Received: by 2002:a25:8b91:0:0:0:0:0 with SMTP id j17csp3471653ybl; Mon, 3 Feb 2020 00:39:24 -0800 (PST) X-Google-Smtp-Source: APXvYqwLWHMKs1fntJopYOLaS8nAf1fr4qD3iRVpvc41tG/F89EmsC7X4YSVZzh77WXKSGbnw3lL X-Received: by 2002:a05:6808:289:: with SMTP id z9mr5944939oic.48.1580719163902; Mon, 03 Feb 2020 00:39:23 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1580719163; cv=none; d=google.com; s=arc-20160816; b=g5LVaNSEFhPB19TkCQqw4MMKJswZC/uXck/LfccB5ytsx9VgFztyKyk0n10UZ3oTKx SXib6rDrgEsKC7K8Vj/gkKhyxHGCBmrk7Phg2BCzZfIu51Zr1pG/2jdCftAY1F+f9U/I vO214uwqxxgLa/y4jzeqS7IPDDRDoAYiBC/RNWaoSr0at8gFIbXmRpcX5NKBnrx5wmbJ NBvV+m3R9y9a6pqMvyw3IZFGQbfcWsBfPTWG1lHyp1SQmpuMIEI7uN0zt8Tq5PuxvH9v OvXNfg9tXV0rOXC35R4yfiB56RvsbZHZltOoOYvFGSc4PxlKmRtWBkmxE1CIwD7OdvI2 NAJg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:date:cc:to:subject:from:references :in-reply-to:message-id:dkim-signature; bh=W3kOT7qChYUoys2Kv0Pzk4S1AUmIGz5dAAJR4TXhjf8=; b=Ck8SX+nQt1SYU6+13hPT+/lTmEfynIvdkLGKVyqmmV4lz1e20QJ6vuAM+HuEXknmMX I9Kgrfebdx6rWWlHp8aP7Uqi8Rjz6WsUQdDSP1CrYX8SM2tXk0g9/b8/bJMRQwi3SzV0 C0a+0TxjgO8BcVHhota9P2YpUdYx9a6jjhqm/Nre5Jos6+4IrepBs9Kht6poKskArzdP gj5CPFhBSENzm2WuoqTbzcRl6wyQmSKZvkT8lM8kWKkBWiXSvOhhyiWRZZRMqg/E/ElM abHV4bsf6YjJUUJBirVE0yA7lExIEZVGM6CeM3e+jOujYqcmcaVuTjuhta20YdwsliN1 0jJQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@c-s.fr header.s=mail header.b=hRQMQHQD; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id w7si9417656otq.250.2020.02.03.00.39.11; Mon, 03 Feb 2020 00:39:23 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@c-s.fr header.s=mail header.b=hRQMQHQD; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727653AbgBCHMB (ORCPT + 99 others); Mon, 3 Feb 2020 02:12:01 -0500 Received: from pegase1.c-s.fr ([93.17.236.30]:33636 "EHLO pegase1.c-s.fr" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726410AbgBCHMB (ORCPT ); Mon, 3 Feb 2020 02:12:01 -0500 Received: from localhost (mailhub1-int [192.168.12.234]) by localhost (Postfix) with ESMTP id 489zXW4VGPz9tyK4; Mon, 3 Feb 2020 08:11:55 +0100 (CET) Authentication-Results: localhost; dkim=pass reason="1024-bit key; insecure key" header.d=c-s.fr header.i=@c-s.fr header.b=hRQMQHQD; dkim-adsp=pass; dkim-atps=neutral X-Virus-Scanned: Debian amavisd-new at c-s.fr Received: from pegase1.c-s.fr ([192.168.12.234]) by localhost (pegase1.c-s.fr [192.168.12.234]) (amavisd-new, port 10024) with ESMTP id upEV7P5ryzrS; Mon, 3 Feb 2020 08:11:55 +0100 (CET) Received: from messagerie.si.c-s.fr (messagerie.si.c-s.fr [192.168.25.192]) by pegase1.c-s.fr (Postfix) with ESMTP id 489zXW2nsLz9tyK0; Mon, 3 Feb 2020 08:11:55 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=c-s.fr; s=mail; t=1580713915; bh=W3kOT7qChYUoys2Kv0Pzk4S1AUmIGz5dAAJR4TXhjf8=; h=In-Reply-To:References:From:Subject:To:Cc:Date:From; b=hRQMQHQDzl3OWbMEyZNE6l/4U2a9ub8LihOIn86B6n7gcQdPAc5xdUozLmJ5GlwNj yeY7ES78k0S+Vk5NUzjuV2ZyotSYQTE0ghsQcZBc47qVLyv3dkDIhkMWoEi6LOq817 3tpaiSKzV67r+kKr3Y0J6QkhstenfhXAFYTfLn2Q= Received: from localhost (localhost [127.0.0.1]) by messagerie.si.c-s.fr (Postfix) with ESMTP id CB7468B791; Mon, 3 Feb 2020 08:11:59 +0100 (CET) X-Virus-Scanned: amavisd-new at c-s.fr Received: from messagerie.si.c-s.fr ([127.0.0.1]) by localhost (messagerie.si.c-s.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id AodvKBgMwGxb; Mon, 3 Feb 2020 08:11:59 +0100 (CET) Received: from po14934vm.idsi0.si.c-s.fr (po15451.idsi0.si.c-s.fr [172.25.230.102]) by messagerie.si.c-s.fr (Postfix) with ESMTP id AB5958B752; Mon, 3 Feb 2020 08:11:59 +0100 (CET) Received: by po14934vm.idsi0.si.c-s.fr (Postfix, from userid 0) id 62AEF652AD; Mon, 3 Feb 2020 07:11:59 +0000 (UTC) Message-Id: In-Reply-To: <80ebd9075cd7c8b412c6d5d05f7542f9026642ef.1580713729.git.christophe.leroy@c-s.fr> References: <80ebd9075cd7c8b412c6d5d05f7542f9026642ef.1580713729.git.christophe.leroy@c-s.fr> From: Christophe Leroy Subject: [PATCH v3 4/7] powerpc: Set ARCH_HAS_STRICT_MODULE_RWX To: Benjamin Herrenschmidt , Paul Mackerras , Michael Ellerman , ruscur@russell.cc Cc: linux-kernel@vger.kernel.org, linuxppc-dev@lists.ozlabs.org Date: Mon, 3 Feb 2020 07:11:59 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Russell Currey To enable strict module RWX on powerpc, set: CONFIG_STRICT_MODULE_RWX=y You should also have CONFIG_STRICT_KERNEL_RWX=y set to have any real security benefit. ARCH_HAS_STRICT_MODULE_RWX is set to require ARCH_HAS_STRICT_KERNEL_RWX. This is due to a quirk in arch/Kconfig and arch/powerpc/Kconfig that makes STRICT_MODULE_RWX *on by default* in configurations where STRICT_KERNEL_RWX is *unavailable*. Since this doesn't make much sense, and module RWX without kernel RWX doesn't make much sense, having the same dependencies as kernel RWX works around this problem. Signed-off-by: Russell Currey --- v3: no change v2: no change --- arch/powerpc/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig index d0c6e7b7a62d..1a26b8526be0 100644 --- a/arch/powerpc/Kconfig +++ b/arch/powerpc/Kconfig @@ -131,6 +131,7 @@ config PPC select ARCH_HAS_SCALED_CPUTIME if VIRT_CPU_ACCOUNTING_NATIVE && PPC_BOOK3S_64 select ARCH_HAS_SET_MEMORY select ARCH_HAS_STRICT_KERNEL_RWX if ((PPC_BOOK3S_64 || PPC32) && !HIBERNATION) + select ARCH_HAS_STRICT_MODULE_RWX if ARCH_HAS_STRICT_KERNEL_RWX select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST select ARCH_HAS_UACCESS_FLUSHCACHE select ARCH_HAS_UACCESS_MCSAFE if PPC64 -- 2.25.0