Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 30 Nov 2015 13:52:10 -0800
From: Kees Cook <>
To: Ingo Molnar <>, Heiko Carstens <>, 
	Michael Ellerman <>, "James E.J. Bottomley" <>, 
	Catalin Marinas <>, Russell King - ARM Linux <>
Cc: LKML <>, Andy Lutomirski <>, 
	"H. Peter Anvin" <>, Mathias Krause <>, Ingo Molnar <>, 
	Thomas Gleixner <>, "" <>, Arnd Bergmann <>, 
	PaX Team <>, Emese Revfy <>, 
	"" <>, 
	linux-arch <>
Subject: Re: [PATCH v2 1/4] init: create cmdline param to disable readonly

On Wed, Nov 25, 2015 at 11:51 PM, Ingo Molnar <> wrote:
> * Kees Cook <> wrote:
> Btw., could you please remove the Kconfig option altogether in an additional patch
> and make read-only sections an always-on feature? It has been default-y for years
> and all distros have it enabled.

Yeah, this is something I've wanted to do for a while, but I would
point out that only a few architectures have actually implemented it,
and for arm and arm64 it was very recent:

$ git grep 'config DEBUG_RODATA'
arch/arm/mm/Kconfig:config DEBUG_RODATA
arch/arm64/Kconfig.debug:config DEBUG_RODATA
arch/parisc/Kconfig.debug:config DEBUG_RODATA
arch/x86/Kconfig.debug:config DEBUG_RODATA

I think s390 already has strict kernel memory permissions, but they
set it up ahead of time. And now, I see in reading the parisc tree,
they do too, and mark_rodata_ro() is effectively a no-op. How does
powerpc handle permissions for kernel rodata?

For parisc (and maybe powerpc and s390) we'll need additional changes
to support __ro_after_init, since they may be making the ro section ro
_before_ init runs. But, that's okay since this series only uses
__ro_after_init on x86 for the moment. ;)

> The 'debug rodata' naming is purely historic: this started out as a simple
> debugging feature, but meanwhile it has spread and has become an essential kernel
> robustness feature.

I agree completely. I suspect I would turn this into


Kees Cook
Chrome OS & Brillo Security

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.