@@ -251,10 +251,16 @@ void arch_dup_pkeys(struct mm_struct *oldmm, struct mm_struct *mm);
static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,
bool write, bool execute, bool foreign)
{
+#ifdef CONFIG_PROTECT_READONLY_USER_MEMORY
+ /* Forbid write to PROT_READ pages of foreign process */
+ if (write && foreign && (!(vma->vm_flags & VM_WRITE))) {
+ return false;
+ }
+#endif
/* by default, allow everything */
return true;
}
-
+#endif
#define pkey_mm_init(mm)
#define thread_pkey_regs_save(thread)
#define thread_pkey_regs_restore(new_thread, old_thread)
@@ -406,6 +406,12 @@ static inline bool vma_is_foreign(struct vm_area_struct *vma)
bool arch_vma_access_permitted(struct vm_area_struct *vma, bool write,
bool execute, bool foreign)
{
+#ifdef CONFIG_PROTECT_READONLY_USER_MEMORY
+ /* Forbid write to PROT_READ pages of foreign process */
+ if (write && foreign && (!(vma->vm_flags & VM_WRITE))) {
+ return false;
+ }
+#endif
if (static_branch_likely(&pkey_disabled))
return true;
/*
@@ -29,14 +29,18 @@ static inline void arch_bprm_mm_init(struct mm_struct *mm,
struct vm_area_struct *vma)
{
}
-
static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,
bool write, bool execute, bool foreign)
{
+#ifdef CONFIG_PROTECT_READONLY_USER_MEMORY
+ /* Forbid write to PROT_READ pages of foreign process */
+ if (write && foreign && (!(vma->vm_flags & VM_WRITE))) {
+ return false;
+ }
+#endif
/* by default, allow everything */
return true;
}
-
/*
* end asm-generic/mm_hooks.h functions
*/
@@ -97,7 +97,13 @@ static inline void arch_bprm_mm_init(struct mm_struct *mm,
static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,
bool write, bool execute, bool foreign)
{
+#ifdef CONFIG_PROTECT_READONLY_USER_MEMORY
+ /* Forbid write to PROT_READ pages of foreign process */
+ if (write && foreign && (!(vma->vm_flags & VM_WRITE))) {
+ return false;
+ }
+#endif
/* by default, allow everything */
return true;
}
-#endif
+#endif /*__UNICORE_MMU_CONTEXT_H__*/
@@ -329,12 +329,20 @@ static inline bool vma_is_foreign(struct vm_area_struct *vma)
static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,
bool write, bool execute, bool foreign)
{
- /* pkeys never affect instruction fetches */
+#ifdef CONFIG_PROTECT_READONLY_USER_MEMORY
+ /* Forbid write to PROT_READ pages of foreign process */
+ if (write && foreign && (!(vma->vm_flags & VM_WRITE))) {
+ return false;
+ }
+#endif
+ /* Don't check PKRU since pkeys never affect instruction fetches */
if (execute)
return true;
+
/* allow access if the VMA is not one from this process */
if (foreign || vma_is_foreign(vma))
return true;
+
return __pkru_allows_pkey(vma_pkey(vma), write);
}
@@ -30,6 +30,12 @@ static inline void arch_bprm_mm_init(struct mm_struct *mm,
static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,
bool write, bool execute, bool foreign)
{
+#ifdef CONFIG_PROTECT_READONLY_USER_MEMORY
+ /* Forbid write to PROT_READ pages of foreign process */
+ if (write && foreign && (!(vma->vm_flags & VM_WRITE))) {
+ return false;
+ }
+#endif
/* by default, allow everything */
return true;
}
@@ -143,6 +143,16 @@ config LSM_MMAP_MIN_ADDR
this low address space will need the permission specific to the
systems running LSM.
+config PROTECT_READONLY_USER_MEMORY
+ bool "Protect read only process memory"
+ help
+ Protects read only memory of process code and PLT table from possible attack
+ through /proc/PID/mem or through /dev/mem.
+ Disables breakpoints of debuggers(prtace,gdb)
+ Forbid writes to READ ONLY user pages of foreign process
+ Mostly advised for embedded and production system.
+
+
config HAVE_HARDENED_USERCOPY_ALLOCATOR
bool
help
The purpose of this patch is produce hardened kernel for Embedded or Production systems. Typically debuggers, such as gdb, write to read-only code [text] sections of target process.(ptrace) This kind of page protectiion violation raises minor page fault, but kernel's fault handler allows it by default. This is clearly attack surface for adversary. The proposed kernel hardening configuration option checks the type of protection of the foregn vma and blocks writes to read only vma. When enabled, it will stop attacks modifying code or jump tables, etc. Code of arch_vma_access_permitted() function was extended to check foreign vma flags. Tested on x86_64 and ARM(QEMU) with dd command which writes to /proc/PID/mem in r--p or r--xp of vma area addresses range dd reports IO failure when tries to write to adress taken from from /proc/PID/maps (PLT or code section) Signed-off-by: Lev Olshvang <levonshe@yandex.com> --- arch/powerpc/include/asm/mmu_context.h | 8 +++++++- arch/powerpc/mm/book3s64/pkeys.c | 6 ++++++ arch/um/include/asm/mmu_context.h | 8 ++++++-- arch/unicore32/include/asm/mmu_context.h | 8 +++++++- arch/x86/include/asm/mmu_context.h | 10 +++++++++- include/asm-generic/mm_hooks.h | 6 ++++++ security/Kconfig | 10 ++++++++++ 7 files changed, 51 insertions(+), 5 deletions(-)