[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 24 Jun 2020 00:40:29 -0700
From: Kees Cook <keescook@...omium.org>
To: Kristen Carlson Accardi <kristen@...ux.intel.com>
Cc: tglx@...utronix.de, mingo@...hat.com, bp@...en8.de,
arjan@...ux.intel.com, x86@...nel.org, linux-kernel@...r.kernel.org,
kernel-hardening@...ts.openwall.com, rick.p.edgecombe@...el.com
Subject: Re: [PATCH v3 00/10] Function Granular KASLR
On Tue, Jun 23, 2020 at 10:23:17AM -0700, Kristen Carlson Accardi wrote:
> Function Granular Kernel Address Space Layout Randomization (fgkaslr)
I've built and booted this successfully with both GCC/bfd and Clang/lld:
gcc (Ubuntu 9.3.0-10ubuntu2) 9.3.0
GNU ld (GNU Binutils for Ubuntu) 2.34
clang version 11.0.0 (https://github.com/llvm/llvm-project.git c32d695b099109118dbd50dd697fffe23cd9a529)
LLD 11.0.0 (https://github.com/llvm/llvm-project.git c32d695b099109118dbd50dd697fffe23cd9a529)
Tested-by: Kees Cook <keescook@...omium.org>
Clang + objtool is a bit noisy, but I haven't investigated why:
kernel/panic.o: warning: objtool: .text.nmi_panic: unexpected end of section
kernel/panic.o: warning: objtool: .text.__warn_printk: unexpected end of section
kernel/cred.o: warning: objtool: .text.exit_creds: unexpected end of section
kernel/cred.o: warning: objtool: .text.get_task_cred: unexpected end of section
kernel/cred.o: warning: objtool: .text.cred_alloc_blank: unexpected end of section
kernel/cred.o: warning: objtool: .text.abort_creds: unexpected end of section
kernel/cred.o: warning: objtool: .text.prepare_creds: unexpected end of section
kernel/cred.o: warning: objtool: .text.copy_creds: unexpected end of section
kernel/cred.o: warning: objtool: .text.override_creds: unexpected end of section
kernel/cred.o: warning: objtool: .text.revert_creds: unexpected end of section
kernel/cred.o: warning: objtool: .text.prepare_kernel_cred: unexpected end of section
And when interacting with my orphan-section series[1], this patch is
needed to keep from getting A LOT of warnings. ;)
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index af3d004d9a7e..de687ffa4966 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -57,9 +57,14 @@ ifndef CONFIG_FG_KASLR
endif
endif
+ifndef CONFIG_FG_KASLR
# We never want expected sections to be placed heuristically by the
# linker. All sections should be explicitly named in the linker script.
+# However, without a way to provide a wildcard mapping from input
+# sections named .text.* to identically named output sections, this
+# can only be used with FGKASLR is disabled.
LDFLAGS_vmlinux += --orphan-handling=warn
+endif
#
# Prevent GCC from generating any FP code by mistake.
[1] https://lore.kernel.org/lkml/20200624014940.1204448-1-keescook@chromium.org/
--
Kees Cook
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
