From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755125AbbJUN26 (ORCPT ); Wed, 21 Oct 2015 09:28:58 -0400 Received: from mail-ig0-f173.google.com ([209.85.213.173]:35626 "EHLO mail-ig0-f173.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750847AbbJUN25 (ORCPT ); Wed, 21 Oct 2015 09:28:57 -0400 MIME-Version: 1.0 In-Reply-To: <20151021132430.GD3575@pd.tnic> References: <20151012124113.GD2579@codeblueprint.co.uk> <20151012124936.GA6260@gmail.com> <20151012125548.GE2579@codeblueprint.co.uk> <20151012141754.GA6621@gmail.com> <20151012144928.GF2579@codeblueprint.co.uk> <20151014151807.GA27013@gmail.com> <20151014210257.GF2782@codeblueprint.co.uk> <20151021094242.GA12155@gmail.com> <20151021124924.GA19262@gmail.com> <20151021132430.GD3575@pd.tnic> Date: Wed, 21 Oct 2015 15:28:56 +0200 Message-ID: Subject: Re: [PATCH v2] x86/mm: warn on W+x mappings From: Ard Biesheuvel To: Borislav Petkov Cc: Ingo Molnar , Matt Fleming , Stephen Smalley , "x86@kernel.org" , "linux-kernel@vger.kernel.org" , Kees Cook , Thomas Gleixner , "H. Peter Anvin" , Peter Zijlstra , Andy Lutomirski , Denys Vlasenko , Brian Gerst , "linux-efi@vger.kernel.org" Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 21 October 2015 at 15:24, Borislav Petkov wrote: > On Wed, Oct 21, 2015 at 02:57:47PM +0200, Ard Biesheuvel wrote: >> ... For the remaining cases, which is the vast majority, no such >> assumptions can be made, and since the UEFI runtime regions are >> typically populated with a bunch of PE/COFF images (each of which >> consists of text + data), inferring where the boundaries are between >> them does not seem tractable (for instance, to only map 'boundary' >> pages RWX) > > How much of a problem would it be if we still do the on-demand page > faulting and map a trailing piece of code together with the data in a > page RWX? > > Still better than mapping the *whole* thing RWX, no? > In theory, yes. In practice, since this is supposed to be a security enhancement, we need some kind of ground truth to tell us which pages can be legally modified *and* executed, so that we can detect the illegal cases. My point was that, since a multitude of PE/COFF images can be covered by a single EfiRuntimeServicesCode region, the UEFI memory map does not give us enough information to make the distinction between a page that sits on the text/data boundary of some PE/COFF image and a page that sits wholly in either. -- Ard.