Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751332AbdCCFuq (ORCPT ); Fri, 3 Mar 2017 00:50:46 -0500 Received: from mail-io0-f175.google.com ([209.85.223.175]:33892 "EHLO mail-io0-f175.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751506AbdCCFun (ORCPT ); Fri, 3 Mar 2017 00:50:43 -0500 MIME-Version: 1.0 In-Reply-To: <1488466831-13918-1-git-send-email-hoeun.ryu@gmail.com> References: <1488466831-13918-1-git-send-email-hoeun.ryu@gmail.com> From: Kees Cook Date: Thu, 2 Mar 2017 20:02:57 -0800 X-Google-Sender-Auth: vIJcgOCbqM5f-DRQGEG11rhKdB8 Message-ID: Subject: Re: [RFC] arm64: support HAVE_ARCH_RARE_WRITE To: Hoeun Ryu Cc: "kernel-hardening@lists.openwall.com" , LKML , Mark Rutland , Andy Lutomirski , Emese Revfy , Russell King , PaX Team , "x86@kernel.org" Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1672 Lines: 43 On Thu, Mar 2, 2017 at 7:00 AM, Hoeun Ryu wrote: > This RFC is a quick and dirty arm64 implementation for Kees Cook's RFC for > rare_write infrastructure [1]. Awesome! :) > This implementation is based on Mark Rutland's suggestions, which is that > a special userspace mm that maps only __start/end_rodata as RW permission > is prepared during early boot time (paging_init) and __arch_rare_write_map() > switches to the mm [2]. > > Due to the limit of implementation (the mm having RW mapping is userspace > mm), we need a new arch-specific __arch_rare_write_ptr() to convert RO > address to RW address (CONFIG_HAVE_RARE_WRITE_PTR is added), which is > general for all architectures (__rare_write_ptr()) in Kees's RFC . So all > writes should be instrumented by __rare_write(). Cool, yeah, I'll get all this fixed up in my next version. > One caveat for arm64 is CONFIG_ARM64_SW_TTBR0_PAN. > Because __arch_rare_write_map() installes a special user mm to ttbr0, > usercopy inside __arch_rare_write_map/unmap() pair will break rare_write. > (uaccess_enable() replaces the special mm and RW alias is no longer valid.) That's totally fine constraint: this case should never happen for so many reasons. :) > A similar problem could rise in general usercopy inside > __arch_rare_write_map/unmap(). __arch_rare_write_map() replaces current->mm, > so we loose the address space of the `current` process. > > It passes LKDTM's rare write test. > > [1] : http://www.openwall.com/lists/kernel-hardening/2017/02/27/5 > [2] : https://lkml.org/lkml/2017/2/22/254 > > Signed-off-by: Hoeun Ryu -Kees -- Kees Cook Pixel Security