Re: [PATCH] Arm: mm: ftrace: Only set text back to ro after kernel has been marked ro

2018-06-29 Thread Matthias Reichl
On Fri, Jun 29, 2018 at 11:16:58AM -0400, Steven Rostedt wrote: > On Fri, 29 Jun 2018 16:47:14 +0200 > Matthias Reichl wrote: > > > On Tue, Dec 05, 2017 at 12:14:46PM -0800, Kees Cook wrote: > > > On Tue, Dec 5, 2017 at 12:09 PM, Russell King - ARM Linux > > > wrote: > > > > On Tue, Dec 05, 20

Re: [PATCH] Arm: mm: ftrace: Only set text back to ro after kernel has been marked ro

2018-06-29 Thread Steven Rostedt
On Fri, 29 Jun 2018 16:47:14 +0200 Matthias Reichl wrote: > On Tue, Dec 05, 2017 at 12:14:46PM -0800, Kees Cook wrote: > > On Tue, Dec 5, 2017 at 12:09 PM, Russell King - ARM Linux > > wrote: > > > On Tue, Dec 05, 2017 at 11:35:59AM -0800, Kees Cook wrote: > > >> We don't _need_ to, but they

Re: [PATCH] Arm: mm: ftrace: Only set text back to ro after kernel has been marked ro

2018-06-29 Thread Matthias Reichl
On Tue, Dec 05, 2017 at 12:14:46PM -0800, Kees Cook wrote: > On Tue, Dec 5, 2017 at 12:09 PM, Russell King - ARM Linux > wrote: > > On Tue, Dec 05, 2017 at 11:35:59AM -0800, Kees Cook wrote: > >> We don't _need_ to, but they're all contiguous, so the ro_perms array > >> used by set_kernel_text_*()

Re: [PATCH] Arm: mm: ftrace: Only set text back to ro after kernel has been marked ro

2017-12-05 Thread Kees Cook
On Tue, Dec 5, 2017 at 12:09 PM, Russell King - ARM Linux wrote: > On Tue, Dec 05, 2017 at 11:35:59AM -0800, Kees Cook wrote: >> We don't _need_ to, but they're all contiguous, so the ro_perms array >> used by set_kernel_text_*() is actually only a single entry: >> >> static struct section_perm ro

Re: [PATCH] Arm: mm: ftrace: Only set text back to ro after kernel has been marked ro

2017-12-05 Thread Russell King - ARM Linux
On Tue, Dec 05, 2017 at 11:35:59AM -0800, Kees Cook wrote: > We don't _need_ to, but they're all contiguous, so the ro_perms array > used by set_kernel_text_*() is actually only a single entry: > > static struct section_perm ro_perms[] = { > /* Make kernel code and rodata RX (set RO). */ >

Re: [PATCH] Arm: mm: ftrace: Only set text back to ro after kernel has been marked ro

2017-12-05 Thread Kees Cook
On Tue, Dec 5, 2017 at 5:36 AM, Russell King - ARM Linux wrote: > On Tue, Dec 05, 2017 at 01:30:11PM +, Phil Elwell wrote: >> This was my initial explanation: >> >> 1. Data which is marked __ro_after_init is initially writeable. >> >> 2. The ro_perms data covers kernel text, read-only data and

Re: [PATCH] Arm: mm: ftrace: Only set text back to ro after kernel has been marked ro

2017-12-05 Thread Phil Elwell
On 05/12/2017 13:23, Matthias Reichl wrote: > On Tue, Dec 05, 2017 at 01:14:17PM +, Russell King - ARM Linux wrote: >> On Tue, Dec 05, 2017 at 12:47:09PM +0100, Matthias Reichl wrote: >>> On Wed, Aug 23, 2017 at 03:03:51PM -0400, Steven Rostedt wrote: On Wed, 23 Aug 2017 11:48:13 -0700 >>>

Re: [PATCH] Arm: mm: ftrace: Only set text back to ro after kernel has been marked ro

2017-12-05 Thread Russell King - ARM Linux
On Tue, Dec 05, 2017 at 01:30:11PM +, Phil Elwell wrote: > On 05/12/2017 13:23, Matthias Reichl wrote: > > On Tue, Dec 05, 2017 at 01:14:17PM +, Russell King - ARM Linux wrote: > >> On Tue, Dec 05, 2017 at 12:47:09PM +0100, Matthias Reichl wrote: > >>> On Wed, Aug 23, 2017 at 03:03:51PM -04

Re: [PATCH] Arm: mm: ftrace: Only set text back to ro after kernel has been marked ro

2017-12-05 Thread Matthias Reichl
On Tue, Dec 05, 2017 at 01:14:17PM +, Russell King - ARM Linux wrote: > On Tue, Dec 05, 2017 at 12:47:09PM +0100, Matthias Reichl wrote: > > On Wed, Aug 23, 2017 at 03:03:51PM -0400, Steven Rostedt wrote: > > > On Wed, 23 Aug 2017 11:48:13 -0700 > > > Kees Cook wrote: > > > > > > > > diff --g

Re: [PATCH] Arm: mm: ftrace: Only set text back to ro after kernel has been marked ro

2017-12-05 Thread Russell King - ARM Linux
On Tue, Dec 05, 2017 at 12:47:09PM +0100, Matthias Reichl wrote: > On Wed, Aug 23, 2017 at 03:03:51PM -0400, Steven Rostedt wrote: > > On Wed, 23 Aug 2017 11:48:13 -0700 > > Kees Cook wrote: > > > > > > diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c > > > > index ad80548..fd75f38 100644 > >

Re: [PATCH] Arm: mm: ftrace: Only set text back to ro after kernel has been marked ro

2017-12-05 Thread Matthias Reichl
On Wed, Aug 23, 2017 at 03:03:51PM -0400, Steven Rostedt wrote: > On Wed, 23 Aug 2017 11:48:13 -0700 > Kees Cook wrote: > > > > diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c > > > index ad80548..fd75f38 100644 > > > --- a/arch/arm/mm/init.c > > > +++ b/arch/arm/mm/init.c > > > @@ -745,19 +

Re: [PATCH] Arm: mm: ftrace: Only set text back to ro after kernel has been marked ro

2017-08-23 Thread Steven Rostedt
On Wed, 23 Aug 2017 11:48:13 -0700 Kees Cook wrote: > > diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c > > index ad80548..fd75f38 100644 > > --- a/arch/arm/mm/init.c > > +++ b/arch/arm/mm/init.c > > @@ -745,19 +745,29 @@ static int __mark_rodata_ro(void *unused) > > return 0; > > }

Re: [PATCH] Arm: mm: ftrace: Only set text back to ro after kernel has been marked ro

2017-08-23 Thread Kees Cook
On Wed, Aug 23, 2017 at 10:58 AM, Steven Rostedt wrote: > > ftrace needs to modify the kernel text in order to enable function tracing. > For security reasons, the kernel text is marked to read-only (ro) at the end > of system bootup. When enabling function tracing after that, ftrace calls > arch

Re: [PATCH] Arm: mm: ftrace: Only set text back to ro after kernel has been marked ro

2017-08-23 Thread Matthias Reichl
On Wed, Aug 23, 2017 at 01:58:36PM -0400, Steven Rostedt wrote: > > ftrace needs to modify the kernel text in order to enable function tracing. > For security reasons, the kernel text is marked to read-only (ro) at the end > of system bootup. When enabling function tracing after that, ftrace calls

[PATCH] Arm: mm: ftrace: Only set text back to ro after kernel has been marked ro

2017-08-23 Thread Steven Rostedt
ftrace needs to modify the kernel text in order to enable function tracing. For security reasons, the kernel text is marked to read-only (ro) at the end of system bootup. When enabling function tracing after that, ftrace calls arch specific code that needs to enable the modification of kernel text