| Message ID | 20200415210452.27436-10-kristen@linux.intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Function Granular Kernel Address Space Layout Randomization | expand |
On Wed, 15 Apr 2020 at 23:07, Kristen Carlson Accardi <kristen@linux.intel.com> wrote: > > If a module has functions split out into separate text sections > (i.e. compiled with the -ffunction-sections flag), reorder the > functions to provide some code diversification to modules. > Is that the only prerequisite? I.e., is it sufficient for another architecture to add -ffunction-sections to the module CFLAGS to get this functionality? (assuming it defines CONFIG_FG_KASLR=y) > Signed-off-by: Kristen Carlson Accardi <kristen@linux.intel.com> > Reviewed-by: Kees Cook <keescook@chromium.org> > --- > kernel/module.c | 82 +++++++++++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 82 insertions(+) > > diff --git a/kernel/module.c b/kernel/module.c > index 646f1e2330d2..e432ec5f6df4 100644 > --- a/kernel/module.c > +++ b/kernel/module.c > @@ -53,6 +53,8 @@ > #include <linux/bsearch.h> > #include <linux/dynamic_debug.h> > #include <linux/audit.h> > +#include <linux/random.h> > +#include <asm/setup.h> > #include <uapi/linux/module.h> > #include "module-internal.h" > > @@ -2370,6 +2372,83 @@ static long get_offset(struct module *mod, unsigned int *size, > return ret; > } > > +/* > + * shuffle_text_list() > + * Use a Fisher Yates algorithm to shuffle a list of text sections. > + */ > +static void shuffle_text_list(Elf_Shdr **list, int size) > +{ > + int i; > + unsigned int j; > + Elf_Shdr *temp; > + > + for (i = size - 1; i > 0; i--) { > + /* > + * pick a random index from 0 to i > + */ > + get_random_bytes(&j, sizeof(j)); > + j = j % (i + 1); > + > + temp = list[i]; > + list[i] = list[j]; > + list[j] = temp; > + } > +} > + > +/* > + * randomize_text() > + * Look through the core section looking for executable code sections. > + * Store sections in an array and then shuffle the sections > + * to reorder the functions. > + */ > +static void randomize_text(struct module *mod, struct load_info *info) > +{ > + int i; > + int num_text_sections = 0; > + Elf_Shdr **text_list; > + int size = 0; > + int max_sections = info->hdr->e_shnum; > + unsigned int sec = find_sec(info, ".text"); > + > + if (sec == 0) > + return; > + > + text_list = kmalloc_array(max_sections, sizeof(*text_list), GFP_KERNEL); > + if (text_list == NULL) > + return; > + > + for (i = 0; i < max_sections; i++) { > + Elf_Shdr *shdr = &info->sechdrs[i]; > + const char *sname = info->secstrings + shdr->sh_name; > + > + if (!(shdr->sh_flags & SHF_ALLOC) || > + !(shdr->sh_flags & SHF_EXECINSTR) || > + strstarts(sname, ".init")) > + continue; > + > + text_list[num_text_sections] = shdr; > + num_text_sections++; > + } > + > + shuffle_text_list(text_list, num_text_sections); > + > + for (i = 0; i < num_text_sections; i++) { > + Elf_Shdr *shdr = text_list[i]; > + > + /* > + * get_offset has a section index for it's last > + * argument, that is only used by arch_mod_section_prepend(), > + * which is only defined by parisc. Since this this type > + * of randomization isn't supported on parisc, we can > + * safely pass in zero as the last argument, as it is > + * ignored. > + */ > + shdr->sh_entsize = get_offset(mod, &size, shdr, 0); > + } > + > + kfree(text_list); > +} > + > /* Lay out the SHF_ALLOC sections in a way not dissimilar to how ld > might -- code, read-only data, read-write data, small data. Tally > sizes, and place the offsets into sh_entsize fields: high bit means it > @@ -2460,6 +2539,9 @@ static void layout_sections(struct module *mod, struct load_info *info) > break; > } > } > + > + if (IS_ENABLED(CONFIG_FG_KASLR) && kaslr_enabled()) kaslr_enabled() only exists [as a function] on x86 > + randomize_text(mod, info); > } > > static void set_license(struct module *mod, const char *license) > -- > 2.20.1 >
On 4/20/2020 5:01 AM, Ard Biesheuvel wrote: > Is that the only prerequisite? I.e., is it sufficient for another > architecture to add -ffunction-sections to the module CFLAGS to get > this functionality? (assuming it defines CONFIG_FG_KASLR=y) I suspect you also need/want at least normal KASLR enabled as a "does it even make sense" common sense threshold
On Mon, 20 Apr 2020 at 15:37, Arjan van de Ven <arjan@linux.intel.com> wrote: > > On 4/20/2020 5:01 AM, Ard Biesheuvel wrote: > > Is that the only prerequisite? I.e., is it sufficient for another > > architecture to add -ffunction-sections to the module CFLAGS to get > > this functionality? (assuming it defines CONFIG_FG_KASLR=y) > > I suspect you also need/want at least normal KASLR enabled as > a "does it even make sense" common sense threshold Fair enough. But that is more of a policy concern than a functional concern. FWIW I took patches #8 and #9, hardwired a couple of CONFIG_FG_KASLR=y checks and added the -ffunction-sections GCC option for the modules, and everything appears to be working as expected on arm64. I was just wondering if I was missing something. Note that arm64 does not have a decompressor, so there the fine grained randomization of the core kernel is not really feasible using the approach presented here.
On 4/20/2020 6:43 AM, Ard Biesheuvel wrote: > > Note that arm64 does not have a decompressor, so there the fine > grained randomization of the core kernel is not really feasible using > the approach presented here. maybe do a "memcpy" decompressor as an option? :-) >
On Mon, 2020-04-20 at 14:01 +0200, Ard Biesheuvel wrote: > On Wed, 15 Apr 2020 at 23:07, Kristen Carlson Accardi > <kristen@linux.intel.com> wrote: > > If a module has functions split out into separate text sections > > (i.e. compiled with the -ffunction-sections flag), reorder the > > functions to provide some code diversification to modules. > > > > Is that the only prerequisite? I.e., is it sufficient for another > architecture to add -ffunction-sections to the module CFLAGS to get > this functionality? (assuming it defines CONFIG_FG_KASLR=y) I think it would work for modules. I've not tested this of course. It might not make sense for some architectures (like 32 bit), but it would probably work. > > > Signed-off-by: Kristen Carlson Accardi <kristen@linux.intel.com> > > Reviewed-by: Kees Cook <keescook@chromium.org> > > --- > > kernel/module.c | 82 > > +++++++++++++++++++++++++++++++++++++++++++++++++ > > 1 file changed, 82 insertions(+) > > > > diff --git a/kernel/module.c b/kernel/module.c > > index 646f1e2330d2..e432ec5f6df4 100644 > > --- a/kernel/module.c > > +++ b/kernel/module.c > > @@ -53,6 +53,8 @@ > > #include <linux/bsearch.h> > > #include <linux/dynamic_debug.h> > > #include <linux/audit.h> > > +#include <linux/random.h> > > +#include <asm/setup.h> > > #include <uapi/linux/module.h> > > #include "module-internal.h" > > > > @@ -2370,6 +2372,83 @@ static long get_offset(struct module *mod, > > unsigned int *size, > > return ret; > > } > > > > +/* > > + * shuffle_text_list() > > + * Use a Fisher Yates algorithm to shuffle a list of text > > sections. > > + */ > > +static void shuffle_text_list(Elf_Shdr **list, int size) > > +{ > > + int i; > > + unsigned int j; > > + Elf_Shdr *temp; > > + > > + for (i = size - 1; i > 0; i--) { > > + /* > > + * pick a random index from 0 to i > > + */ > > + get_random_bytes(&j, sizeof(j)); > > + j = j % (i + 1); > > + > > + temp = list[i]; > > + list[i] = list[j]; > > + list[j] = temp; > > + } > > +} > > + > > +/* > > + * randomize_text() > > + * Look through the core section looking for executable code > > sections. > > + * Store sections in an array and then shuffle the sections > > + * to reorder the functions. > > + */ > > +static void randomize_text(struct module *mod, struct load_info > > *info) > > +{ > > + int i; > > + int num_text_sections = 0; > > + Elf_Shdr **text_list; > > + int size = 0; > > + int max_sections = info->hdr->e_shnum; > > + unsigned int sec = find_sec(info, ".text"); > > + > > + if (sec == 0) > > + return; > > + > > + text_list = kmalloc_array(max_sections, sizeof(*text_list), > > GFP_KERNEL); > > + if (text_list == NULL) > > + return; > > + > > + for (i = 0; i < max_sections; i++) { > > + Elf_Shdr *shdr = &info->sechdrs[i]; > > + const char *sname = info->secstrings + shdr- > > >sh_name; > > + > > + if (!(shdr->sh_flags & SHF_ALLOC) || > > + !(shdr->sh_flags & SHF_EXECINSTR) || > > + strstarts(sname, ".init")) > > + continue; > > + > > + text_list[num_text_sections] = shdr; > > + num_text_sections++; > > + } > > + > > + shuffle_text_list(text_list, num_text_sections); > > + > > + for (i = 0; i < num_text_sections; i++) { > > + Elf_Shdr *shdr = text_list[i]; > > + > > + /* > > + * get_offset has a section index for it's last > > + * argument, that is only used by > > arch_mod_section_prepend(), > > + * which is only defined by parisc. Since this this > > type > > + * of randomization isn't supported on parisc, we > > can > > + * safely pass in zero as the last argument, as it > > is > > + * ignored. > > + */ > > + shdr->sh_entsize = get_offset(mod, &size, shdr, 0); > > + } > > + > > + kfree(text_list); > > +} > > + > > /* Lay out the SHF_ALLOC sections in a way not dissimilar to how > > ld > > might -- code, read-only data, read-write data, small > > data. Tally > > sizes, and place the offsets into sh_entsize fields: high bit > > means it > > @@ -2460,6 +2539,9 @@ static void layout_sections(struct module > > *mod, struct load_info *info) > > break; > > } > > } > > + > > + if (IS_ENABLED(CONFIG_FG_KASLR) && kaslr_enabled()) > > kaslr_enabled() only exists [as a function] on x86 CONFIG_FG_KASLR is dependant on x86_64. If people really think there is value in having the module randomization not dependent on the kernel randomization it can be changed to a different config option - but I am not sure that there is a ton of value in the module randomization on it's own. > > > > + randomize_text(mod, info); > > } > > > > static void set_license(struct module *mod, const char *license) > > -- > > 2.20.1 > >
On Mon, 2020-04-20 at 10:56 -0700, Kristen Carlson Accardi wrote: > On Mon, 2020-04-20 at 14:01 +0200, Ard Biesheuvel wrote: > > On Wed, 15 Apr 2020 at 23:07, Kristen Carlson Accardi > > <kristen@linux.intel.com> wrote: > > > If a module has functions split out into separate text sections > > > (i.e. compiled with the -ffunction-sections flag), reorder the > > > functions to provide some code diversification to modules. > > > > > > > Is that the only prerequisite? I.e., is it sufficient for another > > architecture to add -ffunction-sections to the module CFLAGS to get > > this functionality? (assuming it defines CONFIG_FG_KASLR=y) > > I think it would work for modules. I've not tested this of course. It > might not make sense for some architectures (like 32 bit), but it > would > probably work. > > > > Signed-off-by: Kristen Carlson Accardi <kristen@linux.intel.com> > > > Reviewed-by: Kees Cook <keescook@chromium.org> > > > --- > > > kernel/module.c | 82 > > > +++++++++++++++++++++++++++++++++++++++++++++++++ > > > 1 file changed, 82 insertions(+) > > > > > > diff --git a/kernel/module.c b/kernel/module.c > > > index 646f1e2330d2..e432ec5f6df4 100644 > > > --- a/kernel/module.c > > > +++ b/kernel/module.c > > > @@ -53,6 +53,8 @@ > > > #include <linux/bsearch.h> > > > #include <linux/dynamic_debug.h> > > > #include <linux/audit.h> > > > +#include <linux/random.h> > > > +#include <asm/setup.h> > > > #include <uapi/linux/module.h> > > > #include "module-internal.h" > > > > > > @@ -2370,6 +2372,83 @@ static long get_offset(struct module *mod, > > > unsigned int *size, > > > return ret; > > > } > > > > > > +/* > > > + * shuffle_text_list() > > > + * Use a Fisher Yates algorithm to shuffle a list of text > > > sections. > > > + */ > > > +static void shuffle_text_list(Elf_Shdr **list, int size) > > > +{ > > > + int i; > > > + unsigned int j; > > > + Elf_Shdr *temp; > > > + > > > + for (i = size - 1; i > 0; i--) { > > > + /* > > > + * pick a random index from 0 to i > > > + */ > > > + get_random_bytes(&j, sizeof(j)); > > > + j = j % (i + 1); > > > + > > > + temp = list[i]; > > > + list[i] = list[j]; > > > + list[j] = temp; > > > + } > > > +} > > > + > > > +/* > > > + * randomize_text() > > > + * Look through the core section looking for executable code > > > sections. > > > + * Store sections in an array and then shuffle the sections > > > + * to reorder the functions. > > > + */ > > > +static void randomize_text(struct module *mod, struct load_info > > > *info) > > > +{ > > > + int i; > > > + int num_text_sections = 0; > > > + Elf_Shdr **text_list; > > > + int size = 0; > > > + int max_sections = info->hdr->e_shnum; > > > + unsigned int sec = find_sec(info, ".text"); > > > + > > > + if (sec == 0) > > > + return; > > > + > > > + text_list = kmalloc_array(max_sections, > > > sizeof(*text_list), > > > GFP_KERNEL); > > > + if (text_list == NULL) > > > + return; > > > + > > > + for (i = 0; i < max_sections; i++) { > > > + Elf_Shdr *shdr = &info->sechdrs[i]; > > > + const char *sname = info->secstrings + shdr- > > > > sh_name; > > > + > > > + if (!(shdr->sh_flags & SHF_ALLOC) || > > > + !(shdr->sh_flags & SHF_EXECINSTR) || > > > + strstarts(sname, ".init")) > > > + continue; > > > + > > > + text_list[num_text_sections] = shdr; > > > + num_text_sections++; > > > + } > > > + > > > + shuffle_text_list(text_list, num_text_sections); > > > + > > > + for (i = 0; i < num_text_sections; i++) { > > > + Elf_Shdr *shdr = text_list[i]; > > > + > > > + /* > > > + * get_offset has a section index for it's last > > > + * argument, that is only used by > > > arch_mod_section_prepend(), > > > + * which is only defined by parisc. Since this > > > this > > > type > > > + * of randomization isn't supported on parisc, we > > > can > > > + * safely pass in zero as the last argument, as > > > it > > > is > > > + * ignored. > > > + */ > > > + shdr->sh_entsize = get_offset(mod, &size, shdr, > > > 0); > > > + } > > > + > > > + kfree(text_list); > > > +} > > > + > > > /* Lay out the SHF_ALLOC sections in a way not dissimilar to how > > > ld > > > might -- code, read-only data, read-write data, small > > > data. Tally > > > sizes, and place the offsets into sh_entsize fields: high bit > > > means it > > > @@ -2460,6 +2539,9 @@ static void layout_sections(struct module > > > *mod, struct load_info *info) > > > break; > > > } > > > } > > > + > > > + if (IS_ENABLED(CONFIG_FG_KASLR) && kaslr_enabled()) > > > > kaslr_enabled() only exists [as a function] on x86 > > CONFIG_FG_KASLR is dependant on x86_64. If people really think there > is > value in having the module randomization not dependent on the kernel > randomization it can be changed to a different config option - but I > am > not sure that there is a ton of value in the module randomization on > it's own. I should have added - thank you for pointing this out, I will fix it in the next version. I was on a tangent about whether you should even use this without the main kernel randomization :).
On Mon, 20 Apr 2020 at 19:59, Kristen Carlson Accardi <kristen@linux.intel.com> wrote: > > On Mon, 2020-04-20 at 10:56 -0700, Kristen Carlson Accardi wrote: > > On Mon, 2020-04-20 at 14:01 +0200, Ard Biesheuvel wrote: > > > On Wed, 15 Apr 2020 at 23:07, Kristen Carlson Accardi > > > <kristen@linux.intel.com> wrote: > > > > If a module has functions split out into separate text sections > > > > (i.e. compiled with the -ffunction-sections flag), reorder the > > > > functions to provide some code diversification to modules. > > > > > > > > > > Is that the only prerequisite? I.e., is it sufficient for another > > > architecture to add -ffunction-sections to the module CFLAGS to get > > > this functionality? (assuming it defines CONFIG_FG_KASLR=y) > > > > I think it would work for modules. I've not tested this of course. It > > might not make sense for some architectures (like 32 bit), but it > > would > > probably work. > > > > > > Signed-off-by: Kristen Carlson Accardi <kristen@linux.intel.com> > > > > Reviewed-by: Kees Cook <keescook@chromium.org> > > > > --- > > > > kernel/module.c | 82 > > > > +++++++++++++++++++++++++++++++++++++++++++++++++ > > > > 1 file changed, 82 insertions(+) > > > > > > > > diff --git a/kernel/module.c b/kernel/module.c > > > > index 646f1e2330d2..e432ec5f6df4 100644 > > > > --- a/kernel/module.c > > > > +++ b/kernel/module.c > > > > @@ -53,6 +53,8 @@ > > > > #include <linux/bsearch.h> > > > > #include <linux/dynamic_debug.h> > > > > #include <linux/audit.h> > > > > +#include <linux/random.h> > > > > +#include <asm/setup.h> > > > > #include <uapi/linux/module.h> > > > > #include "module-internal.h" > > > > > > > > @@ -2370,6 +2372,83 @@ static long get_offset(struct module *mod, > > > > unsigned int *size, > > > > return ret; > > > > } > > > > > > > > +/* > > > > + * shuffle_text_list() > > > > + * Use a Fisher Yates algorithm to shuffle a list of text > > > > sections. > > > > + */ > > > > +static void shuffle_text_list(Elf_Shdr **list, int size) > > > > +{ > > > > + int i; > > > > + unsigned int j; > > > > + Elf_Shdr *temp; > > > > + > > > > + for (i = size - 1; i > 0; i--) { > > > > + /* > > > > + * pick a random index from 0 to i > > > > + */ > > > > + get_random_bytes(&j, sizeof(j)); > > > > + j = j % (i + 1); > > > > + > > > > + temp = list[i]; > > > > + list[i] = list[j]; > > > > + list[j] = temp; > > > > + } > > > > +} > > > > + > > > > +/* > > > > + * randomize_text() > > > > + * Look through the core section looking for executable code > > > > sections. > > > > + * Store sections in an array and then shuffle the sections > > > > + * to reorder the functions. > > > > + */ > > > > +static void randomize_text(struct module *mod, struct load_info > > > > *info) > > > > +{ > > > > + int i; > > > > + int num_text_sections = 0; > > > > + Elf_Shdr **text_list; > > > > + int size = 0; > > > > + int max_sections = info->hdr->e_shnum; > > > > + unsigned int sec = find_sec(info, ".text"); > > > > + > > > > + if (sec == 0) > > > > + return; > > > > + > > > > + text_list = kmalloc_array(max_sections, > > > > sizeof(*text_list), > > > > GFP_KERNEL); > > > > + if (text_list == NULL) > > > > + return; > > > > + > > > > + for (i = 0; i < max_sections; i++) { > > > > + Elf_Shdr *shdr = &info->sechdrs[i]; > > > > + const char *sname = info->secstrings + shdr- > > > > > sh_name; > > > > + > > > > + if (!(shdr->sh_flags & SHF_ALLOC) || > > > > + !(shdr->sh_flags & SHF_EXECINSTR) || > > > > + strstarts(sname, ".init")) > > > > + continue; > > > > + > > > > + text_list[num_text_sections] = shdr; > > > > + num_text_sections++; > > > > + } > > > > + > > > > + shuffle_text_list(text_list, num_text_sections); > > > > + > > > > + for (i = 0; i < num_text_sections; i++) { > > > > + Elf_Shdr *shdr = text_list[i]; > > > > + > > > > + /* > > > > + * get_offset has a section index for it's last > > > > + * argument, that is only used by > > > > arch_mod_section_prepend(), > > > > + * which is only defined by parisc. Since this > > > > this > > > > type > > > > + * of randomization isn't supported on parisc, we > > > > can > > > > + * safely pass in zero as the last argument, as > > > > it > > > > is > > > > + * ignored. > > > > + */ > > > > + shdr->sh_entsize = get_offset(mod, &size, shdr, > > > > 0); > > > > + } > > > > + > > > > + kfree(text_list); > > > > +} > > > > + > > > > /* Lay out the SHF_ALLOC sections in a way not dissimilar to how > > > > ld > > > > might -- code, read-only data, read-write data, small > > > > data. Tally > > > > sizes, and place the offsets into sh_entsize fields: high bit > > > > means it > > > > @@ -2460,6 +2539,9 @@ static void layout_sections(struct module > > > > *mod, struct load_info *info) > > > > break; > > > > } > > > > } > > > > + > > > > + if (IS_ENABLED(CONFIG_FG_KASLR) && kaslr_enabled()) > > > > > > kaslr_enabled() only exists [as a function] on x86 > > > > CONFIG_FG_KASLR is dependant on x86_64. If people really think there > > is > > value in having the module randomization not dependent on the kernel > > randomization it can be changed to a different config option - but I > > am > > not sure that there is a ton of value in the module randomization on > > it's own. > I think there is. The modules are a sizable attack surface, and made up of drivers for a large part, many of which are not as carefully reviewed as core code. Also, as I pointed out, the ELF loading trick from the decompressor is simply infeasible on arm64, given that there is no decompressor in the first place. > I should have added - thank you for pointing this out, I will fix it in > the next version. I was on a tangent about whether you should even use > this without the main kernel randomization :). > Yeah. I was just pointing out that this breaks the build for all other architectures :-)
On Wed, 2020-04-22 at 18:22 +0200, Ard Biesheuvel wrote: > On Mon, 20 Apr 2020 at 19:59, Kristen Carlson Accardi > <kristen@linux.intel.com> wrote: > > On Mon, 2020-04-20 at 10:56 -0700, Kristen Carlson Accardi wrote: > > > On Mon, 2020-04-20 at 14:01 +0200, Ard Biesheuvel wrote: > > > > On Wed, 15 Apr 2020 at 23:07, Kristen Carlson Accardi > > > > <kristen@linux.intel.com> wrote: > > > > > If a module has functions split out into separate text > > > > > sections > > > > > (i.e. compiled with the -ffunction-sections flag), reorder > > > > > the > > > > > functions to provide some code diversification to modules. > > > > > > > > > > > > > Is that the only prerequisite? I.e., is it sufficient for > > > > another > > > > architecture to add -ffunction-sections to the module CFLAGS to > > > > get > > > > this functionality? (assuming it defines CONFIG_FG_KASLR=y) > > > > > > I think it would work for modules. I've not tested this of > > > course. It > > > might not make sense for some architectures (like 32 bit), but it > > > would > > > probably work. > > > > > > > > Signed-off-by: Kristen Carlson Accardi < > > > > > kristen@linux.intel.com> > > > > > Reviewed-by: Kees Cook <keescook@chromium.org> > > > > > --- > > > > > kernel/module.c | 82 > > > > > +++++++++++++++++++++++++++++++++++++++++++++++++ > > > > > 1 file changed, 82 insertions(+) > > > > > > > > > > diff --git a/kernel/module.c b/kernel/module.c > > > > > index 646f1e2330d2..e432ec5f6df4 100644 > > > > > --- a/kernel/module.c > > > > > +++ b/kernel/module.c > > > > > @@ -53,6 +53,8 @@ > > > > > #include <linux/bsearch.h> > > > > > #include <linux/dynamic_debug.h> > > > > > #include <linux/audit.h> > > > > > +#include <linux/random.h> > > > > > +#include <asm/setup.h> > > > > > #include <uapi/linux/module.h> > > > > > #include "module-internal.h" > > > > > > > > > > @@ -2370,6 +2372,83 @@ static long get_offset(struct module > > > > > *mod, > > > > > unsigned int *size, > > > > > return ret; > > > > > } > > > > > > > > > > +/* > > > > > + * shuffle_text_list() > > > > > + * Use a Fisher Yates algorithm to shuffle a list of text > > > > > sections. > > > > > + */ > > > > > +static void shuffle_text_list(Elf_Shdr **list, int size) > > > > > +{ > > > > > + int i; > > > > > + unsigned int j; > > > > > + Elf_Shdr *temp; > > > > > + > > > > > + for (i = size - 1; i > 0; i--) { > > > > > + /* > > > > > + * pick a random index from 0 to i > > > > > + */ > > > > > + get_random_bytes(&j, sizeof(j)); > > > > > + j = j % (i + 1); > > > > > + > > > > > + temp = list[i]; > > > > > + list[i] = list[j]; > > > > > + list[j] = temp; > > > > > + } > > > > > +} > > > > > + > > > > > +/* > > > > > + * randomize_text() > > > > > + * Look through the core section looking for executable code > > > > > sections. > > > > > + * Store sections in an array and then shuffle the sections > > > > > + * to reorder the functions. > > > > > + */ > > > > > +static void randomize_text(struct module *mod, struct > > > > > load_info > > > > > *info) > > > > > +{ > > > > > + int i; > > > > > + int num_text_sections = 0; > > > > > + Elf_Shdr **text_list; > > > > > + int size = 0; > > > > > + int max_sections = info->hdr->e_shnum; > > > > > + unsigned int sec = find_sec(info, ".text"); > > > > > + > > > > > + if (sec == 0) > > > > > + return; > > > > > + > > > > > + text_list = kmalloc_array(max_sections, > > > > > sizeof(*text_list), > > > > > GFP_KERNEL); > > > > > + if (text_list == NULL) > > > > > + return; > > > > > + > > > > > + for (i = 0; i < max_sections; i++) { > > > > > + Elf_Shdr *shdr = &info->sechdrs[i]; > > > > > + const char *sname = info->secstrings + shdr- > > > > > > sh_name; > > > > > + > > > > > + if (!(shdr->sh_flags & SHF_ALLOC) || > > > > > + !(shdr->sh_flags & SHF_EXECINSTR) || > > > > > + strstarts(sname, ".init")) > > > > > + continue; > > > > > + > > > > > + text_list[num_text_sections] = shdr; > > > > > + num_text_sections++; > > > > > + } > > > > > + > > > > > + shuffle_text_list(text_list, num_text_sections); > > > > > + > > > > > + for (i = 0; i < num_text_sections; i++) { > > > > > + Elf_Shdr *shdr = text_list[i]; > > > > > + > > > > > + /* > > > > > + * get_offset has a section index for it's > > > > > last > > > > > + * argument, that is only used by > > > > > arch_mod_section_prepend(), > > > > > + * which is only defined by parisc. Since > > > > > this > > > > > this > > > > > type > > > > > + * of randomization isn't supported on > > > > > parisc, we > > > > > can > > > > > + * safely pass in zero as the last argument, > > > > > as > > > > > it > > > > > is > > > > > + * ignored. > > > > > + */ > > > > > + shdr->sh_entsize = get_offset(mod, &size, > > > > > shdr, > > > > > 0); > > > > > + } > > > > > + > > > > > + kfree(text_list); > > > > > +} > > > > > + > > > > > /* Lay out the SHF_ALLOC sections in a way not dissimilar to > > > > > how > > > > > ld > > > > > might -- code, read-only data, read-write data, small > > > > > data. Tally > > > > > sizes, and place the offsets into sh_entsize fields: high > > > > > bit > > > > > means it > > > > > @@ -2460,6 +2539,9 @@ static void layout_sections(struct > > > > > module > > > > > *mod, struct load_info *info) > > > > > break; > > > > > } > > > > > } > > > > > + > > > > > + if (IS_ENABLED(CONFIG_FG_KASLR) && kaslr_enabled()) > > > > > > > > kaslr_enabled() only exists [as a function] on x86 > > > > > > CONFIG_FG_KASLR is dependant on x86_64. If people really think > > > there > > > is > > > value in having the module randomization not dependent on the > > > kernel > > > randomization it can be changed to a different config option - > > > but I > > > am > > > not sure that there is a ton of value in the module randomization > > > on > > > it's own. > > I think there is. The modules are a sizable attack surface, and made > up of drivers for a large part, many of which are not as carefully > reviewed as core code. Also, as I pointed out, the ELF loading trick > from the decompressor is simply infeasible on arm64, given that there > is no decompressor in the first place. I can make a separate config option for modules so that you can enable this separately from the main kernel text randomization. I'll make that change for v2.
diff --git a/kernel/module.c b/kernel/module.c index 646f1e2330d2..e432ec5f6df4 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -53,6 +53,8 @@ #include <linux/bsearch.h> #include <linux/dynamic_debug.h> #include <linux/audit.h> +#include <linux/random.h> +#include <asm/setup.h> #include <uapi/linux/module.h> #include "module-internal.h" @@ -2370,6 +2372,83 @@ static long get_offset(struct module *mod, unsigned int *size, return ret; } +/* + * shuffle_text_list() + * Use a Fisher Yates algorithm to shuffle a list of text sections. + */ +static void shuffle_text_list(Elf_Shdr **list, int size) +{ + int i; + unsigned int j; + Elf_Shdr *temp; + + for (i = size - 1; i > 0; i--) { + /* + * pick a random index from 0 to i + */ + get_random_bytes(&j, sizeof(j)); + j = j % (i + 1); + + temp = list[i]; + list[i] = list[j]; + list[j] = temp; + } +} + +/* + * randomize_text() + * Look through the core section looking for executable code sections. + * Store sections in an array and then shuffle the sections + * to reorder the functions. + */ +static void randomize_text(struct module *mod, struct load_info *info) +{ + int i; + int num_text_sections = 0; + Elf_Shdr **text_list; + int size = 0; + int max_sections = info->hdr->e_shnum; + unsigned int sec = find_sec(info, ".text"); + + if (sec == 0) + return; + + text_list = kmalloc_array(max_sections, sizeof(*text_list), GFP_KERNEL); + if (text_list == NULL) + return; + + for (i = 0; i < max_sections; i++) { + Elf_Shdr *shdr = &info->sechdrs[i]; + const char *sname = info->secstrings + shdr->sh_name; + + if (!(shdr->sh_flags & SHF_ALLOC) || + !(shdr->sh_flags & SHF_EXECINSTR) || + strstarts(sname, ".init")) + continue; + + text_list[num_text_sections] = shdr; + num_text_sections++; + } + + shuffle_text_list(text_list, num_text_sections); + + for (i = 0; i < num_text_sections; i++) { + Elf_Shdr *shdr = text_list[i]; + + /* + * get_offset has a section index for it's last + * argument, that is only used by arch_mod_section_prepend(), + * which is only defined by parisc. Since this this type + * of randomization isn't supported on parisc, we can + * safely pass in zero as the last argument, as it is + * ignored. + */ + shdr->sh_entsize = get_offset(mod, &size, shdr, 0); + } + + kfree(text_list); +} + /* Lay out the SHF_ALLOC sections in a way not dissimilar to how ld might -- code, read-only data, read-write data, small data. Tally sizes, and place the offsets into sh_entsize fields: high bit means it @@ -2460,6 +2539,9 @@ static void layout_sections(struct module *mod, struct load_info *info) break; } } + + if (IS_ENABLED(CONFIG_FG_KASLR) && kaslr_enabled()) + randomize_text(mod, info); } static void set_license(struct module *mod, const char *license)