Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ad21fc4f authored by Laura Abbott's avatar Laura Abbott Committed by Kees Cook
Browse files

arch: Move CONFIG_DEBUG_RODATA and CONFIG_SET_MODULE_RONX to be common 



There are multiple architectures that support CONFIG_DEBUG_RODATA and
CONFIG_SET_MODULE_RONX. These options also now have the ability to be
turned off at runtime. Move these to an architecture independent
location and make these options def_bool y for almost all of those
arches.

Signed-off-by: default avatarLaura Abbott <labbott@redhat.com>
Acked-by: default avatarIngo Molnar <mingo@kernel.org>
Acked-by: default avatarHeiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
parent 0c744ea4

Documentation/security/self-protection.txt

+6 −0
Original line number Diff line number Diff line
@@ -56,6 +56,12 @@ CONFIG_DEBUG_SET_MODULE_RONX, which seek to make sure that code is not 
writable, data is not executable, and read-only data is neither writable

nor executable.



Most architectures have these options on by default and not user selectable.

For some architectures like arm that wish to have these be selectable,

the architecture Kconfig can select ARCH_OPTIONAL_KERNEL_RWX to enable

a Kconfig prompt. CONFIG_ARCH_OPTIONAL_KERNEL_RWX_DEFAULT determines

the default setting when ARCH_OPTIONAL_KERNEL_RWX is enabled.



#### Function pointers and sensitive variables must not be writable



Vast areas of kernel memory contain function pointers that are looked

arch/Kconfig

+34 −0
Original line number Diff line number Diff line
@@ -781,4 +781,38 @@ config VMAP_STACK 
	  the stack to map directly to the KASAN shadow map using a formula

	  that is incorrect if the stack is in vmalloc space.



config ARCH_OPTIONAL_KERNEL_RWX

	def_bool n



config ARCH_OPTIONAL_KERNEL_RWX_DEFAULT

	def_bool n



config ARCH_HAS_STRICT_KERNEL_RWX

	def_bool n



config DEBUG_RODATA

	bool "Make kernel text and rodata read-only" if ARCH_OPTIONAL_KERNEL_RWX

	depends on ARCH_HAS_STRICT_KERNEL_RWX

	default !ARCH_OPTIONAL_KERNEL_RWX || ARCH_OPTIONAL_KERNEL_RWX_DEFAULT

	help

	  If this is set, kernel text and rodata memory will be made read-only,

	  and non-text memory will be made non-executable. This provides

	  protection against certain security exploits (e.g. executing the heap

	  or modifying text)



	  These features are considered standard security practice these days.

	  You should say Y here in almost all cases.



config ARCH_HAS_STRICT_MODULE_RWX

	def_bool n



config DEBUG_SET_MODULE_RONX

	bool "Set loadable kernel module data as NX and text as RO" if ARCH_OPTIONAL_KERNEL_RWX

	depends on ARCH_HAS_STRICT_MODULE_RWX && MODULES

	default !ARCH_OPTIONAL_KERNEL_RWX || ARCH_OPTIONAL_KERNEL_RWX_DEFAULT

	help

	  If this is set, module text and rodata memory will be made read-only,

	  and non-text memory will be made non-executable. This provides

	  protection against certain security exploits (e.g. writing to text)



source "kernel/gcov/Kconfig"

arch/arm/Kconfig

+4 −0
Original line number Diff line number Diff line
@@ -4,10 +4,14 @@ config ARM 
	select ARCH_CLOCKSOURCE_DATA

	select ARCH_HAS_DEVMEM_IS_ALLOWED

	select ARCH_HAS_ELF_RANDOMIZE

	select ARCH_HAS_STRICT_KERNEL_RWX if MMU && !XIP_KERNEL

	select ARCH_HAS_STRICT_MODULE_RWX if MMU

	select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST

	select ARCH_HAVE_CUSTOM_GPIO_H

	select ARCH_HAS_GCOV_PROFILE_ALL

	select ARCH_MIGHT_HAVE_PC_PARPORT

	select ARCH_OPTIONAL_KERNEL_RWX if ARCH_HAS_STRICT_KERNEL_RWX

	select ARCH_OPTIONAL_KERNEL_RWX_DEFAULT if CPU_V7

	select ARCH_SUPPORTS_ATOMIC_RMW

	select ARCH_USE_BUILTIN_BSWAP

	select ARCH_USE_CMPXCHG_LOCKREF

arch/arm/Kconfig.debug

+0 −11
Original line number Diff line number Diff line
@@ -1738,17 +1738,6 @@ config PID_IN_CONTEXTIDR 
	  additional instructions during context switch. Say Y here only if you

	  are planning to use hardware trace tools with this kernel.



config DEBUG_SET_MODULE_RONX

	bool "Set loadable kernel module data as NX and text as RO"

	depends on MODULES && MMU

	---help---

	  This option helps catch unintended modifications to loadable

	  kernel module's text and read-only data. It also prevents execution

	  of module data. Such protection may interfere with run-time code

	  patching and dynamic kernel tracing - and they might also protect

	  against certain classes of kernel exploits.

	  If in doubt, say "N".



source "drivers/hwtracing/coresight/Kconfig"



endmenu

arch/arm/mm/Kconfig

+0 −12
Original line number Diff line number Diff line
@@ -1051,18 +1051,6 @@ config ARCH_SUPPORTS_BIG_ENDIAN 
	  This option specifies the architecture can support big endian

	  operation.



config DEBUG_RODATA

	bool "Make kernel text and rodata read-only"

	depends on MMU && !XIP_KERNEL

	default y if CPU_V7

	help

	  If this is set, kernel text and rodata memory will be made

	  read-only, and non-text kernel memory will be made non-executable.

	  The tradeoff is that each region is padded to section-size (1MiB)

	  boundaries (because their permissions are different and splitting

	  the 1M pages into 4K ones causes TLB performance problems), which

	  can waste memory.



config DEBUG_ALIGN_RODATA

	bool "Make rodata strictly non-executable"

	depends on DEBUG_RODATA