From patchwork Thu Sep 29 21:32:57 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Laura Abbott X-Patchwork-Id: 9357131 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id C8FB060757 for ; Thu, 29 Sep 2016 21:33:45 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B9CC729C58 for ; Thu, 29 Sep 2016 21:33:45 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id ADCC129C68; Thu, 29 Sep 2016 21:33:45 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 925B029C58 for ; Thu, 29 Sep 2016 21:33:44 +0000 (UTC) Received: (qmail 5644 invoked by uid 550); 29 Sep 2016 21:33:43 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: kernel-hardening@lists.openwall.com Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 5626 invoked from network); 29 Sep 2016 21:33:42 -0000 X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=oNock8pfJ3YfiZn6NhbJw3GZHF9OWtufDmxoaLBinpo=; b=dtGaEGheDV/cjU8GImUCKG/25mr+9lpyW3UT35v3yobLgQoXKiT6xyuNxgJi9mTH00 4PCgt+k/w9VfnaJw24koKlncU298X/01qO5XMjknswcdfQy+oqUh0kBD5GEe2gWolBoy I8rZJHuJM+kiOUV2MefNp6eZ9GytEfj9K7QVbAsZwXGIJp4Fg8Ndv2sG1teTGlU+xP70 Qo+VKxj0T+p4NagJHg6hvguW/P8ZIPBzA+qi7heFhz2tY3yzJF7rkisindSDOJ5Ctcka krOrLClaHTtEmUoQWokav5DwE3E5kjyXh12VVv7/rPrw3kYLnBBQksKUbeu8gXuUi0JM ChRA== X-Gm-Message-State: AA6/9RkZ/c+tj1CEfaUdbwMNoxC6etB0F38z5kYlDZuoTiLLqGGvtOCa5pCmkK2h40iY4fK7 X-Received: by 10.66.136.7 with SMTP id pw7mr5909972pab.87.1475184810491; Thu, 29 Sep 2016 14:33:30 -0700 (PDT) From: Laura Abbott To: AKASHI Takahiro , Mark Rutland , Ard Biesheuvel , David Brown , Will Deacon , Catalin Marinas Cc: Laura Abbott , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Kees Cook , kernel-hardening@lists.openwall.com Date: Thu, 29 Sep 2016 14:32:57 -0700 Message-Id: <20160929213257.30505-4-labbott@redhat.com> X-Mailer: git-send-email 2.10.0 In-Reply-To: <20160929213257.30505-1-labbott@redhat.com> References: <20160929213257.30505-1-labbott@redhat.com> Subject: [kernel-hardening] [PATCH 3/3] arm64: dump: Add checking for writable and exectuable pages X-Virus-Scanned: ClamAV using ClamSMTP Page mappings with full RWX permissions are a security risk. x86 has an option to walk the page tables and dump any bad pages. (See e1a58320a38d ("x86/mm: Warn on W^X mappings")). Add a similar implementation for arm64. Signed-off-by: Laura Abbott --- arch/arm64/Kconfig.debug | 28 ++++++++++++++++++++++++++++ arch/arm64/include/asm/ptdump.h | 10 ++++++++++ arch/arm64/mm/dump.c | 36 ++++++++++++++++++++++++++++++++++++ arch/arm64/mm/mmu.c | 2 ++ 4 files changed, 76 insertions(+) diff --git a/arch/arm64/Kconfig.debug b/arch/arm64/Kconfig.debug index 9015f02..037dba4 100644 --- a/arch/arm64/Kconfig.debug +++ b/arch/arm64/Kconfig.debug @@ -42,6 +42,34 @@ config ARM64_RANDOMIZE_TEXT_OFFSET of TEXT_OFFSET and platforms must not require a specific value. +config DEBUG_WX + bool "Warn on W+X mappings at boot" + select ARM64_PTDUMP_CORE + ---help--- + Generate a warning if any W+X mappings are found at boot. + + This is useful for discovering cases where the kernel is leaving + W+X mappings after applying NX, as such mappings are a security risk. + + Look for a message in dmesg output like this: + + arm64/mm: Checked W+X mappings: passed, no W+X pages found. + + or like this, if the check failed: + + arm64/mm: Checked W+X mappings: FAILED, W+X pages found. + + Note that even if the check fails, your kernel is possibly + still fine, as W+X mappings are not a security hole in + themselves, what they do is that they make the exploitation + of other unfixed kernel bugs easier. + + There is no runtime or memory usage effect of this option + once the kernel has booted up - it's a one time check. + + If in doubt, say "Y". + + config DEBUG_SET_MODULE_RONX bool "Set loadable kernel module data as NX and text as RO" depends on MODULES diff --git a/arch/arm64/include/asm/ptdump.h b/arch/arm64/include/asm/ptdump.h index b18a62c..e3c6bc0 100644 --- a/arch/arm64/include/asm/ptdump.h +++ b/arch/arm64/include/asm/ptdump.h @@ -20,6 +20,7 @@ #include #include +#include struct addr_marker { unsigned long start_address; @@ -31,6 +32,8 @@ struct ptdump_info { const struct addr_marker *markers; unsigned long base_addr; unsigned long max_addr; + /* Internal, do not touch */ + struct list_head node; }; int ptdump_register(struct ptdump_info *info, const char *name); @@ -44,6 +47,13 @@ static inline int ptdump_debugfs_create(struct ptdump_info *info, return 0; } #endif +void ptdump_check_wx(void); + +#ifdef CONFIG_DEBUG_WX +#define debug_checkwx() ptdump_check_wx() +#else +#define debug_checkwx() do { } while (0) +#endif #else static inline int ptdump_register(struct ptdump_info *info, const char *name) diff --git a/arch/arm64/mm/dump.c b/arch/arm64/mm/dump.c index e318f3d..b0b1dd6 100644 --- a/arch/arm64/mm/dump.c +++ b/arch/arm64/mm/dump.c @@ -29,6 +29,8 @@ #include #include +static LIST_HEAD(dump_info); + static const struct addr_marker address_markers[] = { #ifdef CONFIG_KASAN { KASAN_SHADOW_START, "Kasan shadow start" }, @@ -74,6 +76,8 @@ struct pg_state { unsigned long start_address; unsigned level; u64 current_prot; + bool check_wx; + unsigned long wx_pages; }; struct prot_bits { @@ -219,6 +223,15 @@ static void note_page(struct pg_state *st, unsigned long addr, unsigned level, unsigned long delta; if (st->current_prot) { + if (st->check_wx && + ((st->current_prot & PTE_RDONLY) != PTE_RDONLY) && + ((st->current_prot & PTE_PXN) != PTE_PXN)) { + WARN_ONCE(1, "arm64/mm: Found insecure W+X mapping at address %p/%pS\n", + (void *)st->start_address, + (void *)st->start_address); + st->wx_pages += (addr - st->start_address) / PAGE_SIZE; + } + pt_dump_seq_printf(st->seq, "0x%016lx-0x%016lx ", st->start_address, addr); @@ -341,6 +354,7 @@ static void ptdump_initialize(struct ptdump_info *info) int ptdump_register(struct ptdump_info *info, const char *name) { ptdump_initialize(info); + list_add(&info->node, &dump_info); return ptdump_debugfs_create(info, name); } @@ -350,6 +364,28 @@ static struct ptdump_info kernel_ptdump_info = { .base_addr = VA_START, }; +void ptdump_check_wx(void) +{ + struct ptdump_info *info; + + list_for_each_entry(info, &dump_info, node) { + struct pg_state st = { + .seq = NULL, + .marker = info->markers, + .check_wx = true, + }; + + __walk_pgd(&st, info->mm, info->base_addr); + note_page(&st, 0, 0, 0); + if (st.wx_pages) + pr_info("Checked W+X mappings (%p): FAILED, %lu W+X pages found\n", + info->mm, + st.wx_pages); + else + pr_info("Checked W+X mappings (%p): passed, no W+X pages found\n", info->mm); + } +} + static int ptdump_init(void) { return ptdump_register(&kernel_ptdump_info, "kernel_page_tables"); diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c index 4989948..1f036d2 100644 --- a/arch/arm64/mm/mmu.c +++ b/arch/arm64/mm/mmu.c @@ -41,6 +41,7 @@ #include #include #include +#include #include "mm.h" @@ -397,6 +398,7 @@ void mark_rodata_ro(void) section_size = (unsigned long)__init_begin - (unsigned long)__start_rodata; create_mapping_late(__pa(__start_rodata), (unsigned long)__start_rodata, section_size, PAGE_KERNEL_RO); + debug_checkwx(); } void fixup_init(void)