Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1238005

Re: [RFC][PATCH] x86/mm: warn on W+x mappings

Show all headers | View raw

* Borislav Petkov <bp@alien8.de> wrote:

> On Thu, Oct 01, 2015 at 12:24:25PM -0700, Kees Cook wrote:
> > On Thu, Oct 1, 2015 at 9:28 AM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
> > > Warn on any residual W+x mappings if X86_PTDUMP is enabled.
> > >
> > > Sample dmesg output:
> > > Checking for W+x mappings
> > > 0xffffffff81755000-0xffffffff81800000         684K     RW                 GLB x  pte
> > > Found W+x mappings.  Please fix.
> > >
> > > Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
> > > ---
> > > Not sure if this is the best place to put this check.
> > > It must occur after free_init_pages() or it won't catch the
> > > W+x case for the gap between __ex_table and rodata.
> > 
> > Yeah. Hmm. I want this test for sure, but I'd like to be able to do with 
> > without needing PTDUMP, since that puts a very sensitive file in debugfs. I 
> > wonder if we can reuse the same code, but only expose the page tables to 
> > userspace with PTDUMP?
> 
> So make it a debugging option like CONFIG_EFI_PGT_DUMP and let it dump the 
> pagetable in dmesg during boot, at the exact point you want it to. Then one can 
> grep dmesg for W+x bits or whatever else...

It's better to generate a WARN()ing programmatically if the W+X condition occurs, 
that gets noticed by tools and people alike. I'd like to start treating that 
condition as a hard kernel bug.

A dump in dmesg is subject to random noise by printk crusaders and is also subject 
to general bitrot, nor does it provide any ready warning to act upon.

Adding an extra debug option is a good idea (just please don't put 'EFI' into the 
name - this isn't really EFI related), to not generate the debugfs node.

I'd even add this debug check as default-enabled in the x86 defconfigs, so that my 
own continuous kernel testing kit picks up any new warnings from it.

Thanks,

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC][PATCH] x86/mm: warn on W+x mappings Stephen Smalley <sds@tycho.nsa.gov> - 2015-10-01 18:40 +0200
  Re: [RFC][PATCH] x86/mm: warn on W+x mappings Kees Cook <keescook@chromium.org> - 2015-10-01 21:30 +0200
    Re: [RFC][PATCH] x86/mm: warn on W+x mappings Borislav Petkov <bp@alien8.de> - 2015-10-01 21:50 +0200
      Re: [RFC][PATCH] x86/mm: warn on W+x mappings Ingo Molnar <mingo@kernel.org> - 2015-10-02 09:30 +0200
        Re: [RFC][PATCH] x86/mm: warn on W+x mappings Borislav Petkov <bp@alien8.de> - 2015-10-02 10:20 +0200
          Re: [RFC][PATCH] x86/mm: warn on W+x mappings Ingo Molnar <mingo@kernel.org> - 2015-10-03 10:00 +0200
            Re: [RFC][PATCH] x86/mm: warn on W+x mappings Borislav Petkov <bp@alien8.de> - 2015-10-03 11:10 +0200
  Re: [RFC][PATCH] x86/mm: warn on W+x mappings Ingo Molnar <mingo@kernel.org> - 2015-10-02 09:40 +0200

csiph-web