Messages in this thread | | | Date | Tue, 10 Nov 2009 11:43:04 -0800 | From | Kees Cook <> | Subject | Re: [PATCH v4] [x86] detect and report lack of NX protections |
| |
On Tue, Nov 10, 2009 at 10:53:33AM -0800, H. Peter Anvin wrote: > On 11/10/2009 09:46 AM, Kees Cook wrote: > > > > The kernel as-is does not set nx_enabled for 64-bit, so this message is > > skipped completely: > > > > if (nx_enabled) > > printk(KERN_INFO "NX (Execute Disable) protection: active\n"); > > > > The only time this printk is shown is on 32-bit with PAE (with NX). > > There is no "else" currently. > > > > The structure you have is: > > if (nx_enabled) > else if (cpu_has_pae) > > The test for cpu_has_pae is unconditional (you only #ifdef the message) > -- in fact, this should cause a compile-time error on 64 bits: > > #undef cpu_has_pae > #define cpu_has_pae ___BUG___
This is fun. CONFIG_X86_PAE isn't defined for 64-bit, and using cpu_has_pae on 64-bit is considered a bug. :)
Here is the matrix of what I want to see reported about NX at boot time. How do you recommend this be implemented?
kernel cpu -> | CPU has PAE | CPU lacks PAE | | | CPU has NX | CPU lacks NX | | V +-------------------+-------------------+-----------------+ 32-bit non-PAE | missing in kernel | missing in kernel | no message | +-------------------+-------------------+-----------------+ 32-bit PAE | active * | missing in CPU | no message | +-------------------+-------------------+-----------------+ 64-bit | active | missing in CPU | impossible | +-------------------+-------------------+-----------------+ The box with the "*" is the only message currently reported by the kernel.
this looks ugly, but does it:
#if defined(CONFIG_X86_32) else if (cpu_has_pae) #else else #endif #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE) /* PAE kernel, PAE CPU, without NX */ printk(KERN_NOTICE "Notice: NX (Execute Disable) protection " "missing in CPU or disabled in BIOS!\n"); #else /* 32bit non-PAE kernel, PAE CPU */ printk(KERN_NOTICE "Notice: NX (Execute Disable) protection " "cannot be enabled: non-PAE kernel!\n"); #endif
-- Kees Cook Ubuntu Security Team
| |