Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-09-03 Thread Jessica Yu
+++ Masahiro Yamada [31/08/20 19:42 +0900]: [snipped for brevity] Sorry for the delay. Please try the attached patch. Hi Masahiro, Thank you for the patch. Sorry for the delay, I just wanted to report back after briefly testing your patch. It works great, at the moment I've only tested with a

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-09-01 Thread Will Deacon
On Mon, Aug 31, 2020 at 11:46:51AM +0200, Jessica Yu wrote: > +++ Will Deacon [21/08/20 13:30 +0100]: > [snipped] > > > > > > So module_enforce_rwx_sections() is already called after > > > > > > module_frob_arch_sections() - which really baffled me at first, > > > > > > since > > > > > > sh_type a

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-31 Thread Masahiro Yamada
On Mon, Aug 31, 2020 at 10:25 PM Ard Biesheuvel wrote: > > On Mon, 31 Aug 2020 at 13:43, Masahiro Yamada wrote: > > > > On Mon, Aug 31, 2020 at 6:47 PM Jessica Yu wrote: > > > > > > +++ Will Deacon [21/08/20 13:30 +0100]: > > > [snipped] > > > >> > > > So module_enforce_rwx_sections() is already

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-31 Thread Jessica Yu
+++ Ard Biesheuvel [31/08/20 16:25 +0300]: On Mon, 31 Aug 2020 at 13:43, Masahiro Yamada wrote: On Mon, Aug 31, 2020 at 6:47 PM Jessica Yu wrote: > > +++ Will Deacon [21/08/20 13:30 +0100]: > [snipped] > >> > > > So module_enforce_rwx_sections() is already called after > >> > > > module_frob_

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-31 Thread Ard Biesheuvel
On Mon, 31 Aug 2020 at 13:43, Masahiro Yamada wrote: > > On Mon, Aug 31, 2020 at 6:47 PM Jessica Yu wrote: > > > > +++ Will Deacon [21/08/20 13:30 +0100]: > > [snipped] > > >> > > > So module_enforce_rwx_sections() is already called after > > >> > > > module_frob_arch_sections() - which really ba

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-31 Thread Masahiro Yamada
On Mon, Aug 31, 2020 at 6:47 PM Jessica Yu wrote: > > +++ Will Deacon [21/08/20 13:30 +0100]: > [snipped] > >> > > > So module_enforce_rwx_sections() is already called after > >> > > > module_frob_arch_sections() - which really baffled me at first, since > >> > > > sh_type and sh_flags should have

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-31 Thread Jessica Yu
+++ Will Deacon [21/08/20 13:30 +0100]: [snipped] > > > So module_enforce_rwx_sections() is already called after > > > module_frob_arch_sections() - which really baffled me at first, since > > > sh_type and sh_flags should have been set already in > > > module_frob_arch_sections(). > > > > > > I

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-24 Thread Masahiro Yamada
On Tue, Aug 25, 2020 at 12:24 AM Jessica Yu wrote: > > +++ Ard Biesheuvel [22/08/20 15:47 +0200]: > >(+ Masahiro) > > > >On Fri, 21 Aug 2020 at 14:30, Will Deacon wrote: > >> > >> On Fri, Aug 21, 2020 at 02:27:05PM +0200, Ard Biesheuvel wrote: > >> > On Fri, 21 Aug 2020 at 14:20, Will Deacon wro

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-24 Thread Jessica Yu
+++ Ard Biesheuvel [22/08/20 15:47 +0200]: (+ Masahiro) On Fri, 21 Aug 2020 at 14:30, Will Deacon wrote: On Fri, Aug 21, 2020 at 02:27:05PM +0200, Ard Biesheuvel wrote: > On Fri, 21 Aug 2020 at 14:20, Will Deacon wrote: > > > > On Thu, Aug 13, 2020 at 03:07:13PM +0200, Ard Biesheuvel wrote:

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-22 Thread Ard Biesheuvel
(+ Masahiro) On Fri, 21 Aug 2020 at 14:30, Will Deacon wrote: > > On Fri, Aug 21, 2020 at 02:27:05PM +0200, Ard Biesheuvel wrote: > > On Fri, 21 Aug 2020 at 14:20, Will Deacon wrote: > > > > > > On Thu, Aug 13, 2020 at 03:07:13PM +0200, Ard Biesheuvel wrote: > > > > On Thu, 13 Aug 2020 at 15:04,

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-21 Thread Will Deacon
On Fri, Aug 21, 2020 at 02:27:05PM +0200, Ard Biesheuvel wrote: > On Fri, 21 Aug 2020 at 14:20, Will Deacon wrote: > > > > On Thu, Aug 13, 2020 at 03:07:13PM +0200, Ard Biesheuvel wrote: > > > On Thu, 13 Aug 2020 at 15:04, Jessica Yu wrote: > > > > > > > > +++ Ard Biesheuvel [13/08/20 10:36 +0200

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-21 Thread Ard Biesheuvel
On Fri, 21 Aug 2020 at 14:20, Will Deacon wrote: > > On Thu, Aug 13, 2020 at 03:07:13PM +0200, Ard Biesheuvel wrote: > > On Thu, 13 Aug 2020 at 15:04, Jessica Yu wrote: > > > > > > +++ Ard Biesheuvel [13/08/20 10:36 +0200]: > > > >On Wed, 12 Aug 2020 at 22:00, Peter Zijlstra > > > >wrote: > > >

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-21 Thread Will Deacon
On Thu, Aug 13, 2020 at 03:07:13PM +0200, Ard Biesheuvel wrote: > On Thu, 13 Aug 2020 at 15:04, Jessica Yu wrote: > > > > +++ Ard Biesheuvel [13/08/20 10:36 +0200]: > > >On Wed, 12 Aug 2020 at 22:00, Peter Zijlstra wrote: > > >> > > >> On Wed, Aug 12, 2020 at 06:37:57PM +0200, Ard Biesheuvel wrot

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-13 Thread Ard Biesheuvel
On Thu, 13 Aug 2020 at 15:04, Jessica Yu wrote: > > +++ Ard Biesheuvel [13/08/20 10:36 +0200]: > >On Wed, 12 Aug 2020 at 22:00, Peter Zijlstra wrote: > >> > >> On Wed, Aug 12, 2020 at 06:37:57PM +0200, Ard Biesheuvel wrote: > >> > I know there is little we can do at this point, apart from ignorin

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-13 Thread Jessica Yu
+++ Ard Biesheuvel [13/08/20 10:36 +0200]: On Wed, 12 Aug 2020 at 22:00, Peter Zijlstra wrote: On Wed, Aug 12, 2020 at 06:37:57PM +0200, Ard Biesheuvel wrote: > I know there is little we can do at this point, apart from ignoring > the permissions - perhaps we should just defer the w^x check un

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-13 Thread Will Deacon
On Wed, Aug 12, 2020 at 05:42:05PM +0100, Szabolcs Nagy wrote: > The 08/12/2020 18:37, Ard Biesheuvel wrote: > > On Wed, 12 Aug 2020 at 18:00, Jessica Yu wrote: > > > +++ Szabolcs Nagy [12/08/20 15:15 +0100]: > > > >for me it bisects to > > > > > > > >https://sourceware.org/git/?p=binutils-gdb.git

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-13 Thread Ard Biesheuvel
On Wed, 12 Aug 2020 at 22:00, Peter Zijlstra wrote: > > On Wed, Aug 12, 2020 at 06:37:57PM +0200, Ard Biesheuvel wrote: > > I know there is little we can do at this point, apart from ignoring > > the permissions - perhaps we should just defer the w^x check until > > after calling module_frob_arch_

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-12 Thread Peter Zijlstra
On Wed, Aug 12, 2020 at 06:37:57PM +0200, Ard Biesheuvel wrote: > I know there is little we can do at this point, apart from ignoring > the permissions - perhaps we should just defer the w^x check until > after calling module_frob_arch_sections()? My earlier suggestion was to ignore it for 0-sized

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-12 Thread Szabolcs Nagy
The 08/12/2020 18:37, Ard Biesheuvel wrote: > module_frob_arch_sections > > On Wed, 12 Aug 2020 at 18:00, Jessica Yu wrote: > > > > +++ Szabolcs Nagy [12/08/20 15:15 +0100]: > > >The 08/12/2020 13:56, Will Deacon wrote: > > >> On Wed, Aug 12, 2020 at 12:40:05PM +0200, pet...@infradead.org wrote:

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-12 Thread Ard Biesheuvel
module_frob_arch_sections On Wed, 12 Aug 2020 at 18:00, Jessica Yu wrote: > > +++ Szabolcs Nagy [12/08/20 15:15 +0100]: > >The 08/12/2020 13:56, Will Deacon wrote: > >> On Wed, Aug 12, 2020 at 12:40:05PM +0200, pet...@infradead.org wrote: > >> > On Wed, Aug 12, 2020 at 10:56:56AM +0200, Ard Biesh

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-12 Thread Jessica Yu
+++ Szabolcs Nagy [12/08/20 15:15 +0100]: The 08/12/2020 13:56, Will Deacon wrote: On Wed, Aug 12, 2020 at 12:40:05PM +0200, pet...@infradead.org wrote: > On Wed, Aug 12, 2020 at 10:56:56AM +0200, Ard Biesheuvel wrote: > > The module .lds has BYTE(0) in the section contents to prevent the > > li

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-12 Thread Szabolcs Nagy
The 08/12/2020 13:56, Will Deacon wrote: > On Wed, Aug 12, 2020 at 12:40:05PM +0200, pet...@infradead.org wrote: > > On Wed, Aug 12, 2020 at 10:56:56AM +0200, Ard Biesheuvel wrote: > > > The module .lds has BYTE(0) in the section contents to prevent the > > > linker from pruning them entirely. The

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-12 Thread H.J. Lu
On Wed, Aug 12, 2020 at 4:42 AM Jessica Yu via Binutils wrote: > > +++ pet...@infradead.org [12/08/20 12:40 +0200]: > >On Wed, Aug 12, 2020 at 10:56:56AM +0200, Ard Biesheuvel wrote: > >> The module .lds has BYTE(0) in the section contents to prevent the > >> linker from pruning them entirely. The

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-12 Thread Will Deacon
On Wed, Aug 12, 2020 at 12:40:05PM +0200, pet...@infradead.org wrote: > On Wed, Aug 12, 2020 at 10:56:56AM +0200, Ard Biesheuvel wrote: > > The module .lds has BYTE(0) in the section contents to prevent the > > linker from pruning them entirely. The (NOLOAD) is there to ensure > > that this byte do

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-12 Thread Jessica Yu
+++ pet...@infradead.org [12/08/20 12:40 +0200]: On Wed, Aug 12, 2020 at 10:56:56AM +0200, Ard Biesheuvel wrote: The module .lds has BYTE(0) in the section contents to prevent the linker from pruning them entirely. The (NOLOAD) is there to ensure that this byte does not end up in the .ko, which

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-12 Thread peterz
On Wed, Aug 12, 2020 at 10:56:56AM +0200, Ard Biesheuvel wrote: > The module .lds has BYTE(0) in the section contents to prevent the > linker from pruning them entirely. The (NOLOAD) is there to ensure > that this byte does not end up in the .ko, which is more a matter of > principle than anything

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-12 Thread Ard Biesheuvel
On Tue, 11 Aug 2020 at 18:01, Jessica Yu wrote: > > +++ Mauro Carvalho Chehab [11/08/20 17:27 +0200]: > >Em Tue, 11 Aug 2020 16:55:24 +0200 > >pet...@infradead.org escreveu: > > > >> On Tue, Aug 11, 2020 at 04:34:27PM +0200, Mauro Carvalho Chehab wrote: > >> > [33] .plt PROGBITS

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-11 Thread Peter Zijlstra
On Tue, Aug 11, 2020 at 07:59:12PM +0200, pet...@infradead.org wrote: > On Tue, Aug 11, 2020 at 06:01:35PM +0200, Jessica Yu wrote: > > > > > On Tue, Aug 11, 2020 at 04:34:27PM +0200, Mauro Carvalho Chehab wrote: > > > > > [33] .plt PROGBITS 0340 00035c80 > > >

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-11 Thread peterz
On Tue, Aug 11, 2020 at 06:01:35PM +0200, Jessica Yu wrote: > > > On Tue, Aug 11, 2020 at 04:34:27PM +0200, Mauro Carvalho Chehab wrote: > > > > [33] .plt PROGBITS 0340 00035c80 > > > >0001 WAX 0 0 1 > > > >

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-11 Thread Will Deacon
On Tue, Aug 11, 2020 at 06:01:35PM +0200, Jessica Yu wrote: > +++ Mauro Carvalho Chehab [11/08/20 17:27 +0200]: > > Em Tue, 11 Aug 2020 16:55:24 +0200 > > pet...@infradead.org escreveu: > > > > > On Tue, Aug 11, 2020 at 04:34:27PM +0200, Mauro Carvalho Chehab wrote: > > > > [33] .plt

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-11 Thread Jessica Yu
+++ Mauro Carvalho Chehab [11/08/20 17:27 +0200]: Em Tue, 11 Aug 2020 16:55:24 +0200 pet...@infradead.org escreveu: On Tue, Aug 11, 2020 at 04:34:27PM +0200, Mauro Carvalho Chehab wrote: > [33] .plt PROGBITS 0340 00035c80 >0001 00

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-11 Thread Mauro Carvalho Chehab
Em Tue, 11 Aug 2020 16:55:24 +0200 pet...@infradead.org escreveu: > On Tue, Aug 11, 2020 at 04:34:27PM +0200, Mauro Carvalho Chehab wrote: > > [33] .plt PROGBITS 0340 00035c80 > >0001 WAX 0 0 1 > > [34] .init

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-11 Thread peterz
On Tue, Aug 11, 2020 at 04:34:27PM +0200, Mauro Carvalho Chehab wrote: > [33] .plt PROGBITS 0340 00035c80 >0001 WAX 0 0 1 > [34] .init.plt NOBITS 0341 00035c81 >0

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-11 Thread Mauro Carvalho Chehab
Hi Jessica, Em Mon, 10 Aug 2020 17:06:50 +0200 Jessica Yu escreveu: > +++ Jessica Yu [10/08/20 11:25 +0200]: > >+++ Mauro Carvalho Chehab [08/08/20 10:12 +0200]: > >[snip] > >>Right now, what happens is: > >> > >># modprobe wlcore > >>modprobe: ERROR: could not insert 'wlcore': Exec fo

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-10 Thread Jessica Yu
+++ Jessica Yu [10/08/20 11:25 +0200]: +++ Mauro Carvalho Chehab [08/08/20 10:12 +0200]: [snip] Right now, what happens is: # modprobe wlcore modprobe: ERROR: could not insert 'wlcore': Exec format error This seems to be failing for all modules, as doesn't show anything probed.

Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

2020-08-10 Thread Jessica Yu
+++ Mauro Carvalho Chehab [08/08/20 10:12 +0200]: [snip] Right now, what happens is: # modprobe wlcore modprobe: ERROR: could not insert 'wlcore': Exec format error This seems to be failing for all modules, as doesn't show anything probed. Btw, IMO, it would be useful to have s