leroy@c-s.fr>,
ajd@linux.ibm.com, Nicholas Piggin <npiggin@gmail.com>,
naveen.n.rao@linux.ibm.com,
linuxppc-dev <linuxppc-dev@lists.ozlabs.org>,
Daniel Axtens <dja@axtens.net>
Subject: Re: [PATCH v9 5/8] powerpc: Set ARCH_HAS_STRICT_MODULE_RWX
Date: Wed, 17 Mar 2021 13:15:47 +1100 [thread overview]
Message-ID: <CACzsE9r4H7yyRfZ3_jcTsjUSwfbPiRyLn6AjU6r2hPWL=OV8pw@mail.gmail.com> (raw)
In-Reply-To: <1b4d4df4-4553-0f33-631f-5a2e5ae97547@csgroup.eu>
On Tue, Mar 16, 2021 at 5:51 PM Christophe Leroy
<christophe.leroy@csgroup.eu> wrote:
>
>
>
> Le 16/03/2021 à 04:17, Jordan Niethe a écrit :
> > From: Russell Currey <ruscur@russell.cc>
> >
> > To enable strict module RWX on powerpc, set:
> >
> > CONFIG_STRICT_MODULE_RWX=y
> >
> > You should also have CONFIG_STRICT_KERNEL_RWX=y set to have any real
> > security benefit.
> >
> > ARCH_HAS_STRICT_MODULE_RWX is set to require ARCH_HAS_STRICT_KERNEL_RWX.
> > This is due to a quirk in arch/Kconfig and arch/powerpc/Kconfig that
> > makes STRICT_MODULE_RWX *on by default* in configurations where
> > STRICT_KERNEL_RWX is *unavailable*.
>
> Not that easy on book3s/32. On it, you can't protect memory against execution on a page basis, you
> can only do it on a segment basis. So in order to do that, when would need to allocate to areas of
> memory: one in module space for text and one in vmalloc space for data.
>
> See https://github.com/linuxppc/linux/commit/6ca05532 and
> https://github.com/linuxppc/linux/commit/7fbc22ce
Would it be ok to just make ARCH_HAS_STRICT_MODULE_RWX conditional on 64s?
>
>
> >
> > Since this doesn't make much sense, and module RWX without kernel RWX
> > doesn't make much sense, having the same dependencies as kernel RWX
> > works around this problem.
> >
> > Signed-off-by: Russell Currey <ruscur@russell.cc>
> > Signed-off-by: Jordan Niethe <jniethe5@gmail.com>
> > ---
> > arch/powerpc/Kconfig | 1 +
> > 1 file changed, 1 insertion(+)
> >
> > diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
> > index 4498a27ac9db..d9cadc4212d0 100644
> > --- a/arch/powerpc/Kconfig
> > +++ b/arch/powerpc/Kconfig
> > @@ -137,6 +137,7 @@ config PPC
> > select ARCH_HAS_SCALED_CPUTIME if VIRT_CPU_ACCOUNTING_NATIVE && PPC_BOOK3S_64
> > select ARCH_HAS_SET_MEMORY
> > select ARCH_HAS_STRICT_KERNEL_RWX if ((PPC_BOOK3S_64 || PPC32) && !HIBERNATION)
> > + select ARCH_HAS_STRICT_MODULE_RWX if ARCH_HAS_STRICT_KERNEL_RWX
> > select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
> > select ARCH_HAS_UACCESS_FLUSHCACHE
> > select ARCH_HAS_COPY_MC if PPC64
> >
next prev parent reply other threads:[~2021-03-17 2:16 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-16 3:17 [PATCH v9 1/8] powerpc/mm: Implement set_memory() routines Jordan Niethe
2021-03-16 3:17 ` [PATCH v9 2/8] powerpc/lib/code-patching: Set up Strict RWX patching earlier Jordan Niethe
2021-03-16 3:36 ` Russell Currey
2021-03-16 6:32 ` Christophe Leroy
2021-03-17 0:38 ` Jordan Niethe
2021-03-17 12:04 ` Michael Ellerman
2021-03-16 3:17 ` [PATCH v9 3/8] powerpc/kprobes: Mark newly allocated probes as RO Jordan Niethe
2021-03-16 6:44 ` Christophe Leroy
2021-03-17 0:50 ` Jordan Niethe
2021-03-17 0:52 ` Jordan Niethe
2021-03-17 6:12 ` Christophe Leroy
2021-03-18 2:42 ` Jordan Niethe
2021-03-16 3:17 ` [PATCH v9 4/8] powerpc/mm/ptdump: debugfs handler for W+X checks at runtime Jordan Niethe
2021-03-16 6:47 ` Christophe Leroy
2021-03-16 3:17 ` [PATCH v9 5/8] powerpc: Set ARCH_HAS_STRICT_MODULE_RWX Jordan Niethe
2021-03-16 6:51 ` Christophe Leroy
2021-03-17 2:15 ` Jordan Niethe [this message]
2021-03-17 5:43 ` Christophe Leroy
2021-03-16 3:17 ` [PATCH v9 6/8] powerpc/configs: Enable STRICT_MODULE_RWX in skiroot_defconfig Jordan Niethe
2021-03-16 3:17 ` [PATCH v9 7/8] powerpc/mm: implement set_memory_attr() Jordan Niethe
2021-03-16 7:25 ` Christophe Leroy
2021-03-17 0:54 ` Jordan Niethe
2021-03-16 3:17 ` [PATCH v9 8/8] powerpc/32: use set_memory_attr() Jordan Niethe
2021-03-19 1:19 ` [PATCH v9 1/8] powerpc/mm: Implement set_memory() routines Michael Ellerman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CACzsE9r4H7yyRfZ3_jcTsjUSwfbPiRyLn6AjU6r2hPWL=OV8pw@mail.gmail.com' \
--to=jniethe5@gmail.com \
--cc=ajd@linux.ibm.com \
--cc=christophe.leroy@c-s.fr \
--cc=christophe.leroy@csgroup.eu \
--cc=dja@axtens.net \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=naveen.n.rao@linux.ibm.com \
--cc=npiggin@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).