Re: [PATCH 2/2] ARM: mm: keep rodata non-executable

2014-04-01 Thread Kees Cook
On Tue, Apr 1, 2014 at 3:54 PM, Laura Abbott wrote: > On 4/1/2014 3:34 PM, Kees Cook wrote: >> On Mon, Mar 24, 2014 at 3:47 AM, Jon Medhurst (Tixy) wrote: >>> On Sun, 2014-03-23 at 16:21 -0600, Kees Cook wrote: For this stage, how about I make this "depends on KEXEC=n && KPROBES=n"? >>>

Re: [PATCH 2/2] ARM: mm: keep rodata non-executable

2014-04-01 Thread Laura Abbott
On 4/1/2014 3:34 PM, Kees Cook wrote: > On Mon, Mar 24, 2014 at 3:47 AM, Jon Medhurst (Tixy) wrote: >> On Sun, 2014-03-23 at 16:21 -0600, Kees Cook wrote: >>> For this stage, how about I make this "depends on KEXEC=n && >>> KPROBES=n"? >> >> There's also ftrace (CONFIG_DYNAMIC_FTRACE I believe) wh

Re: [PATCH 2/2] ARM: mm: keep rodata non-executable

2014-04-01 Thread Kees Cook
On Mon, Mar 24, 2014 at 3:47 AM, Jon Medhurst (Tixy) wrote: > On Sun, 2014-03-23 at 16:21 -0600, Kees Cook wrote: >> For this stage, how about I make this "depends on KEXEC=n && >> KPROBES=n"? > > There's also ftrace (CONFIG_DYNAMIC_FTRACE I believe) which modifies > kernel code with a call to pro

Re: [PATCH 2/2] ARM: mm: keep rodata non-executable

2014-03-24 Thread Dave Martin
On Sun, Mar 23, 2014 at 06:47:36PM +, Laura Abbott wrote: > On 2/17/2014 4:34 AM, Dave Martin wrote: > > On Fri, Feb 14, 2014 at 11:11:07AM -0800, Kees Cook wrote: > >> On Fri, Feb 14, 2014 at 8:22 AM, Dave Martin wrote: > >>> On Thu, Feb 13, 2014 at 05:04:10PM -0800, Kees Cook wrote: > I

Re: [PATCH 2/2] ARM: mm: keep rodata non-executable

2014-03-24 Thread Jon Medhurst (Tixy)
On Sun, 2014-03-23 at 16:21 -0600, Kees Cook wrote: > On Sun, Mar 23, 2014 at 12:47 PM, Laura Abbott wrote: > > On 2/17/2014 4:34 AM, Dave Martin wrote: > >> On Fri, Feb 14, 2014 at 11:11:07AM -0800, Kees Cook wrote: > >>> On Fri, Feb 14, 2014 at 8:22 AM, Dave Martin wrote: > On Thu, Feb 13,

Re: [PATCH 2/2] ARM: mm: keep rodata non-executable

2014-03-23 Thread Kees Cook
On Sun, Mar 23, 2014 at 4:37 PM, Nicolas Pitre wrote: > On Sun, 23 Mar 2014, Kees Cook wrote: > >> On Sun, Mar 23, 2014 at 12:47 PM, Laura Abbott wrote: >> > On 2/17/2014 4:34 AM, Dave Martin wrote: >> >> On Fri, Feb 14, 2014 at 11:11:07AM -0800, Kees Cook wrote: >> >>> On Fri, Feb 14, 2014 at 8:

Re: [PATCH 2/2] ARM: mm: keep rodata non-executable

2014-03-23 Thread Nicolas Pitre
On Sun, 23 Mar 2014, Kees Cook wrote: > On Sun, Mar 23, 2014 at 12:47 PM, Laura Abbott wrote: > > On 2/17/2014 4:34 AM, Dave Martin wrote: > >> On Fri, Feb 14, 2014 at 11:11:07AM -0800, Kees Cook wrote: > >>> On Fri, Feb 14, 2014 at 8:22 AM, Dave Martin wrote: > On Thu, Feb 13, 2014 at 05:0

Re: [PATCH 2/2] ARM: mm: keep rodata non-executable

2014-03-23 Thread Kees Cook
On Sun, Mar 23, 2014 at 12:32 PM, Laura Abbott wrote: > On 3/13/2014 12:07 PM, Kees Cook wrote: >> On Fri, Feb 21, 2014 at 2:09 PM, Kees Cook wrote: >>> On Fri, Feb 21, 2014 at 5:20 AM, Russell King - ARM Linux >>> wrote: On Fri, Feb 21, 2014 at 12:37:04PM +, Dave Martin wrote: > It

Re: [PATCH 2/2] ARM: mm: keep rodata non-executable

2014-03-23 Thread Kees Cook
On Sun, Mar 23, 2014 at 12:47 PM, Laura Abbott wrote: > On 2/17/2014 4:34 AM, Dave Martin wrote: >> On Fri, Feb 14, 2014 at 11:11:07AM -0800, Kees Cook wrote: >>> On Fri, Feb 14, 2014 at 8:22 AM, Dave Martin wrote: On Thu, Feb 13, 2014 at 05:04:10PM -0800, Kees Cook wrote: > Introduce "C

Re: [PATCH 2/2] ARM: mm: keep rodata non-executable

2014-03-23 Thread Laura Abbott
On 2/17/2014 4:34 AM, Dave Martin wrote: > On Fri, Feb 14, 2014 at 11:11:07AM -0800, Kees Cook wrote: >> On Fri, Feb 14, 2014 at 8:22 AM, Dave Martin wrote: >>> On Thu, Feb 13, 2014 at 05:04:10PM -0800, Kees Cook wrote: Introduce "CONFIG_DEBUG_RODATA" to mostly match the x86 config, though >>

Re: [PATCH 2/2] ARM: mm: keep rodata non-executable

2014-03-23 Thread Laura Abbott
On 3/13/2014 12:07 PM, Kees Cook wrote: > On Fri, Feb 21, 2014 at 2:09 PM, Kees Cook wrote: >> On Fri, Feb 21, 2014 at 5:20 AM, Russell King - ARM Linux >> wrote: >>> On Fri, Feb 21, 2014 at 12:37:04PM +, Dave Martin wrote: It would be good if someone who's more familiar with the parms a

Re: [PATCH 2/2] ARM: mm: keep rodata non-executable

2014-03-13 Thread Kees Cook
On Fri, Feb 21, 2014 at 2:09 PM, Kees Cook wrote: > On Fri, Feb 21, 2014 at 5:20 AM, Russell King - ARM Linux > wrote: >> On Fri, Feb 21, 2014 at 12:37:04PM +, Dave Martin wrote: >>> It would be good if someone who's more familiar with the parms and >>> vmlinux.lds stuff could take a look at

Re: [PATCH 2/2] ARM: mm: keep rodata non-executable

2014-02-21 Thread Kees Cook
On Fri, Feb 21, 2014 at 5:20 AM, Russell King - ARM Linux wrote: > On Fri, Feb 21, 2014 at 12:37:04PM +, Dave Martin wrote: >> It would be good if someone who's more familiar with the parms and >> vmlinux.lds stuff could take a look at it, though I don't see any >> obvious problem yet. > > The

Re: [PATCH 2/2] ARM: mm: keep rodata non-executable

2014-02-21 Thread Russell King - ARM Linux
On Fri, Feb 21, 2014 at 12:37:04PM +, Dave Martin wrote: > It would be good if someone who's more familiar with the parms and > vmlinux.lds stuff could take a look at it, though I don't see any > obvious problem yet. The biggest issue with it is that we end up with: - the .text section rounde

Re: [PATCH 2/2] ARM: mm: keep rodata non-executable

2014-02-21 Thread Dave Martin
On Tue, Feb 18, 2014 at 10:10:03AM -0800, Kees Cook wrote: > On Mon, Feb 17, 2014 at 4:34 AM, Dave Martin wrote: > > On Fri, Feb 14, 2014 at 11:11:07AM -0800, Kees Cook wrote: > >> On Fri, Feb 14, 2014 at 8:22 AM, Dave Martin wrote: > >> > On Thu, Feb 13, 2014 at 05:04:10PM -0800, Kees Cook wrote

Re: [PATCH 2/2] ARM: mm: keep rodata non-executable

2014-02-18 Thread Kees Cook
On Mon, Feb 17, 2014 at 4:34 AM, Dave Martin wrote: > On Fri, Feb 14, 2014 at 11:11:07AM -0800, Kees Cook wrote: >> On Fri, Feb 14, 2014 at 8:22 AM, Dave Martin wrote: >> > On Thu, Feb 13, 2014 at 05:04:10PM -0800, Kees Cook wrote: >> >> Introduce "CONFIG_DEBUG_RODATA" to mostly match the x86 con

Re: [PATCH 2/2] ARM: mm: keep rodata non-executable

2014-02-17 Thread Dave Martin
On Fri, Feb 14, 2014 at 11:11:07AM -0800, Kees Cook wrote: > On Fri, Feb 14, 2014 at 8:22 AM, Dave Martin wrote: > > On Thu, Feb 13, 2014 at 05:04:10PM -0800, Kees Cook wrote: > >> Introduce "CONFIG_DEBUG_RODATA" to mostly match the x86 config, though > >> the behavior is different: it depends on

Re: [PATCH 2/2] ARM: mm: keep rodata non-executable

2014-02-14 Thread Kees Cook
On Fri, Feb 14, 2014 at 8:22 AM, Dave Martin wrote: > On Thu, Feb 13, 2014 at 05:04:10PM -0800, Kees Cook wrote: >> Introduce "CONFIG_DEBUG_RODATA" to mostly match the x86 config, though >> the behavior is different: it depends on STRICT_KERNMEM_PERMS, which >> sets rodata read-only (but executabl

Re: [PATCH 2/2] ARM: mm: keep rodata non-executable

2014-02-14 Thread Dave Martin
On Thu, Feb 13, 2014 at 05:04:10PM -0800, Kees Cook wrote: > Introduce "CONFIG_DEBUG_RODATA" to mostly match the x86 config, though > the behavior is different: it depends on STRICT_KERNMEM_PERMS, which > sets rodata read-only (but executable), where as this option additionally > splits rodata from

[PATCH 2/2] ARM: mm: keep rodata non-executable

2014-02-13 Thread Kees Cook
Introduce "CONFIG_DEBUG_RODATA" to mostly match the x86 config, though the behavior is different: it depends on STRICT_KERNMEM_PERMS, which sets rodata read-only (but executable), where as this option additionally splits rodata from the kernel text (resulting in potentially more memory lost to padd