Re: [kernel-hardening] Re: [PATCH 2/2] arm: apply more __ro_after_init

[Daniel Micay]

On Wed, 2016-08-10 at 10:43 +0100, Russell King - ARM Linux wrote:
> On Fri, Jun 03, 2016 at 11:40:24AM -0700, Kees Cook wrote:
> > 
> > @@ -1309,16 +1309,11 @@ void __init arm_mm_memblock_reserve(void)
> > Â * Any other function or debugging method which may touch any
> > device _will_
> > Â * crash the kernel.
> > Â */
> > +static char vectors[PAGE_SIZE * 2] __ro_after_init
> > __aligned(PAGE_SIZE);
> > Âstatic void __init devicemaps_init(const struct machine_desc
> > *mdesc)
> > Â{
> > Â	struct map_desc map;
> > Â	unsigned long addr;
> > -	void *vectors;
> > -
> > -	/*
> > -	Â* Allocate the vector page early.
> > -	Â*/
> > -	vectors = early_alloc(PAGE_SIZE * 2);
> 
> This one is not appropriate.ÂÂWe _do_ write to these pages after init
> for FIQ handler updates.ÂÂSee set_fiq_handler().

This is one of the many cases where pax_open_kernel/pax_close_kernel are
needed to temporarily toggle it read-only. From grsecurity:

@@ -95,7 +95,10 @@ void set_fiq_handler(void *start, unsigned int
length)
Â	void *base = vectors_page;
Â	unsigned offset = FIQ_OFFSET;
Â
+	pax_open_kernel();
Â	memcpy(base + offset, start, length);
+	pax_close_kernel();

Attachment: signature.asc
Description: This is a digitally signed message part