[PATCH] powerpc: Default to enabling STRICT_KERNEL_RWX
Subsystems:
linux for powerpc (32-bit and 64-bit) , the rest
3241d
5 messages,
2 authors,
2017-10-05 · open the first message on its own page
When available, CONFIG_KERNEL_RWX should be default-enabled.
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Paul Mackerras <redacted>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: Kees Cook <redacted>
---
arch/powerpc/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 809c468edab1..9a549bbfc278 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig @@ -178,6 +178,7 @@ config PPC
select HAVE_ARCH_TRACEHOOK
select ARCH_HAS_STRICT_KERNEL_RWX if (( PPC_BOOK3S_64 || PPC32) && ! RELOCATABLE && ! HIBERNATION)
select ARCH_OPTIONAL_KERNEL_RWX if ARCH_HAS_STRICT_KERNEL_RWX
+ select ARCH_OPTIONAL_KERNEL_RWX_DEFAULT select HAVE_CBPF_JIT if ! PPC64
select HAVE_CONTEXT_TRACKING if PPC64
select HAVE_DEBUG_KMEMLEAK --
2.7.4
--
Kees Cook
Pixel Security
Le 05/10/2017 à 05:45, Kees Cook a écrit : When available, CONFIG_KERNEL_RWX should be default-enabled.
On PPC32, this option implies deactivating BATs and/or LTLB mapping of
the linear kernel address space, hence a significant performance
degradation.
So at least on PPC32, it should remain unselected by default.
Christophe
quoted hunk
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Paul Mackerras <redacted>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: Kees Cook <redacted>
---
arch/powerpc/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 809c468edab1..9a549bbfc278 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig @@ -178,6 +178,7 @@ config PPC
select HAVE_ARCH_TRACEHOOK
select ARCH_HAS_STRICT_KERNEL_RWX if (( PPC_BOOK3S_64 || PPC32) && ! RELOCATABLE && ! HIBERNATION)
select ARCH_OPTIONAL_KERNEL_RWX if ARCH_HAS_STRICT_KERNEL_RWX
+ select ARCH_OPTIONAL_KERNEL_RWX_DEFAULT select HAVE_CBPF_JIT if ! PPC64
select HAVE_CONTEXT_TRACKING if PPC64
select HAVE_DEBUG_KMEMLEAK
On Thu, Oct 5, 2017 at 12:49 AM, Christophe LEROY
[off-list ref] wrote:
Le 05/10/2017 =C3=A0 05:45, Kees Cook a =C3=A9crit : quoted
When available, CONFIG_KERNEL_RWX should be default-enabled.
On PPC32, this option implies deactivating BATs and/or LTLB mapping of th= e linear kernel address space, hence a significant performance degradation.
So at least on PPC32, it should remain unselected by default.
Alright, sounds fine to me. Would this be okay?
+ select ARCH_OPTIONAL_KERNEL_RWX_DEFAULT if !PPC64
-Kees
Christophe
quoted
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Paul Mackerras <redacted>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: Kees Cook <redacted>
---
arch/powerpc/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 809c468edab1..9a549bbfc278 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig @@ -178,6 +178,7 @@ config PPC
select HAVE_ARCH_TRACEHOOK
select ARCH_HAS_STRICT_KERNEL_RWX if (( PPC_BOOK3S_64 || PPC32) && !RELOCATABLE && !HIBERNATION)
select ARCH_OPTIONAL_KERNEL_RWX if
ARCH_HAS_STRICT_KERNEL_RWX
+ select ARCH_OPTIONAL_KERNEL_RWX_DEFAULT
select HAVE_CBPF_JIT if !PPC64
select HAVE_CONTEXT_TRACKING if PPC64
select HAVE_DEBUG_KMEMLEAK
--=20
Kees Cook
Pixel Security
Le 05/10/2017 à 19:30, Kees Cook a écrit : On Thu, Oct 5, 2017 at 12:49 AM, Christophe LEROY
[off-list ref] wrote: quoted
Le 05/10/2017 à 05:45, Kees Cook a écrit : quoted
When available, CONFIG_KERNEL_RWX should be default-enabled.
On PPC32, this option implies deactivating BATs and/or LTLB mapping of the
linear kernel address space, hence a significant performance degradation.
So at least on PPC32, it should remain unselected by default.
Alright, sounds fine to me. Would this be okay?
+ select ARCH_OPTIONAL_KERNEL_RWX_DEFAULT if !PPC64
You mean
select ARCH_OPTIONAL_KERNEL_RWX_DEFAULT if PPC64
Don't you ?
Christophe
-Kees
quoted
Christophe
quoted
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Paul Mackerras <redacted>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: Kees Cook <redacted>
---
arch/powerpc/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 809c468edab1..9a549bbfc278 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig @@ -178,6 +178,7 @@ config PPC
select HAVE_ARCH_TRACEHOOK
select ARCH_HAS_STRICT_KERNEL_RWX if (( PPC_BOOK3S_64 || PPC32) && !RELOCATABLE && !HIBERNATION)
select ARCH_OPTIONAL_KERNEL_RWX if
ARCH_HAS_STRICT_KERNEL_RWX
+ select ARCH_OPTIONAL_KERNEL_RWX_DEFAULT
select HAVE_CBPF_JIT if !PPC64
select HAVE_CONTEXT_TRACKING if PPC64
select HAVE_DEBUG_KMEMLEAK
---
L'absence de virus dans ce courrier électronique a été vérifiée par le logiciel antivirus Avast.
https://www.avast.com/antivirus
On Thu, Oct 5, 2017 at 11:57 AM, christophe leroy
[off-list ref] wrote:
Le 05/10/2017 =C3=A0 19:30, Kees Cook a =C3=A9crit : quoted
On Thu, Oct 5, 2017 at 12:49 AM, Christophe LEROY
[off-list ref] wrote: quoted
Le 05/10/2017 =C3=A0 05:45, Kees Cook a =C3=A9crit : quoted
When available, CONFIG_KERNEL_RWX should be default-enabled.
On PPC32, this option implies deactivating BATs and/or LTLB mapping of
the
linear kernel address space, hence a significant performance degradatio= n. quoted quoted
So at least on PPC32, it should remain unselected by default.
Alright, sounds fine to me. Would this be okay?
+ select ARCH_OPTIONAL_KERNEL_RWX_DEFAULT if !PPC64
You mean
select ARCH_OPTIONAL_KERNEL_RWX_DEFAULT if PPC64
Don't you ?
Oops, yes! :)
-Kees
--=20
Kees Cook
Pixel Security