Re: [PATCH] arm64: make CONFIG_DEBUG_RODATA non-optional

From: Kees Cook
Date: Thu Jan 28 2016 - 10:17:14 EST

On Thu, Jan 28, 2016 at 6:59 AM, Mark Rutland <mark.rutland@xxxxxxx> wrote:
> On Thu, Jan 28, 2016 at 06:06:53AM -0800, Kees Cook wrote:
>> On Thu, Jan 28, 2016 at 3:06 AM, Mark Rutland <mark.rutland@xxxxxxx> wrote:
>> > One thing I would like to do is to avoid the need for fixup_executable
>> > entirely, by mapping the kernel text RO from the outset. However, that
>> > requires rework of the alternatives patching (to use a temporary RW
>> > alias), and I haven't had the time to look into that yet.
>> This makes perfect sense for the rodata section, but the (future)
>> postinit_rodata section we'll still want to mark RO after init
>> finishes. x86 and ARM cheat y marking both RO after init, and they
>> don't have to pad sections. parisc will need to solve this too.
> Depending on how many postinit_rodata variables there are, we might be
> able to drop those in .rodata, have them RO always, and initialise them
> via a temporary RW alias (e.g. something in the vmalloc area).
> The only requirement for that is that we use a helper to initialise any
> __postinit_ro variables via a temporary RW alias, e.g.
> #define SET_POST_INIT_RO(ptr, v) ({ \\
> typeof(ptr) __ptr_rw = (ptr) \\
> BUG_ON(initcalls_done); \\
> __ptr_rw = create_rw_alias(__ptr); \\
> __ptr_rw = v; \\
> destroy_rw_alias(__ptr_rw); \\
> })
> ...
> __postinit_ro void *thing;
> void __init some_init_func(void) {
> void *__thing = some_ranodomized_allocator();
> SET_POSTINIT_RO(thing, thing);
> }

Well, that certainly would make their usage explicit, but I'd really
like to avoid that, especially in the face of trying to const-ify as
much of the kernel as possible to reduce attack surface. I don't want
to have to both mark the variable and its writes, since that would
make the constification gcc plugin a bit more complex.


Kees Cook
Chrome OS & Brillo Security