Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751465AbbKZMPJ (ORCPT ); Thu, 26 Nov 2015 07:15:09 -0500 Received: from r00tworld.com ([212.85.137.150]:41219 "EHLO r00tworld.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750852AbbKZMPF (ORCPT ); Thu, 26 Nov 2015 07:15:05 -0500 From: "PaX Team" To: Ingo Molnar Date: Thu, 26 Nov 2015 13:14:26 +0100 MIME-Version: 1.0 Subject: Re: [kernel-hardening] [PATCH 0/2] introduce post-init read-only memory Reply-to: pageexec@freemail.hu CC: kernel-hardening@lists.openwall.com, Mathias Krause , "linux-kernel@vger.kernel.org" , Kees Cook , Andy Lutomirski , Ingo Molnar , Thomas Gleixner , "H. Peter Anvin" , x86-ml , Arnd Bergmann , Michael Ellerman , linux-arch@vger.kernel.org, Emese Revfy Message-ID: <5656F7A2.738.131F89C0@pageexec.freemail.hu> In-reply-to: <20151126104229.GA8530@gmail.com> References: <1448401114-24650-1-git-send-email-keescook@chromium.org>, <5656D779.17137.12A1EA53@pageexec.freemail.hu>, <20151126104229.GA8530@gmail.com> X-mailer: Pegasus Mail for Windows (4.70) Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7BIT Content-description: Mail message body X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-2.1.12 (r00tworld.com [212.85.137.150]); Thu, 26 Nov 2015 13:14:19 +0100 (CET) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2956 Lines: 62 On 26 Nov 2015 at 11:42, Ingo Molnar wrote: > * PaX Team wrote: > > > On 26 Nov 2015 at 9:54, Ingo Molnar wrote: > > > e.g., imagine that the write was to a function pointer (even an entire ops > > structure) or a boolean that controls some important feature for after-init > > code. ignoring/dropping such writes could cause all kinds of logic bugs (if not > > worse). > > Well, the typical case is that it's a logic bug to _do_ the write: the structure > was marked readonly for a reason but some init code re-runs during suspend or so. that's actually not the typical case in my experience, but rather these two: 1. initial mistake: someone didn't actually check whether the given object can be __read_only 2. code evolution: an object that was once written by __init code only (and thus proactively subjected to __read_only) gets modified by non-init code due to later changes what you described above is a third case where there's a latent bug to begin (unintended write) with that __read_only merely exposes but doesn't create itself, unlike the two cases above (intended writes getting caught by wrong use of __read_only). > But yes, logic bugs might trigger - but that is true in the opposite case as well, > if we do the write despite it being marked readonly: not really, the two cases above are not a priori bugs, they become bugs due to using __read_only without due care (which is why i suggested to detect them at compile time). > > misusing __read_only and ignoring write attempts would effectively produce the > > same misbehaviour as above so i strongly advise against it. > > No, the difference to the GCC related aliasing bug is that with my technique the > kernel would immediately produce a very visible kernel warning, which is a very > clear sign that is wrong - and with a very clear backtrace in the warning that > points right to the problematic code - which signature shows us (and users) what > is wrong. my proposal would produce the exact same reports, the difference is in letting the write attempt succeed vs. skipping it. this latter step is what is wrong since it introduces at least a logic bug the same way the constprop optimization created a logic bug. > Plus the truly paranoid might panic/halt the system on such warnings, so for > highly secure systems there's a way to not even allow the possibility of logic > bugs. (at the cost of stopping the system when a bug triggers.) this would/should be the default behaviour, i.e., no attempt at being smart by either allowing or skipping the faulting insn, just report the event and trigger whatever fancy future exploit reaction mechanism will get into the kernel. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/