Re: [PATCH] lkdtm: add test for executing .rodata

2016-02-23 Thread Kees Cook
On Tue, Feb 23, 2016 at 2:00 PM, PaX Team wrote: > On 23 Feb 2016 at 12:53, Kees Cook wrote: > >> I prefer using all the "regular" mechanisms so that I really know I'm >> exercising the actual case I want to be testing. (i.e. I don't want to >> bypass the linker.) >> >> If only there were some way

Re: [PATCH] lkdtm: add test for executing .rodata

2016-02-23 Thread PaX Team
On 23 Feb 2016 at 12:53, Kees Cook wrote: > I prefer using all the "regular" mechanisms so that I really know I'm > exercising the actual case I want to be testing. (i.e. I don't want to > bypass the linker.) > > If only there were some way to filter gcc output, like with plugins. ;) plugins can

Re: [PATCH] lkdtm: add test for executing .rodata

2016-02-23 Thread Kees Cook
On Mon, Feb 22, 2016 at 3:21 PM, PaX Team wrote: > On 22 Feb 2016 at 12:46, Kees Cook wrote: > >> GCC really wants to declare the section. :( > > hmm, i see, so how about going about it another way. instead of trying > to do this at compile/link time, do it an load/runtime. one way of doing > it w

Re: [kernel-hardening] Re: [PATCH] lkdtm: add test for executing .rodata

2016-02-23 Thread Kees Cook
On Tue, Feb 23, 2016 at 12:31 PM, David Brown wrote: > On Mon, Feb 22, 2016 at 12:46:28PM -0800, Kees Cook wrote: >> >> On Thu, Feb 18, 2016 at 1:27 PM, PaX Team wrote: >>> >>> On 18 Feb 2016 at 12:34, Ard Biesheuvel wrote: >>> However, that does not fix the issue Kees is trying to solve, wh

Re: [kernel-hardening] Re: [PATCH] lkdtm: add test for executing .rodata

2016-02-23 Thread David Brown
On Mon, Feb 22, 2016 at 12:46:28PM -0800, Kees Cook wrote: On Thu, Feb 18, 2016 at 1:27 PM, PaX Team wrote: On 18 Feb 2016 at 12:34, Ard Biesheuvel wrote: However, that does not fix the issue Kees is trying to solve, where a .rodata section is emitted with the "x" bit set, which causes the li

Re: [PATCH] lkdtm: add test for executing .rodata

2016-02-22 Thread PaX Team
On 22 Feb 2016 at 12:46, Kees Cook wrote: > GCC really wants to declare the section. :( hmm, i see, so how about going about it another way. instead of trying to do this at compile/link time, do it an load/runtime. one way of doing it would be to preserve a page in .rodata then map in a code page

Re: [PATCH] lkdtm: add test for executing .rodata

2016-02-22 Thread Kees Cook
On Thu, Feb 18, 2016 at 1:27 PM, PaX Team wrote: > On 18 Feb 2016 at 12:34, Ard Biesheuvel wrote: > >> However, that does not fix the issue Kees is trying to solve, where a >> .rodata section is emitted with the "x" bit set, which causes the >> linker to complain: >> >> /tmp/cc50ffWw.s: Assembler

Re: [PATCH] lkdtm: add test for executing .rodata

2016-02-18 Thread PaX Team
On 18 Feb 2016 at 12:34, Ard Biesheuvel wrote: > However, that does not fix the issue Kees is trying to solve, where a > .rodata section is emitted with the "x" bit set, which causes the > linker to complain: > > /tmp/cc50ffWw.s: Assembler messages: > /tmp/cc50ffWw.s:2: Warning: setting incorrect

Re: [PATCH] lkdtm: add test for executing .rodata

2016-02-18 Thread Kees Cook
On Thu, Feb 18, 2016 at 4:46 AM, Ard Biesheuvel wrote: > On 18 February 2016 at 13:07, Arnd Bergmann wrote: >> On Thursday 18 February 2016 12:34:50 Ard Biesheuvel wrote: >>> >>> We have __section() as an alias for __attribute__((__section__())), so >>> we could use that instead. >>> >>> However,

Re: [PATCH] lkdtm: add test for executing .rodata

2016-02-18 Thread Ard Biesheuvel
On 18 February 2016 at 13:07, Arnd Bergmann wrote: > On Thursday 18 February 2016 12:34:50 Ard Biesheuvel wrote: >> >> We have __section() as an alias for __attribute__((__section__())), so >> we could use that instead. >> >> However, that does not fix the issue Kees is trying to solve, where a >>

Re: [PATCH] lkdtm: add test for executing .rodata

2016-02-18 Thread Arnd Bergmann
On Thursday 18 February 2016 12:34:50 Ard Biesheuvel wrote: > > We have __section() as an alias for __attribute__((__section__())), so > we could use that instead. > > However, that does not fix the issue Kees is trying to solve, where a > .rodata section is emitted with the "x" bit set, which ca

Re: [PATCH] lkdtm: add test for executing .rodata

2016-02-18 Thread Ard Biesheuvel
On 18 February 2016 at 12:34, Ard Biesheuvel wrote: > On 18 February 2016 at 11:32, PaX Team wrote: >> On 17 Feb 2016 at 12:29, Kees Cook wrote: >> >>> >> +static void __attribute__((__section__(".rodata,\"a\",@progbits#"))) >>> >> +do_nothing_rodata(void) >>> >> +{ >>> >> + return; >>> >>

Re: [PATCH] lkdtm: add test for executing .rodata

2016-02-18 Thread Ard Biesheuvel
On 18 February 2016 at 11:32, PaX Team wrote: > On 17 Feb 2016 at 12:29, Kees Cook wrote: > >> >> +static void __attribute__((__section__(".rodata,\"a\",@progbits#"))) >> >> +do_nothing_rodata(void) >> >> +{ >> >> + return; >> >> +} >> >> + >> > >> > >> >> >> > >> > This doesn't cross compil

Re: [PATCH] lkdtm: add test for executing .rodata

2016-02-18 Thread PaX Team
On 17 Feb 2016 at 12:29, Kees Cook wrote: > >> +static void __attribute__((__section__(".rodata,\"a\",@progbits#"))) > >> +do_nothing_rodata(void) > >> +{ > >> + return; > >> +} > >> + > > > > > >> > > > > This doesn't cross compile for me on arm64 with two different toolchains > > > > CC dr

Re: [PATCH] lkdtm: add test for executing .rodata

2016-02-17 Thread Arnd Bergmann
On Wednesday 17 February 2016 22:44:12 Arnd Bergmann wrote: > On Tuesday 16 February 2016 13:49:04 Kees Cook wrote: > > } > > > > +static void __attribute__((__section__(".rodata,\"a\",@progbits#"))) > > +do_nothing_rodata(void) > > +{ > > + return; > > +} > > + > > static void do_nothing

Re: [PATCH] lkdtm: add test for executing .rodata

2016-02-17 Thread Arnd Bergmann
On Tuesday 16 February 2016 13:49:04 Kees Cook wrote: > } > > +static void __attribute__((__section__(".rodata,\"a\",@progbits#"))) > +do_nothing_rodata(void) > +{ > + return; > +} > + > static void do_nothing(void) > { > I think this also needs to be marked "noinline" to ensure that t

Re: [PATCH] lkdtm: add test for executing .rodata

2016-02-17 Thread Kees Cook
On Wed, Feb 17, 2016 at 12:29 PM, Kees Cook wrote: > On Tue, Feb 16, 2016 at 5:06 PM, Laura Abbott wrote: >> >> >> On 02/16/2016 01:49 PM, Kees Cook wrote: >>> >>> Make sure that the read-only data section isn't executable. >>> >>> Signed-off-by: Kees Cook >>> --- >>> drivers/misc/lkdtm.c | 28

Re: [PATCH] lkdtm: add test for executing .rodata

2016-02-17 Thread Kees Cook
On Tue, Feb 16, 2016 at 5:06 PM, Laura Abbott wrote: > > > On 02/16/2016 01:49 PM, Kees Cook wrote: >> >> Make sure that the read-only data section isn't executable. >> >> Signed-off-by: Kees Cook >> --- >> drivers/misc/lkdtm.c | 28 +--- >> 1 file changed, 21 insertion

Re: [PATCH] lkdtm: add test for executing .rodata

2016-02-16 Thread Laura Abbott
On 02/16/2016 01:49 PM, Kees Cook wrote: Make sure that the read-only data section isn't executable. Signed-off-by: Kees Cook --- drivers/misc/lkdtm.c | 28 +--- 1 file changed, 21 insertions(+), 7 deletions(-) diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm

[PATCH] lkdtm: add test for executing .rodata

2016-02-16 Thread Kees Cook
Make sure that the read-only data section isn't executable. Signed-off-by: Kees Cook --- drivers/misc/lkdtm.c | 28 +--- 1 file changed, 21 insertions(+), 7 deletions(-) diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c index 11fdadc68e53..9835fcc0506e 100644 ---