Messages in this thread Patches in this message | | | From | Kees Cook <> | Date | Wed, 22 Nov 2017 09:56:30 -0800 | Subject | Re: Does CONFIG_HARDENED_USERCOPY break /dev/mem? |
| |
On Wed, Nov 22, 2017 at 9:43 AM, Kees Cook <keescook@chromium.org> wrote: > On Wed, Nov 22, 2017 at 1:28 AM, Michael Holzheu > <holzheu@linux.vnet.ibm.com> wrote: >> So what's your plan now? How will you fix this issue? > > I think the best plan here would be to use the Kconfig "imply > STRICT_DEVMEM" in HARDENED_USERCOPY. That would make STRICT_DEVMEM > enabled by default but still configurable. Then the kernel-text check > in hardened usercopy could be skip when !STRICT_DEVMEM.
Hmm, this doesn't work the way I was expecting...
diff --git a/security/Kconfig b/security/Kconfig index e8e449444e65..3b4effd8bbc2 100644 --- a/security/Kconfig +++ b/security/Kconfig @@ -143,6 +143,7 @@ config HARDENED_USERCOPY bool "Harden memory copies between kernel and userspace" depends on HAVE_HARDENED_USERCOPY_ALLOCATOR select BUG + imply STRICT_DEVMEM help This option checks for obviously wrong memory regions when copying memory to/from the kernel (via copy_to_user() and $ make defconfig $ egrep '(DEVMEM|HARDENED_USERCOPY)\b' .config CONFIG_DEVMEM=y # CONFIG_STRICT_DEVMEM is not set # CONFIG_HARDENED_USERCOPY is not set $ ./scripts/config -e CONFIG_HARDENED_USERCOPY $ egrep '(DEVMEM|HARDENED_USERCOPY)\b' .config CONFIG_DEVMEM=y # CONFIG_STRICT_DEVMEM is not set CONFIG_HARDENED_USERCOPY=y Maybe make STRICT_DEVMEM's default tie to HARDENED_USERCOPY? Bleh, this doesn't seem to work either:
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug index 947d3e2ed5c2..8cc05033ba65 100644 --- a/lib/Kconfig.debug +++ b/lib/Kconfig.debug @@ -1985,7 +1985,7 @@ config STRICT_DEVMEM bool "Filter access to /dev/mem" depends on MMU && DEVMEM depends on ARCH_HAS_DEVMEM_IS_ALLOWED - default y if TILE || PPC + default y if TILE || PPC || HARDENED_USERCOPY ---help--- If this option is disabled, you allow userspace (root) access to all of memory, including kernel and userspace memory. Accidental I'm open to suggestions...
-Kees
-- Kees Cook Pixel Security
| |