Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1252631

Re: [PATCH v2] x86/mm: warn on W+x mappings

Show all headers | View raw

* Matt Fleming <matt@codeblueprint.co.uk> wrote:

> > > Right, we could do that, but then we wouldn't be able to support 
> > > creation/updating variables at runtime, such as when you install a 
> > > distribution for the first time, or want to boot a new kernel filename 
> > > directly from the firmware without a boot loader (and need to modify the 
> > > BootXXXX variables).
> > 
> > Do we know the precise position and address range of these variables?
> > 
> > We could map them writable (but not executable), and the rest executable (but 
> > not writable).
>  
> The variables are stored in NVRAM, which we don't map into the kernel virtual 
> address space. [...]

Just curious: is there firmware that memory maps those variables privately?

> [...] We have to initiate the transaction of writing to the variables by 
> executing EFI runtime services.
> 
> We obviously have buffers that we pass to the BIOS that contain variable data, 
> but these should be NX anyway because they're regular kernel allocations.
> 
> > That raises the question whether the same physical page ever mixes variables 
> > and actual code - but the hope would be that it's suffiently page granular for 
> > this to work.
> 
> I don't think that would ever happen.

Ok, that's promising, so how about this then to solve the security weakness the 
new warning unearthed: map the whole EFI range as 'r-x (NX)', but detect writes 
from the page fault handler and transparently allow them to flip over the range to 
'rw-'.

Note that for security reasons we don't allow a subsequent flipping back to NX if 
there's an NX fault on the same page, i.e. this new mechanism is a monotonic 
one-way process that should dynamically 'map out' data pages versus executable 
pages.

It should also be pretty robust, assuming we can take page faults while EFI code 
is executing and is trying to modify EFI data: is that the case?

Thanks,

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Re: [PATCH v2] x86/mm: warn on W+x mappings Ingo Molnar <mingo@kernel.org> - 2015-10-21 11:50 +0200
  Re: [PATCH v2] x86/mm: warn on W+x mappings Ingo Molnar <mingo@kernel.org> - 2015-10-21 14:50 +0200
    Re: [PATCH v2] x86/mm: warn on W+x mappings Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2015-10-21 15:00 +0200
      Re: [PATCH v2] x86/mm: warn on W+x mappings Borislav Petkov <bp@alien8.de> - 2015-10-21 15:30 +0200
        Re: [PATCH v2] x86/mm: warn on W+x mappings Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2015-10-21 15:30 +0200
          Re: [PATCH v2] x86/mm: warn on W+x mappings Borislav Petkov <bp@alien8.de> - 2015-10-21 16:40 +0200
            Re: [PATCH v2] x86/mm: warn on W+x mappings Andy Lutomirski <luto@amacapital.net> - 2015-10-21 20:50 +0200
              Re: [PATCH v2] x86/mm: warn on W+x mappings Andy Lutomirski <luto@amacapital.net> - 2015-10-21 22:50 +0200
              Re: [PATCH v2] x86/mm: warn on W+x mappings Matt Fleming <matt@codeblueprint.co.uk> - 2015-10-21 22:50 +0200
  Re: [PATCH v2] x86/mm: warn on W+x mappings Matt Fleming <matt@codeblueprint.co.uk> - 2015-10-21 22:40 +0200

csiph-web