Date: Tue, 4 Dec 2018 14:17:59 +0200 From: Igor Stoppa <igor.stoppa@...il.com> To: Andy Lutomirski <luto@...capital.net>, Kees Cook <keescook@...omium.org>, Matthew Wilcox <willy@...radead.org> Cc: igor.stoppa@...wei.com, Nadav Amit <nadav.amit@...il.com>, Peter Zijlstra <peterz@...radead.org>, Dave Hansen <dave.hansen@...ux.intel.com>, linux-integrity@...r.kernel.org, kernel-hardening@...ts.openwall.com, linux-mm@...ck.org, linux-kernel@...r.kernel.org Subject: [RFC v1 PATCH 0/6] hardening: statically allocated protected memory This patch-set is the first-cut implementation of write-rare memory protection, as previously agreed  Its purpose it to keep data write protected kernel data which is seldom modified. There is no read overhead, however writing requires special operations that are probably unsitable for often-changing data. The use is opt-in, by applying the modifier __wr_after_init to a variable declaration. As the name implies, the write protection kicks in only after init() is completed; before that moment, the data is modifiable in the usual way. Current Limitations: * supports only data which is allocated statically, at build time. * supports only x86_64 * might not work for very large amount of data, since it relies on the assumption that said data can be entirely remapped, at init. Some notes: - even if the code is only for x86_64, it is placed in the generic locations, with the intention of extending it also to arm64 - the current section used for collecting wr-after-init data might need to be moved, to work with arm64 MMU - the functionality is in its own c and h files, for now, to ease the introduction (and refactoring) of code dealing with dynamic allocation - recently some updated patches were posted for live-patch on arm64 , they might help with adding arm64 support here - to avoid the risk of weakening __ro_after_init, __wr_after_init data is in a separate set of pages, and any invocation will confirm that the memory affected falls within this range. I have modified rodata_test accordingly, to check als othis case. - to avoid replicating the code which does the change of mapping, there is only one function performing multiple, selectable, operations, such as memcpy(), memset(). I have added also rcu_assign_pointer() as further example. But I'm not too fond of this implementation either. I just couldn't think of any that I would like significantly better. - I have left out the patchset from Nadav that these patches depend on, but it can be found here  (Should have I resubmitted it?) - I am not sure what is the correct form for giving proper credit wrt the authoring of the wr_after_init mechanism, guidance would be appreciated - In an attempt to spam less people, I have curbed the list of recipients. If I have omitted someone who should have been kept/added, please add them to the thread.  https://www.openwall.com/lists/kernel-hardening/2018/11/22/8  https://firstname.lastname@example.org/msg1793199.html  https://email@example.com/msg1810245.html Signed-off-by: Igor Stoppa <igor.stoppa@...wei.com> CC: Andy Lutomirski <luto@...capital.net> CC: Nadav Amit <nadav.amit@...il.com> CC: Matthew Wilcox <willy@...radead.org> CC: Peter Zijlstra <peterz@...radead.org> CC: Kees Cook <keescook@...omium.org> CC: Dave Hansen <dave.hansen@...ux.intel.com> CC: linux-integrity@...r.kernel.org CC: kernel-hardening@...ts.openwall.com CC: linux-mm@...ck.org CC: linux-kernel@...r.kernel.org Igor Stoppa (6): [PATCH 1/6] __wr_after_init: linker section and label [PATCH 2/6] __wr_after_init: write rare for static allocation [PATCH 3/6] rodata_test: refactor tests [PATCH 4/6] rodata_test: add verification for __wr_after_init [PATCH 5/6] __wr_after_init: test write rare functionality [PATCH 6/6] __wr_after_init: lkdtm test drivers/misc/lkdtm/core.c | 3 + drivers/misc/lkdtm/lkdtm.h | 3 + drivers/misc/lkdtm/perms.c | 29 ++++++++ include/asm-generic/vmlinux.lds.h | 20 ++++++ include/linux/cache.h | 17 +++++ include/linux/prmem.h | 134 +++++++++++++++++++++++++++++++++++++ init/main.c | 2 + mm/Kconfig | 4 ++ mm/Kconfig.debug | 9 +++ mm/Makefile | 2 + mm/prmem.c | 124 ++++++++++++++++++++++++++++++++++ mm/rodata_test.c | 63 ++++++++++++------ mm/test_write_rare.c | 135 ++++++++++++++++++++++++++++++++++++++ 13 files changed, 525 insertions(+), 20 deletions(-)
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.