2017-12-01 20:10:06

by Kees Cook

[permalink] [raw]
Subject: [PATCH] Kconfig: Make STRICT_DEVMEM default-y on x86 and arm64

Distros have been shipping with CONFIG_STRICT_DEVMEM=y for years now. It
is probably time to flip this default for x86 and arm64.

Signed-off-by: Kees Cook <[email protected]>
---
lib/Kconfig.debug | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 947d3e2ed5c2..39b123d04a36 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1985,7 +1985,7 @@ config STRICT_DEVMEM
bool "Filter access to /dev/mem"
depends on MMU && DEVMEM
depends on ARCH_HAS_DEVMEM_IS_ALLOWED
- default y if TILE || PPC
+ default y if TILE || PPC || X86 || ARM64
---help---
If this option is disabled, you allow userspace (root) access to all
of memory, including kernel and userspace memory. Accidental
--
2.7.4


--
Kees Cook
Pixel Security


2017-12-01 20:46:41

by Laura Abbott

[permalink] [raw]
Subject: Re: [PATCH] Kconfig: Make STRICT_DEVMEM default-y on x86 and arm64

On 12/01/2017 12:10 PM, Kees Cook wrote:
> Distros have been shipping with CONFIG_STRICT_DEVMEM=y for years now. It
> is probably time to flip this default for x86 and arm64.
>

With my Fedora hat on,

Acked-by: Laura Abbott <[email protected]

> Signed-off-by: Kees Cook <[email protected]>
> ---
> lib/Kconfig.debug | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
> index 947d3e2ed5c2..39b123d04a36 100644
> --- a/lib/Kconfig.debug
> +++ b/lib/Kconfig.debug
> @@ -1985,7 +1985,7 @@ config STRICT_DEVMEM
> bool "Filter access to /dev/mem"
> depends on MMU && DEVMEM
> depends on ARCH_HAS_DEVMEM_IS_ALLOWED
> - default y if TILE || PPC
> + default y if TILE || PPC || X86 || ARM64
> ---help---
> If this option is disabled, you allow userspace (root) access to all
> of memory, including kernel and userspace memory. Accidental
>

2017-12-04 15:56:07

by Will Deacon

[permalink] [raw]
Subject: Re: [PATCH] Kconfig: Make STRICT_DEVMEM default-y on x86 and arm64

On Fri, Dec 01, 2017 at 12:10:00PM -0800, Kees Cook wrote:
> Distros have been shipping with CONFIG_STRICT_DEVMEM=y for years now. It
> is probably time to flip this default for x86 and arm64.

Should we be defaulting IO_STRICT_DEVMEM on as well?

Will

> Signed-off-by: Kees Cook <[email protected]>
> ---
> lib/Kconfig.debug | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
> index 947d3e2ed5c2..39b123d04a36 100644
> --- a/lib/Kconfig.debug
> +++ b/lib/Kconfig.debug
> @@ -1985,7 +1985,7 @@ config STRICT_DEVMEM
> bool "Filter access to /dev/mem"
> depends on MMU && DEVMEM
> depends on ARCH_HAS_DEVMEM_IS_ALLOWED
> - default y if TILE || PPC
> + default y if TILE || PPC || X86 || ARM64
> ---help---
> If this option is disabled, you allow userspace (root) access to all
> of memory, including kernel and userspace memory. Accidental
> --
> 2.7.4
>
>
> --
> Kees Cook
> Pixel Security

2017-12-04 18:19:32

by Kees Cook

[permalink] [raw]
Subject: Re: [PATCH] Kconfig: Make STRICT_DEVMEM default-y on x86 and arm64

On Mon, Dec 4, 2017 at 7:56 AM, Will Deacon <[email protected]> wrote:
> On Fri, Dec 01, 2017 at 12:10:00PM -0800, Kees Cook wrote:
>> Distros have been shipping with CONFIG_STRICT_DEVMEM=y for years now. It
>> is probably time to flip this default for x86 and arm64.
>
> Should we be defaulting IO_STRICT_DEVMEM on as well?

I'd love to see that, but I haven't seen a long history on this
setting yet. It may be that arm64 can do it, since it doesn't have the
x86 hardware legacy stuff ... If you're willing to give it a shot, I'm
all for it. :)

-Kees

>
> Will
>
>> Signed-off-by: Kees Cook <[email protected]>
>> ---
>> lib/Kconfig.debug | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
>> index 947d3e2ed5c2..39b123d04a36 100644
>> --- a/lib/Kconfig.debug
>> +++ b/lib/Kconfig.debug
>> @@ -1985,7 +1985,7 @@ config STRICT_DEVMEM
>> bool "Filter access to /dev/mem"
>> depends on MMU && DEVMEM
>> depends on ARCH_HAS_DEVMEM_IS_ALLOWED
>> - default y if TILE || PPC
>> + default y if TILE || PPC || X86 || ARM64
>> ---help---
>> If this option is disabled, you allow userspace (root) access to all
>> of memory, including kernel and userspace memory. Accidental
>> --
>> 2.7.4
>>
>>
>> --
>> Kees Cook
>> Pixel Security



--
Kees Cook
Pixel Security

Subject: [tip:core/debug] Kconfig: Make STRICT_DEVMEM default-y on x86 and arm64

Commit-ID: 0f7cda2b824bb2afe0d75716a8664117fa03f5e0
Gitweb: https://git.kernel.org/tip/0f7cda2b824bb2afe0d75716a8664117fa03f5e0
Author: Kees Cook <[email protected]>
AuthorDate: Fri, 1 Dec 2017 12:10:00 -0800
Committer: Ingo Molnar <[email protected]>
CommitDate: Mon, 11 Dec 2017 18:41:26 +0100

Kconfig: Make STRICT_DEVMEM default-y on x86 and arm64

Distros have been shipping with CONFIG_STRICT_DEVMEM=y for years now. It
is probably time to flip this default for x86 and arm64.

Signed-off-by: Kees Cook <[email protected]>
Acked-by: Laura Abbott <[email protected]>
Cc: Andrew Morton <[email protected]>
Cc: Linus Torvalds <[email protected]>
Cc: Mark Rutland <[email protected]>
Cc: Peter Zijlstra <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Cc: Will Deacon <[email protected]>
Cc: [email protected]
Link: http://lkml.kernel.org/r/20171201201000.GA44539@beast
Signed-off-by: Ingo Molnar <[email protected]>
---
lib/Kconfig.debug | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 947d3e2..39b123d 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1985,7 +1985,7 @@ config STRICT_DEVMEM
bool "Filter access to /dev/mem"
depends on MMU && DEVMEM
depends on ARCH_HAS_DEVMEM_IS_ALLOWED
- default y if TILE || PPC
+ default y if TILE || PPC || X86 || ARM64
---help---
If this option is disabled, you allow userspace (root) access to all
of memory, including kernel and userspace memory. Accidental

2017-12-19 13:33:23

by Ard Biesheuvel

[permalink] [raw]
Subject: Re: [kernel-hardening] [PATCH] Kconfig: Make STRICT_DEVMEM default-y on x86 and arm64

On 1 December 2017 at 20:10, Kees Cook <[email protected]> wrote:
> Distros have been shipping with CONFIG_STRICT_DEVMEM=y for years now. It
> is probably time to flip this default for x86 and arm64.
>
> Signed-off-by: Kees Cook <[email protected]>

Acked-by: Ard Biesheuvel <[email protected]>

> ---
> lib/Kconfig.debug | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
> index 947d3e2ed5c2..39b123d04a36 100644
> --- a/lib/Kconfig.debug
> +++ b/lib/Kconfig.debug
> @@ -1985,7 +1985,7 @@ config STRICT_DEVMEM
> bool "Filter access to /dev/mem"
> depends on MMU && DEVMEM
> depends on ARCH_HAS_DEVMEM_IS_ALLOWED
> - default y if TILE || PPC
> + default y if TILE || PPC || X86 || ARM64
> ---help---
> If this option is disabled, you allow userspace (root) access to all
> of memory, including kernel and userspace memory. Accidental
> --
> 2.7.4
>
>
> --
> Kees Cook
> Pixel Security