kernel-hardening - Re: [PATCH] x86: make IDT read-only

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LFD.2.02.1304091122490.21884@ionos>
Date: Tue, 9 Apr 2013 11:23:15 +0200 (CEST)
From: Thomas Gleixner <tglx@...utronix.de>
To: "H. Peter Anvin" <hpa@...or.com>
cc: Kees Cook <keescook@...omium.org>, Ingo Molnar <mingo@...hat.com>, 
    linux-kernel@...r.kernel.org, x86@...nel.org, 
    Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>, 
    Jeremy Fitzhardinge <jeremy@...p.org>, 
    Marcelo Tosatti <mtosatti@...hat.com>, Alex Shi <alex.shi@...el.com>, 
    Borislav Petkov <borislav.petkov@....com>, 
    Alexander Duyck <alexander.h.duyck@...el.com>, 
    Frederic Weisbecker <fweisbec@...il.com>, 
    Steven Rostedt <rostedt@...dmis.org>, 
    "Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>, 
    xen-devel@...ts.xensource.com, virtualization@...ts.linux-foundation.org, 
    kernel-hardening@...ts.openwall.com, 
    Dan Rosenberg <drosenberg@...curity.com>, Julien Tinnes <jln@...gle.com>, 
    Will Drewry <wad@...omium.org>, Eric Northup <digitaleric@...gle.com>
Subject: Re: [PATCH] x86: make IDT read-only

On Mon, 8 Apr 2013, H. Peter Anvin wrote:

> On 04/08/2013 03:43 PM, Kees Cook wrote:
> > This makes the IDT unconditionally read-only. This primarily removes
> > the IDT from being a target for arbitrary memory write attacks. It has
> > an added benefit of also not leaking (via the "sidt" instruction) the
> > kernel base offset, if it has been relocated.
> > 
> > Signed-off-by: Kees Cook <keescook@...omium.org>
> > Cc: Eric Northup <digitaleric@...gle.com>
> 
> Also, tglx: does this interfere with your per-cpu IDT efforts?

I don't think so. And it's on the backburner at the moment.

Thanks,

	tglx

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.