From patchwork Sat Mar 4 14:30:46 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 9603977 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 9B55560453 for ; Sat, 4 Mar 2017 14:32:00 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8B7272654B for ; Sat, 4 Mar 2017 14:32:00 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7EA7926E4D; Sat, 4 Mar 2017 14:32:00 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 7512C2654B for ; Sat, 4 Mar 2017 14:31:59 +0000 (UTC) Received: (qmail 17591 invoked by uid 550); 4 Mar 2017 14:31:43 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 16330 invoked from network); 4 Mar 2017 14:31:40 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=MBuawuC7wHmuQtoDFwiEa+08uzwXYwD8ZyejKcRGzYA=; b=Q9nAONPaUUmG5RMr8zVOoQrncoyWku7MCKDXd+zWP3CQr9t6EmXcwxr3Yl96EpdgYo hmf5fVqsK28gNAzZEPByA0V0+GTebL41jP/Z8s+JpdR+a2hPoLydNlx+ijb/tqQQ9zNi xmIjH1ZOZw/HyFhWzwBoA57qhxzBhO3PQjkec= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=MBuawuC7wHmuQtoDFwiEa+08uzwXYwD8ZyejKcRGzYA=; b=FAXkF49wJtrlnKzdHYv3nZW1scgS9mUfS+f+QPsGS8eoiBiloMUOuG4rFaQLZyfxIK 3ig0KDzCa1opq2sqUkMZzIAQL9+2AkiyqZFIPkJTDGWkvdNez85ZDywtlfTCkqdIlWd/ VDltqgGUnfSsU74ArnfIoQBwi7Pc6uGqfXtw977g4OkPGn0R4dbJgQShgjOarN/Efhhe 7NqflQFRnzSawiTbZES3I+w+YkRad+0x1wP7+Z+5855iM9SNtMkC/zpoApfp0PTMpy+o JGn1zL6CMVx5c1AC8uqe/9TnUbJU8WZ20XLGgHyZK0a7ZdHcqXRIDeeVjYCxg6vTc7gT bnpw== X-Gm-Message-State: AMke39mV9PZoAoIcB7aQRAAtY2JPb5wqGAHIL5QTCbqGTubvzJhoawpu4K5aGkkHlRNmPnVu X-Received: by 10.223.134.98 with SMTP id 31mr7957679wrw.69.1488637889307; Sat, 04 Mar 2017 06:31:29 -0800 (PST) From: Ard Biesheuvel To: linux-arm-kernel@lists.infradead.org, kernel-hardening@lists.openwall.com, mark.rutland@arm.com, catalin.marinas@arm.com, will.deacon@arm.com, labbott@fedoraproject.org Cc: kvmarm@lists.cs.columbia.edu, marc.zyngier@arm.com, keescook@chromium.org, andre.przywara@arm.com, james.morse@arm.com, suzuki.poulose@arm.com, Ard Biesheuvel Date: Sat, 4 Mar 2017 14:30:46 +0000 Message-Id: <1488637848-13588-5-git-send-email-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1488637848-13588-1-git-send-email-ard.biesheuvel@linaro.org> References: <1488637848-13588-1-git-send-email-ard.biesheuvel@linaro.org> Subject: [kernel-hardening] [PATCH v4 4/6] arm64: mmu: map .text as read-only from the outset X-Virus-Scanned: ClamAV using ClamSMTP Now that alternatives patching code no longer relies on the primary mapping of .text being writable, we can remove the code that removes the writable permissions post-init time, and map it read-only from the outset. To preserve the existing behavior under rodata=off, which is relied upon by external debuggers to manage software breakpoints (as pointed out by Mark), add an early_param() check for rodata=, and use RWX permissions if it set to 'off'. Reviewed-by: Laura Abbott Reviewed-by: Kees Cook Signed-off-by: Ard Biesheuvel Reviewed-by: Mark Rutland --- arch/arm64/mm/mmu.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c index df377fbe464e..edd982f88714 100644 --- a/arch/arm64/mm/mmu.c +++ b/arch/arm64/mm/mmu.c @@ -416,9 +416,6 @@ void mark_rodata_ro(void) { unsigned long section_size; - section_size = (unsigned long)_etext - (unsigned long)_text; - update_mapping_prot(__pa_symbol(_text), (unsigned long)_text, - section_size, PAGE_KERNEL_ROX); /* * mark .rodata as read only. Use __init_begin rather than __end_rodata * to cover NOTES and EXCEPTION_TABLE. @@ -451,6 +448,12 @@ static void __init map_kernel_segment(pgd_t *pgd, void *va_start, void *va_end, vm_area_add_early(vma); } +static int __init parse_rodata(char *arg) +{ + return strtobool(arg, &rodata_enabled); +} +early_param("rodata", parse_rodata); + /* * Create fine-grained mappings for the kernel. */ @@ -458,7 +461,9 @@ static void __init map_kernel(pgd_t *pgd) { static struct vm_struct vmlinux_text, vmlinux_rodata, vmlinux_init, vmlinux_data; - map_kernel_segment(pgd, _text, _etext, PAGE_KERNEL_EXEC, &vmlinux_text); + pgprot_t text_prot = rodata_enabled ? PAGE_KERNEL_ROX : PAGE_KERNEL_EXEC; + + map_kernel_segment(pgd, _text, _etext, text_prot, &vmlinux_text); map_kernel_segment(pgd, __start_rodata, __init_begin, PAGE_KERNEL, &vmlinux_rodata); map_kernel_segment(pgd, __init_begin, __init_end, PAGE_KERNEL_EXEC, &vmlinux_init);