Messages in this thread | | | From | Rusty Russell <> | Subject | Re: [PATCH v8] RO/NX protection for loadable kernel modules | Date | Mon, 8 Feb 2010 12:15:31 +1030 |
| |
On Wed, 3 Feb 2010 09:35:39 am Andi Kleen wrote: > Siarhei Liakh <sliakh.lkml@gmail.com> writes: > > > This patch is a logical extension of the protection provided by > > CONFIG_DEBUG_RODATA to LKMs. The protection is provided by splitting > > module_core and module_init into three logical parts each and setting > > appropriate page access permissions for each individual section: > > My current kernel has 52 modules loaded, most of them very small. > Assuming the additional alignment of the data section cost two more > pages on average (I think that's a good assumption), that's roughly > 424KB of additional memory, plus associated runtime costs in increased > TLB usage. > > What would I get for that if I applied the patch and enabled the option?
Strict RO/NX protection. But without the option enabled, the patch gives best-effort protection, which is nice (for no additional space).
Cheers, Rusty.
| |