From patchwork Tue Jun 7 21:57:06 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 9162669 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 2363060467 for ; Tue, 7 Jun 2016 21:57:59 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 145652832C for ; Tue, 7 Jun 2016 21:57:59 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 07DEE2836D; Tue, 7 Jun 2016 21:57:59 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id F3A3A2832C for ; Tue, 7 Jun 2016 21:57:57 +0000 (UTC) Received: (qmail 6124 invoked by uid 550); 7 Jun 2016 21:57:49 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: kernel-hardening@lists.openwall.com Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 5711 invoked from network); 7 Jun 2016 21:57:25 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=Iurbb0/j5dn1gQv2Jb0oq5MpgQOobEpDyT6+8a9YaOA=; b=OKn+QJC6v3QXFvqq4jX87foyRZwLI6nrNACOS//CzVcp5gFITiWPkHebXo/Rd7LTwV 912Ijk6AeRLfnkk/7dM0jYV+MPkiqor/wK2NBV6ZTIWQmxr6dBirl9e4P2V9BE9opkrQ gJF1c12cxbpJ1YgrIUpyzjnpLlG5nhYzCRABs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=Iurbb0/j5dn1gQv2Jb0oq5MpgQOobEpDyT6+8a9YaOA=; b=Ht384r5SXHrSOj2VBtPQ1hq3Tk4tJaDC6FpTPyy9YVsPx3VI0KDPYJ81kDL9zVmjIo 3Zm0yvsgLS08m+ZEmXKXP6and+x4c/9V7INc2AewyP+SGlJ0kayMi06b7r78YAbig+0e a6/bjtZA/H852PyK6RUjNfzadtth4o2p0n49Y1IyGT5YweOw6ZWh/V9E+BkCRc7Tx46w oJOpXRfrRD0noPSJwqfEK5pP5fFB4qP1ir/yd/HdO+ujjWkedXisHufcL1WDtwXUqVav J8PO1rM8iTCk+wv0TptK8Sla/rQauUjfyW3u8FIDfHeq30l9jYaXdM/phDTNVl0HWqQ8 zPLg== X-Gm-Message-State: ALyK8tILPouN2f+cIS/dpERJWxO1CBWbxeBVsgso3OkNCxwUR9H87uta58ywludMOHMpFBUi X-Received: by 10.98.89.7 with SMTP id n7mr1704170pfb.113.1465336633511; Tue, 07 Jun 2016 14:57:13 -0700 (PDT) From: Kees Cook To: kernel-hardening@lists.openwall.com Cc: Kees Cook , Arnd Bergmann , Greg Kroah-Hartman , Andrew Morton , "David S. Miller" , Mauro Carvalho Chehab , Jiri Slaby , Guenter Roeck , linux-kernel@vger.kernel.org Date: Tue, 7 Jun 2016 14:57:06 -0700 Message-Id: <1465336628-18219-4-git-send-email-keescook@chromium.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1465336628-18219-1-git-send-email-keescook@chromium.org> References: <1465336628-18219-1-git-send-email-keescook@chromium.org> Subject: [kernel-hardening] [PATCH 3/5] lkdtm: add function for testing .rodata section X-Virus-Scanned: ClamAV using ClamSMTP This adds a function that lives in the .rodata section. The section flags are corrected using objcopy since there is no way with gcc to declare section flags in an architecture-agnostic way. Signed-off-by: Kees Cook --- drivers/misc/Makefile | 7 +++++++ drivers/misc/lkdtm.h | 6 ++++++ drivers/misc/lkdtm_core.c | 24 +++++++++++++++++------- drivers/misc/lkdtm_rodata.c | 10 ++++++++++ 4 files changed, 40 insertions(+), 7 deletions(-) create mode 100644 drivers/misc/lkdtm.h create mode 100644 drivers/misc/lkdtm_rodata.c diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile index c3cb6ad8cc37..b2d3d68dfa22 100644 --- a/drivers/misc/Makefile +++ b/drivers/misc/Makefile @@ -59,3 +59,10 @@ obj-$(CONFIG_CXL_BASE) += cxl/ obj-$(CONFIG_PANEL) += panel.o lkdtm-$(CONFIG_LKDTM) += lkdtm_core.o +lkdtm-$(CONFIG_LKDTM) += lkdtm_rodata_objcopy.o + +OBJCOPYFLAGS_lkdtm_rodata_objcopy.o := \ + --set-section-flags .text=alloc,readonly \ + --rename-section .text=.rodata +$(obj)/lkdtm_rodata_objcopy.o: $(obj)/lkdtm_rodata.o + $(call if_changed,objcopy) diff --git a/drivers/misc/lkdtm.h b/drivers/misc/lkdtm.h new file mode 100644 index 000000000000..9531fa3be4c3 --- /dev/null +++ b/drivers/misc/lkdtm.h @@ -0,0 +1,6 @@ +#ifndef __LKDTM_H +#define __LKDTM_H + +void lkdtm_rodata_do_nothing(void); + +#endif diff --git a/drivers/misc/lkdtm_core.c b/drivers/misc/lkdtm_core.c index 605050c60f10..187cd9b63e9a 100644 --- a/drivers/misc/lkdtm_core.c +++ b/drivers/misc/lkdtm_core.c @@ -52,6 +52,8 @@ #include #endif +#include "lkdtm.h" + /* * Make sure our attempts to over run the kernel stack doesn't trigger * a compiler warning when CONFIG_FRAME_WARN is set. Then make sure we @@ -103,6 +105,7 @@ enum ctype { CT_EXEC_STACK, CT_EXEC_KMALLOC, CT_EXEC_VMALLOC, + CT_EXEC_RODATA, CT_EXEC_USERSPACE, CT_ACCESS_USERSPACE, CT_WRITE_RO, @@ -145,6 +148,7 @@ static char* cp_type[] = { "EXEC_STACK", "EXEC_KMALLOC", "EXEC_VMALLOC", + "EXEC_RODATA", "EXEC_USERSPACE", "ACCESS_USERSPACE", "WRITE_RO", @@ -346,15 +350,18 @@ static noinline void corrupt_stack(void) memset((void *)data, 0, 64); } -static void noinline execute_location(void *dst) +static noinline void execute_location(void *dst, bool write) { void (*func)(void) = dst; pr_info("attempting ok execution at %p\n", do_nothing); do_nothing(); - memcpy(dst, do_nothing, EXEC_SIZE); - flush_icache_range((unsigned long)dst, (unsigned long)dst + EXEC_SIZE); + if (write) { + memcpy(dst, do_nothing, EXEC_SIZE); + flush_icache_range((unsigned long)dst, + (unsigned long)dst + EXEC_SIZE); + } pr_info("attempting bad execution at %p\n", func); func(); } @@ -551,25 +558,28 @@ static void lkdtm_do_action(enum ctype which) schedule(); break; case CT_EXEC_DATA: - execute_location(data_area); + execute_location(data_area, true); break; case CT_EXEC_STACK: { u8 stack_area[EXEC_SIZE]; - execute_location(stack_area); + execute_location(stack_area, true); break; } case CT_EXEC_KMALLOC: { u32 *kmalloc_area = kmalloc(EXEC_SIZE, GFP_KERNEL); - execute_location(kmalloc_area); + execute_location(kmalloc_area, true); kfree(kmalloc_area); break; } case CT_EXEC_VMALLOC: { u32 *vmalloc_area = vmalloc(EXEC_SIZE); - execute_location(vmalloc_area); + execute_location(vmalloc_area, true); vfree(vmalloc_area); break; } + case CT_EXEC_RODATA: + execute_location(lkdtm_rodata_do_nothing, false); + break; case CT_EXEC_USERSPACE: { unsigned long user_addr; diff --git a/drivers/misc/lkdtm_rodata.c b/drivers/misc/lkdtm_rodata.c new file mode 100644 index 000000000000..4d0d851f02b9 --- /dev/null +++ b/drivers/misc/lkdtm_rodata.c @@ -0,0 +1,10 @@ +/* + * This includes functions that are meant to live entirely in .rodata + * (via objcopy tricks), to validate the non-executability of .rodata. + */ +#include + +void lkdtm_rodata_do_nothing(void) +{ + /* Does nothing. We just want an architecture agnostic "return". */ +}