Skip to content

Commit 7bb0338

Browse files
torvaldstorvalds
committed
Merge tag 'rodata-v4.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull rodata updates from Kees Cook: "This renames the (now inaccurate) DEBUG_RODATA and related SET_MODULE_RONX configs to the more sensible STRICT_KERNEL_RWX and STRICT_MODULE_RWX" * tag 'rodata-v4.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: arch: Rename CONFIG_DEBUG_RODATA and CONFIG_DEBUG_MODULE_RONX arch: Move CONFIG_DEBUG_RODATA and CONFIG_SET_MODULE_RONX to be common
2 parents 4a0853b + 0f5bf6d commit 7bb0338

33 files changed

Lines changed: 90 additions & 109 deletions

‎Documentation/DocBook/kgdb.tmpl‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -115,12 +115,12 @@
115115
</para>
116116
<para>
117117
If the architecture that you are using supports the kernel option
118-
CONFIG_DEBUG_RODATA, you should consider turning it off. This
118+
CONFIG_STRICT_KERNEL_RWX, you should consider turning it off. This
119119
option will prevent the use of software breakpoints because it
120120
marks certain regions of the kernel's memory space as read-only.
121121
If kgdb supports it for the architecture you are using, you can
122122
use hardware breakpoints if you desire to run with the
123-
CONFIG_DEBUG_RODATA option turned on, else you need to turn off
123+
CONFIG_STRICT_KERNEL_RWX option turned on, else you need to turn off
124124
this option.
125125
</para>
126126
<para>
@@ -135,7 +135,7 @@
135135
<para>Here is an example set of .config symbols to enable or
136136
disable for kgdb:
137137
<itemizedlist>
138-
<listitem><para># CONFIG_DEBUG_RODATA is not set</para></listitem>
138+
<listitem><para># CONFIG_STRICT_KERNEL_RWX is not set</para></listitem>
139139
<listitem><para>CONFIG_FRAME_POINTER=y</para></listitem>
140140
<listitem><para>CONFIG_KGDB=y</para></listitem>
141141
<listitem><para>CONFIG_KGDB_SERIAL_CONSOLE=y</para></listitem>
@@ -166,7 +166,7 @@
166166
</para>
167167
<para>Here is an example set of .config symbols to enable/disable kdb:
168168
<itemizedlist>
169-
<listitem><para># CONFIG_DEBUG_RODATA is not set</para></listitem>
169+
<listitem><para># CONFIG_STRICT_KERNEL_RWX is not set</para></listitem>
170170
<listitem><para>CONFIG_FRAME_POINTER=y</para></listitem>
171171
<listitem><para>CONFIG_KGDB=y</para></listitem>
172172
<listitem><para>CONFIG_KGDB_SERIAL_CONSOLE=y</para></listitem>

‎Documentation/security/self-protection.txt‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,11 +51,17 @@ kernel, they are implemented in a way where the memory is temporarily
5151
made writable during the update, and then returned to the original
5252
permissions.)
5353

54-
In support of this are (the poorly named) CONFIG_DEBUG_RODATA and
55-
CONFIG_DEBUG_SET_MODULE_RONX, which seek to make sure that code is not
54+
In support of this are CONFIG_STRICT_KERNEL_RWX and
55+
CONFIG_STRICT_MODULE_RWX, which seek to make sure that code is not
5656
writable, data is not executable, and read-only data is neither writable
5757
nor executable.
5858

59+
Most architectures have these options on by default and not user selectable.
60+
For some architectures like arm that wish to have these be selectable,
61+
the architecture Kconfig can select ARCH_OPTIONAL_KERNEL_RWX to enable
62+
a Kconfig prompt. CONFIG_ARCH_OPTIONAL_KERNEL_RWX_DEFAULT determines
63+
the default setting when ARCH_OPTIONAL_KERNEL_RWX is enabled.
64+
5965
#### Function pointers and sensitive variables must not be writable
6066

6167
Vast areas of kernel memory contain function pointers that are looked

‎arch/Kconfig‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -781,4 +781,38 @@ config VMAP_STACK
781781
the stack to map directly to the KASAN shadow map using a formula
782782
that is incorrect if the stack is in vmalloc space.
783783

784+
config ARCH_OPTIONAL_KERNEL_RWX
785+
def_bool n
786+
787+
config ARCH_OPTIONAL_KERNEL_RWX_DEFAULT
788+
def_bool n
789+
790+
config ARCH_HAS_STRICT_KERNEL_RWX
791+
def_bool n
792+
793+
config STRICT_KERNEL_RWX
794+
bool "Make kernel text and rodata read-only" if ARCH_OPTIONAL_KERNEL_RWX
795+
depends on ARCH_HAS_STRICT_KERNEL_RWX
796+
default !ARCH_OPTIONAL_KERNEL_RWX || ARCH_OPTIONAL_KERNEL_RWX_DEFAULT
797+
help
798+
If this is set, kernel text and rodata memory will be made read-only,
799+
and non-text memory will be made non-executable. This provides
800+
protection against certain security exploits (e.g. executing the heap
801+
or modifying text)
802+
803+
These features are considered standard security practice these days.
804+
You should say Y here in almost all cases.
805+
806+
config ARCH_HAS_STRICT_MODULE_RWX
807+
def_bool n
808+
809+
config STRICT_MODULE_RWX
810+
bool "Set loadable kernel module data as NX and text as RO" if ARCH_OPTIONAL_KERNEL_RWX
811+
depends on ARCH_HAS_STRICT_MODULE_RWX && MODULES
812+
default !ARCH_OPTIONAL_KERNEL_RWX || ARCH_OPTIONAL_KERNEL_RWX_DEFAULT
813+
help
814+
If this is set, module text and rodata memory will be made read-only,
815+
and non-text memory will be made non-executable. This provides
816+
protection against certain security exploits (e.g. writing to text)
817+
784818
source "kernel/gcov/Kconfig"

‎arch/arm/Kconfig‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,14 @@ config ARM
44
select ARCH_CLOCKSOURCE_DATA
55
select ARCH_HAS_DEVMEM_IS_ALLOWED
66
select ARCH_HAS_ELF_RANDOMIZE
7+
select ARCH_HAS_STRICT_KERNEL_RWX if MMU && !XIP_KERNEL
8+
select ARCH_HAS_STRICT_MODULE_RWX if MMU
79
select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
810
select ARCH_HAVE_CUSTOM_GPIO_H
911
select ARCH_HAS_GCOV_PROFILE_ALL
1012
select ARCH_MIGHT_HAVE_PC_PARPORT
13+
select ARCH_OPTIONAL_KERNEL_RWX if ARCH_HAS_STRICT_KERNEL_RWX
14+
select ARCH_OPTIONAL_KERNEL_RWX_DEFAULT if CPU_V7
1115
select ARCH_SUPPORTS_ATOMIC_RMW
1216
select ARCH_USE_BUILTIN_BSWAP
1317
select ARCH_USE_CMPXCHG_LOCKREF

‎arch/arm/Kconfig.debug‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1738,17 +1738,6 @@ config PID_IN_CONTEXTIDR
17381738
additional instructions during context switch. Say Y here only if you
17391739
are planning to use hardware trace tools with this kernel.
17401740

1741-
config DEBUG_SET_MODULE_RONX
1742-
bool "Set loadable kernel module data as NX and text as RO"
1743-
depends on MODULES && MMU
1744-
---help---
1745-
This option helps catch unintended modifications to loadable
1746-
kernel module's text and read-only data. It also prevents execution
1747-
of module data. Such protection may interfere with run-time code
1748-
patching and dynamic kernel tracing - and they might also protect
1749-
against certain classes of kernel exploits.
1750-
If in doubt, say "N".
1751-
17521741
source "drivers/hwtracing/coresight/Kconfig"
17531742

17541743
endmenu

‎arch/arm/configs/aspeed_g4_defconfig‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@ CONFIG_MODULE_UNLOAD=y
2525
# CONFIG_ARCH_MULTI_V7 is not set
2626
CONFIG_ARCH_ASPEED=y
2727
CONFIG_MACH_ASPEED_G4=y
28-
CONFIG_DEBUG_RODATA=y
2928
CONFIG_AEABI=y
3029
CONFIG_UACCESS_WITH_MEMCPY=y
3130
CONFIG_SECCOMP=y
@@ -79,7 +78,8 @@ CONFIG_DEBUG_LL_UART_8250=y
7978
CONFIG_DEBUG_UART_PHYS=0x1e784000
8079
CONFIG_DEBUG_UART_VIRT=0xe8784000
8180
CONFIG_EARLY_PRINTK=y
82-
CONFIG_DEBUG_SET_MODULE_RONX=y
81+
CONFIG_STRICT_MODULE_RWX=y
82+
CONFIG_STRICT_KERNEL_RWX=y
8383
# CONFIG_XZ_DEC_X86 is not set
8484
# CONFIG_XZ_DEC_POWERPC is not set
8585
# CONFIG_XZ_DEC_IA64 is not set

‎arch/arm/configs/aspeed_g5_defconfig‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@ CONFIG_ARCH_MULTI_V6=y
2626
# CONFIG_ARCH_MULTI_V7 is not set
2727
CONFIG_ARCH_ASPEED=y
2828
CONFIG_MACH_ASPEED_G5=y
29-
CONFIG_DEBUG_RODATA=y
3029
CONFIG_AEABI=y
3130
CONFIG_UACCESS_WITH_MEMCPY=y
3231
CONFIG_SECCOMP=y
@@ -81,7 +80,8 @@ CONFIG_DEBUG_LL_UART_8250=y
8180
CONFIG_DEBUG_UART_PHYS=0x1e784000
8281
CONFIG_DEBUG_UART_VIRT=0xe8784000
8382
CONFIG_EARLY_PRINTK=y
84-
CONFIG_DEBUG_SET_MODULE_RONX=y
83+
CONFIG_STRICT_MODULE_RWX=y
84+
CONFIG_STRICT_KERNEL_RWX=y
8585
# CONFIG_XZ_DEC_X86 is not set
8686
# CONFIG_XZ_DEC_POWERPC is not set
8787
# CONFIG_XZ_DEC_IA64 is not set

‎arch/arm/include/asm/cacheflush.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -490,7 +490,7 @@ static inline int set_memory_x(unsigned long addr, int numpages) { return 0; }
490490
static inline int set_memory_nx(unsigned long addr, int numpages) { return 0; }
491491
#endif
492492

493-
#ifdef CONFIG_DEBUG_RODATA
493+
#ifdef CONFIG_STRICT_KERNEL_RWX
494494
void set_kernel_text_rw(void);
495495
void set_kernel_text_ro(void);
496496
#else

‎arch/arm/kernel/patch.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,9 @@ static void __kprobes *patch_map(void *addr, int fixmap, unsigned long *flags)
2424
bool module = !core_kernel_text(uintaddr);
2525
struct page *page;
2626

27-
if (module && IS_ENABLED(CONFIG_DEBUG_SET_MODULE_RONX))
27+
if (module && IS_ENABLED(CONFIG_STRICT_MODULE_RWX))
2828
page = vmalloc_to_page(addr);
29-
else if (!module && IS_ENABLED(CONFIG_DEBUG_RODATA))
29+
else if (!module && IS_ENABLED(CONFIG_STRICT_KERNEL_RWX))
3030
page = virt_to_page(addr);
3131
else
3232
return addr;

‎arch/arm/kernel/vmlinux.lds.S‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ SECTIONS
9797
HEAD_TEXT
9898
}
9999

100-
#ifdef CONFIG_DEBUG_RODATA
100+
#ifdef CONFIG_STRICT_KERNEL_RWX
101101
. = ALIGN(1<<SECTION_SHIFT);
102102
#endif
103103

@@ -158,7 +158,7 @@ SECTIONS
158158

159159
NOTES
160160

161-
#ifdef CONFIG_DEBUG_RODATA
161+
#ifdef CONFIG_STRICT_KERNEL_RWX
162162
. = ALIGN(1<<SECTION_SHIFT);
163163
#else
164164
. = ALIGN(PAGE_SIZE);
@@ -230,7 +230,7 @@ SECTIONS
230230
PERCPU_SECTION(L1_CACHE_BYTES)
231231
#endif
232232

233-
#ifdef CONFIG_DEBUG_RODATA
233+
#ifdef CONFIG_STRICT_KERNEL_RWX
234234
. = ALIGN(1<<SECTION_SHIFT);
235235
#else
236236
. = ALIGN(THREAD_SIZE);
@@ -325,7 +325,7 @@ SECTIONS
325325
STABS_DEBUG
326326
}
327327

328-
#ifdef CONFIG_DEBUG_RODATA
328+
#ifdef CONFIG_STRICT_KERNEL_RWX
329329
/*
330330
* Without CONFIG_DEBUG_ALIGN_RODATA, __start_rodata_section_aligned will
331331
* be the first section-aligned location after __start_rodata. Otherwise,

0 commit comments

Comments
 (0)