[PATCH v9 5/8] powerpc: Set ARCH_HAS_STRICT_MODULE_RWX

[Christophe Leroy]

Le 17/03/2021 à 03:15, Jordan Niethe a écrit :
> On Tue, Mar 16, 2021 at 5:51 PM Christophe Leroy
> <christophe.leroy at csgroup.eu> wrote:
>>
>>
>>
>> Le 16/03/2021 à 04:17, Jordan Niethe a écrit :
>>> From: Russell Currey <ruscur at russell.cc>
>>>
>>> To enable strict module RWX on powerpc, set:
>>>
>>>       CONFIG_STRICT_MODULE_RWX=y
>>>
>>> You should also have CONFIG_STRICT_KERNEL_RWX=y set to have any real
>>> security benefit.
>>>
>>> ARCH_HAS_STRICT_MODULE_RWX is set to require ARCH_HAS_STRICT_KERNEL_RWX.
>>> This is due to a quirk in arch/Kconfig and arch/powerpc/Kconfig that
>>> makes STRICT_MODULE_RWX *on by default* in configurations where
>>> STRICT_KERNEL_RWX is *unavailable*.
>>
>> Not that easy on book3s/32. On it, you can't protect memory against execution on a page basis, you
>> can only do it on a segment basis. So in order to do that, when would need to allocate to areas of
>> memory: one in module space for text and one in vmalloc space for data.
>>
>> See https://github.com/linuxppc/linux/commit/6ca05532 and
>> https://github.com/linuxppc/linux/commit/7fbc22ce
> Would it be ok to just make ARCH_HAS_STRICT_MODULE_RWX conditional on 64s?

I think making it conditional on !PPC_BOOK3S_604 should be enough.

>>
>>
>>>
>>> Since this doesn't make much sense, and module RWX without kernel RWX
>>> doesn't make much sense, having the same dependencies as kernel RWX
>>> works around this problem.
>>>
>>> Signed-off-by: Russell Currey <ruscur at russell.cc>
>>> Signed-off-by: Jordan Niethe <jniethe5 at gmail.com>
>>> ---
>>>    arch/powerpc/Kconfig | 1 +
>>>    1 file changed, 1 insertion(+)
>>>
>>> diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
>>> index 4498a27ac9db..d9cadc4212d0 100644
>>> --- a/arch/powerpc/Kconfig
>>> +++ b/arch/powerpc/Kconfig
>>> @@ -137,6 +137,7 @@ config PPC
>>>        select ARCH_HAS_SCALED_CPUTIME          if VIRT_CPU_ACCOUNTING_NATIVE && PPC_BOOK3S_64
>>>        select ARCH_HAS_SET_MEMORY
>>>        select ARCH_HAS_STRICT_KERNEL_RWX       if ((PPC_BOOK3S_64 || PPC32) && !HIBERNATION)
>>> +     select ARCH_HAS_STRICT_MODULE_RWX       if ARCH_HAS_STRICT_KERNEL_RWX
>>>        select ARCH_HAS_TICK_BROADCAST          if GENERIC_CLOCKEVENTS_BROADCAST
>>>        select ARCH_HAS_UACCESS_FLUSHCACHE
>>>        select ARCH_HAS_COPY_MC                 if PPC64
>>>