Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

From: Jessica Yu <jeyu@kernel.org>
To: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Cc: peterz@infradead.org, linux-kernel@vger.kernel.org,
	Thomas Gleixner <tglx@linutronix.de>,
	keescook@chromium.org, Josh Poimboeuf <jpoimboe@redhat.com>,
	Miroslav Benes <mbenes@suse.cz>,
	Mark Rutland <mark.rutland@arm.com>,
	Ard Biesheuvel <ardb@kernel.org>
Subject: Re: [PATCH v2] module: Harden STRICT_MODULE_RWX
Date: Tue, 11 Aug 2020 18:01:35 +0200	[thread overview]
Message-ID: <20200811160134.GA13652@linux-8ccs> (raw)
In-Reply-To: <20200811172738.2d632a09@coco.lan>

+++ Mauro Carvalho Chehab [11/08/20 17:27 +0200]:
>Em Tue, 11 Aug 2020 16:55:24 +0200
>peterz@infradead.org escreveu:
>
>> On Tue, Aug 11, 2020 at 04:34:27PM +0200, Mauro Carvalho Chehab wrote:
>> >   [33] .plt              PROGBITS         0000000000000340  00035c80
>> >        0000000000000001  0000000000000000 WAX       0     0     1
>> >   [34] .init.plt         NOBITS           0000000000000341  00035c81
>> >        0000000000000001  0000000000000000  WA       0     0     1
>> >   [35] .text.ftrace[...] PROGBITS         0000000000000342  00035c81
>> >        0000000000000001  0000000000000000 WAX       0     0     1
>>
>> .plt and .text.ftrace_tramplines are buggered.
>>
>> arch/arm64/kernel/module.lds even marks then as NOLOAD.
>
>Hmm... Shouldn't the code at module_enforce_rwx_sections() or at
>load_module() ignore such sections instead of just rejecting probing
>all modules?
>
>I mean, if the existing toolchain is not capable of excluding
>those sections, either the STRICT_MODULE_RWX hardening should be
>disabled, if a broken toolchain is detected or some runtime code
>should handle such sections on a different way.

Hi Mauro, thanks for providing the readelf output. The sections marked 'WAX'
are indeed the reason why the module loader is rejecting them.

Interesting, my cross-compiled modules do not have the executable flag -

  [38] .plt              NOBITS           0000000000000340  00038fc0
       0000000000000001  0000000000000000  WA       0     0     1
  [39] .init.plt         NOBITS           0000000000000341  00038fc0
       0000000000000001  0000000000000000  WA       0     0     1
  [40] .text.ftrace_tram NOBITS           0000000000000342  00038fc0
       0000000000000001  0000000000000000  WA       0     0     1

ld version:

    GNU ld (GNU Binutils) 2.34
    Copyright (C) 2020 Free Software Foundation, Inc.
    This program is free software; you may redistribute it under the terms of
    the GNU General Public License version 3 or (at your option) a later version.

And gcc:

    aarch64-linux-gcc (GCC) 9.3.0
    Copyright (C) 2019 Free Software Foundation, Inc.
    This is free software; see the source for copying conditions.  There is NO
    warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

I'm a bit confused about what NOLOAD actually implies in this context. From the
ld documentation - "The `(NOLOAD)' directive will mark a section to not be
loaded at run time." But these sections are marked SHF_ALLOC and are referenced
to in the module plt code. Or does it just tell the linker to not initialize it?

Adding Ard to CC, I'm sure he'd know more about the section flag specifics.

Jessica