From patchwork Mon Jun 19 20:56:38 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 9797817 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 9F6AB6020B for ; Mon, 19 Jun 2017 20:58:06 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A9C9328459 for ; Mon, 19 Jun 2017 20:58:06 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9E0F62846B; Mon, 19 Jun 2017 20:58:06 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id CCEFB28459 for ; Mon, 19 Jun 2017 20:58:04 +0000 (UTC) Received: (qmail 28256 invoked by uid 550); 19 Jun 2017 20:58:00 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Delivered-To: moderator for kernel-hardening@lists.openwall.com Received: (qmail 24574 invoked from network); 19 Jun 2017 20:57:05 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=NgBvquLYy51Re5bla2g6yL6nuiUHmIcnz6mK45EqFN4=; b=IvkyJ1RF2BioI6S7cspoEox52Gdn4amC3qaR96XVM9afrfaw9skFJBcuW6RD1NbUsH s4Qv9eKoy3QTKwZ+Q172HStFERAQTAa9EPioSgb9frvMTvXbwFJwDDcdKQAYEiiYxvmT jrvWx9q08yasqcTdIpkzwoiQCau+2pVGsK67c= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=NgBvquLYy51Re5bla2g6yL6nuiUHmIcnz6mK45EqFN4=; b=fWMXPcJ/m2j903Syla4+bCSUVyCl2Ownx/dj/JWmDFi13cw+YeTTCbOQYr4btYIe3w X1AcXlg+Rc4WW1BeW6VghOtglfPGXSETSH7/LjGrTJ7dOPdfkzDct9RiDbcUytKLDvO/ OVUe1RB3guwPi6764xO7ncUm5rQEZWyyF89TfsaMeOlLXuXrbxJh8/Al3b1GkyxzIYk/ nDScyd/o+iriLh2z0uxDgjfA3d0orPisQjwysjkkp9N1uNJ+qbeKyXGmWWGvE1gtx453 Yc0mYSD6qGd1MZOpCG4IhuukSR4aJ6tCJAgidJRJXczSp4MO4Owadj5PDG2btg1aVBZf OuSw== X-Gm-Message-State: AKS2vOyWz/4PUhMG28/Twr3PMixD4lloYBX2FMZZM1yh0xCR+S+lNxEd 3XqjM8QtAyK9l8lS X-Received: by 10.98.87.6 with SMTP id l6mr27518202pfb.233.1497905813809; Mon, 19 Jun 2017 13:56:53 -0700 (PDT) From: Kees Cook To: kernel-hardening@lists.openwall.com Cc: Kees Cook , Linus Torvalds , linux-kernel@vger.kernel.org Date: Mon, 19 Jun 2017 13:56:38 -0700 Message-Id: <1497905801-69164-2-git-send-email-keescook@chromium.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1497905801-69164-1-git-send-email-keescook@chromium.org> References: <1497905801-69164-1-git-send-email-keescook@chromium.org> Subject: [kernel-hardening] [PATCH 1/4] task_struct: Allow randomized layout X-Virus-Scanned: ClamAV using ClamSMTP This marks most of the layout of task_struct as randomizable, but leaves thread_info and scheduler state untouched at the start, and thread_struct untouched at the end. Other parts of the kernel use unnamed structures, but the 0-day builder using gcc-4.4 blows up on static initializers. Officially, it's documented as only working on gcc 4.6 and later, which further confuses me: https://gcc.gnu.org/wiki/C11Status The structure layout randomization already requires gcc 4.7, but instead of depending on the plugin being enabled, just check the gcc versions for wider build testing. At Linus's suggestion, the marking is hidden in a macro to reduce how ugly it looks. Additionally, indenting is left unchanged since it would make things harder to read. Randomization of task_struct is modified from Brad Spengler/PaX Team's code in the last public patch of grsecurity/PaX based on my understanding of the code. Changes or omissions from the original code are mine and don't reflect the original grsecurity/PaX code. Cc: Linus Torvalds Signed-off-by: Kees Cook --- include/linux/compiler-gcc.h | 13 ++++++++++++- include/linux/compiler.h | 5 +++++ include/linux/sched.h | 14 ++++++++++++++ 3 files changed, 31 insertions(+), 1 deletion(-) diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h index 7deaae3dc87d..c4a66c036692 100644 --- a/include/linux/compiler-gcc.h +++ b/include/linux/compiler-gcc.h @@ -231,6 +231,7 @@ #endif /* GCC_VERSION >= 40500 */ #if GCC_VERSION >= 40600 + /* * When used with Link Time Optimization, gcc can optimize away C functions or * variables which are referenced only from assembly code. __visible tells the @@ -238,7 +239,17 @@ * this. */ #define __visible __attribute__((externally_visible)) -#endif + +/* + * RANDSTRUCT_PLUGIN wants to use an anonymous struct, but it is only + * possible since GCC 4.6. To provide as much build testing coverage + * as possible, this is used for all GCC 4.6+ builds, and not just on + * RANDSTRUCT_PLUGIN builds. + */ +#define randomized_struct_fields_start struct { +#define randomized_struct_fields_end } __randomize_layout; + +#endif /* GCC_VERSION >= 40600 */ #if GCC_VERSION >= 40900 && !defined(__CHECKER__) diff --git a/include/linux/compiler.h b/include/linux/compiler.h index 55ee9ee814f8..0b4ac3e8c63e 100644 --- a/include/linux/compiler.h +++ b/include/linux/compiler.h @@ -456,6 +456,11 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s # define __no_randomize_layout #endif +#ifndef randomized_struct_fields_start +# define randomized_struct_fields_start +# define randomized_struct_fields_end +#endif + /* * Tell gcc if a function is cold. The compiler will assume any path * directly leading to the call is unlikely. diff --git a/include/linux/sched.h b/include/linux/sched.h index f833254fce00..e2ad3531e7fe 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -490,6 +490,13 @@ struct task_struct { #endif /* -1 unrunnable, 0 runnable, >0 stopped: */ volatile long state; + + /* + * This begins the randomizable portion of task_struct. Only + * scheduling-critical items should be added above here. + */ + randomized_struct_fields_start + void *stack; atomic_t usage; /* Per task flags (PF_*), defined further below: */ @@ -1051,6 +1058,13 @@ struct task_struct { /* Used by LSM modules for access restriction: */ void *security; #endif + + /* + * New fields for task_struct should be added above here, so that + * they are included in the randomized portion of task_struct. + */ + randomized_struct_fields_end + /* CPU-specific state of this task: */ struct thread_struct thread;