Re: [PATCH v9 5/8] powerpc: Set ARCH_HAS_STRICT_MODULE_RWX

Le 17/03/2021 à 03:15, Jordan Niethe a écrit :

On Tue, Mar 16, 2021 at 5:51 PM Christophe Leroy
[off-list ref] wrote:

quoted

Le 16/03/2021 à 04:17, Jordan Niethe a écrit :

quoted

From: Russell Currey <redacted>

To enable strict module RWX on powerpc, set:

      CONFIG_STRICT_MODULE_RWX=y

You should also have CONFIG_STRICT_KERNEL_RWX=y set to have any real
security benefit.

ARCH_HAS_STRICT_MODULE_RWX is set to require ARCH_HAS_STRICT_KERNEL_RWX.
This is due to a quirk in arch/Kconfig and arch/powerpc/Kconfig that
makes STRICT_MODULE_RWX *on by default* in configurations where
STRICT_KERNEL_RWX is *unavailable*.

Not that easy on book3s/32. On it, you can't protect memory against execution on a page basis, you
can only do it on a segment basis. So in order to do that, when would need to allocate to areas of
memory: one in module space for text and one in vmalloc space for data.

See https://github.com/linuxppc/linux/commit/6ca05532 and
https://github.com/linuxppc/linux/commit/7fbc22ce

Would it be ok to just make ARCH_HAS_STRICT_MODULE_RWX conditional on 64s?

I think making it conditional on !PPC_BOOK3S_604 should be enough.

quoted

quoted

Since this doesn't make much sense, and module RWX without kernel RWX
doesn't make much sense, having the same dependencies as kernel RWX
works around this problem.

Signed-off-by: Russell Currey <redacted>
Signed-off-by: Jordan Niethe <redacted>
---
   arch/powerpc/Kconfig | 1 +
   1 file changed, 1 insertion(+)

diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 4498a27ac9db..d9cadc4212d0 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig

@@ -137,6 +137,7 @@ config PPC
       select ARCH_HAS_SCALED_CPUTIME          if VIRT_CPU_ACCOUNTING_NATIVE && PPC_BOOK3S_64
       select ARCH_HAS_SET_MEMORY
       select ARCH_HAS_STRICT_KERNEL_RWX       if ((PPC_BOOK3S_64 || PPC32) && !HIBERNATION)
+     select ARCH_HAS_STRICT_MODULE_RWX       if ARCH_HAS_STRICT_KERNEL_RWX
       select ARCH_HAS_TICK_BROADCAST          if GENERIC_CLOCKEVENTS_BROADCAST
       select ARCH_HAS_UACCESS_FLUSHCACHE
       select ARCH_HAS_COPY_MC                 if PPC64