Re: [PATCH] x86/mm/pti: Move user W+X check into pti_finalize()

2018-08-16 Thread David H. Gutteridge
On Wed, 2018-08-08 at 13:16 +0200, Joerg Roedel wrote: > From: Joerg Roedel > > The user page-table gets the updated kernel mappings in > pti_finalize(), which runs after the RO+X permissions got > applied to the kernel page-table in mark_readonly(). > > But with CONFIG_DEBUG_WX enabled, the use

Re: [PATCH] x86/mm/pti: Move user W+X check into pti_finalize()

2018-08-09 Thread Joerg Roedel
Hi Kees, On Wed, Aug 08, 2018 at 01:33:01PM -0700, Kees Cook wrote: > I'm slightly nervous about complicating this and splitting up the > check. I have a mild preference that all the checks get moved later, > so that all architectures have the checks happening at the same time > during boot. Split

Re: [PATCH] x86/mm/pti: Move user W+X check into pti_finalize()

2018-08-09 Thread Joerg Roedel
Hi Dave, On Wed, Aug 08, 2018 at 08:54:37AM -0700, Dave Hansen wrote: > One bit of information missing from the changelog: Could you clarify how > there are any entries in the user page tables for the code to complain? > Before pti_init(), I would have expected the user page tables to be empty. T

Re: [PATCH] x86/mm/pti: Move user W+X check into pti_finalize()

2018-08-08 Thread Kees Cook
On Wed, Aug 8, 2018 at 4:16 AM, Joerg Roedel wrote: > From: Joerg Roedel > > The user page-table gets the updated kernel mappings in > pti_finalize(), which runs after the RO+X permissions got > applied to the kernel page-table in mark_readonly(). > > But with CONFIG_DEBUG_WX enabled, the user pa

Re: [PATCH] x86/mm/pti: Move user W+X check into pti_finalize()

2018-08-08 Thread Dave Hansen
On 08/08/2018 04:16 AM, Joerg Roedel wrote: > But with CONFIG_DEBUG_WX enabled, the user page-table is > already checked in mark_readonly() for insecure mappings. > This causes false-positive warnings, because the user > page-table did not get the updated mappings yet. One bit of information missi

[PATCH] x86/mm/pti: Move user W+X check into pti_finalize()

2018-08-08 Thread Joerg Roedel
From: Joerg Roedel The user page-table gets the updated kernel mappings in pti_finalize(), which runs after the RO+X permissions got applied to the kernel page-table in mark_readonly(). But with CONFIG_DEBUG_WX enabled, the user page-table is already checked in mark_readonly() for insecure mappi