lkml.org 
[lkml]   [2020]   [May]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: [PATCH v2 9/9] module: Reorder functions
    On Thu, May 21, 2020 at 09:56:40AM -0700, Kristen Carlson Accardi wrote:
    > Introduce a new config option to allow modules to be re-ordered
    > by function. This option can be enabled independently of the
    > kernel text KASLR or FG_KASLR settings so that it can be used
    > by architectures that do not support either of these features.
    > This option will be selected by default if CONFIG_FG_KASLR is
    > selected.
    >
    > If a module has functions split out into separate text sections
    > (i.e. compiled with the -ffunction-sections flag), reorder the
    > functions to provide some code diversification to modules.
    >
    > Signed-off-by: Kristen Carlson Accardi <kristen@linux.intel.com>
    > Reviewed-by: Kees Cook <keescook@chromium.org>
    > Acked-by: Ard Biesheuvel <ardb@kernel.org>
    > Tested-by: Ard Biesheuvel <ardb@kernel.org>
    > Reviewed-by: Tony Luck <tony.luck@intel.com>
    > Tested-by: Tony Luck <tony.luck@intel.com>
    > ---
    > arch/x86/Kconfig | 1 +
    > arch/x86/Makefile | 3 ++
    > init/Kconfig | 11 +++++++
    > kernel/module.c | 81 +++++++++++++++++++++++++++++++++++++++++++++++
    > 4 files changed, 96 insertions(+)
    >
    > diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
    > index 50e83ea57d70..d0bdd5c8c432 100644
    > --- a/arch/x86/Kconfig
    > +++ b/arch/x86/Kconfig
    > @@ -2187,6 +2187,7 @@ config FG_KASLR
    > bool "Function Granular Kernel Address Space Layout Randomization"
    > depends on $(cc-option, -ffunction-sections)
    > depends on RANDOMIZE_BASE && X86_64
    > + select MODULE_FG_KASLR
    > help
    > This option improves the randomness of the kernel text
    > over basic Kernel Address Space Layout Randomization (KASLR)
    > diff --git a/arch/x86/Makefile b/arch/x86/Makefile
    > index b65ec63c7db7..8c830c37c74c 100644
    > --- a/arch/x86/Makefile
    > +++ b/arch/x86/Makefile
    > @@ -51,6 +51,9 @@ ifdef CONFIG_X86_NEED_RELOCS
    > LDFLAGS_vmlinux := --emit-relocs --discard-none
    > endif
    >
    > +ifdef CONFIG_MODULE_FG_KASLR
    > + KBUILD_CFLAGS_MODULE += -ffunction-sections
    > +endif

    With CONFIG_FG_KASLR=y, will -ffunction-sections appear twice on the
    compiler command line?

    > #
    > # Prevent GCC from generating any FP code by mistake.
    > #
    > diff --git a/init/Kconfig b/init/Kconfig
    > index 74a5ac65644f..b19920413bcc 100644
    > --- a/init/Kconfig
    > +++ b/init/Kconfig
    > @@ -2227,6 +2227,17 @@ config UNUSED_KSYMS_WHITELIST
    > one per line. The path can be absolute, or relative to the kernel
    > source tree.
    >
    > +config MODULE_FG_KASLR

    Oh, er, yes. I'd suggested moving 'config FG_KASLR' into arch/Kconfig,
    but I think init/Kconfig is more correct.

    > + depends on $(cc-option, -ffunction-sections)

    Oh! And I am reminded suddenly about CONFIG_FG_KASLR needing to interact
    correctly with CONFIG_LD_DEAD_CODE_DATA_ELIMINATION in that we do NOT
    want the sections to be collapsed at link time:

    #ifdef CONFIG_LD_DEAD_CODE_DATA_ELIMINATION
    #define TEXT_MAIN .text .text.[0-9a-zA-Z_]*

    (I think I had fixed this in some earlier version?)

    I think you want this (untested):


    diff --git a/Makefile b/Makefile
    index 04f5662ae61a..a0d9acd3b900 100644
    --- a/Makefile
    +++ b/Makefile
    @@ -853,8 +853,11 @@ ifdef CONFIG_DEBUG_SECTION_MISMATCH
    KBUILD_CFLAGS += $(call cc-option, -fno-inline-functions-called-once)
    endif

    +ifneq ($(CONFIG_LD_DEAD_CODE_DATA_ELIMINATION)$(CONFIG_FG_KASLR),)
    +KBUILD_CFLAGS_KERNEL += -ffunction-sections
    +endif
    ifdef CONFIG_LD_DEAD_CODE_DATA_ELIMINATION
    -KBUILD_CFLAGS_KERNEL += -ffunction-sections -fdata-sections
    +KBUILD_CFLAGS_KERNEL += -fdata-sections
    LDFLAGS_vmlinux += --gc-sections
    endif

    diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
    index 71e387a5fe90..5f5c692751dd 100644
    --- a/include/asm-generic/vmlinux.lds.h
    +++ b/include/asm-generic/vmlinux.lds.h
    @@ -93,20 +93,31 @@
    * sections to be brought in with rodata.
    */
    #ifdef CONFIG_LD_DEAD_CODE_DATA_ELIMINATION
    -#define TEXT_MAIN .text .text.[0-9a-zA-Z_]*
    #define DATA_MAIN .data .data.[0-9a-zA-Z_]* .data..LPBX*
    #define SDATA_MAIN .sdata .sdata.[0-9a-zA-Z_]*
    #define RODATA_MAIN .rodata .rodata.[0-9a-zA-Z_]*
    #define BSS_MAIN .bss .bss.[0-9a-zA-Z_]*
    #define SBSS_MAIN .sbss .sbss.[0-9a-zA-Z_]*
    #else
    -#define TEXT_MAIN .text
    #define DATA_MAIN .data
    #define SDATA_MAIN .sdata
    #define RODATA_MAIN .rodata
    #define BSS_MAIN .bss
    #define SBSS_MAIN .sbss
    #endif
    +/*
    + * Both LD_DEAD_CODE_DATA_ELIMINATION and CONFIG_FG_KASLR options enable
    + * -ffunction-sections, which produces separately named .text sections. In
    + * the case of CONFIG_FG_KASLR, they need to stay distinct so they can be
    + * separately randomized. Without CONFIG_FG_KASLR, the separate .text
    + * sections can be collected back into a common section, which makes the
    + * resulting image slightly smaller.
    + */
    +#if defined(CONFIG_LD_DEAD_CODE_DATA_ELIMINATION) && !defined(CONFIG_FG_KASLR)
    +#define TEXT_MAIN .text .text.[0-9a-zA-Z_]*
    +#else
    +#define TEXT_MAIN .text
    +#endif

    /*
    * Align to a 32 byte boundary equal to the

    > + bool "Module Function Granular Layout Randomization"
    > + help
    > + This option randomizes the module text section by reordering the text
    > + section by function at module load time. In order to use this
    > + feature, the module must have been compiled with the
    > + -ffunction-sections compiler flag.
    > +
    > + If unsure, say N.
    > +
    > endif # MODULES
    >
    > config MODULES_TREE_LOOKUP
    > diff --git a/kernel/module.c b/kernel/module.c
    > index 646f1e2330d2..e3cd619c60c2 100644
    > --- a/kernel/module.c
    > +++ b/kernel/module.c
    > @@ -53,6 +53,7 @@
    > #include <linux/bsearch.h>
    > #include <linux/dynamic_debug.h>
    > #include <linux/audit.h>
    > +#include <linux/random.h>
    > #include <uapi/linux/module.h>
    > #include "module-internal.h"
    >
    > @@ -2370,6 +2371,83 @@ static long get_offset(struct module *mod, unsigned int *size,
    > return ret;
    > }
    >
    > +/*
    > + * shuffle_text_list()
    > + * Use a Fisher Yates algorithm to shuffle a list of text sections.
    > + */
    > +static void shuffle_text_list(Elf_Shdr **list, int size)
    > +{
    > + int i;
    > + unsigned int j;
    > + Elf_Shdr *temp;
    > +
    > + for (i = size - 1; i > 0; i--) {
    > + /*
    > + * pick a random index from 0 to i
    > + */
    > + get_random_bytes(&j, sizeof(j));
    > + j = j % (i + 1);
    > +
    > + temp = list[i];
    > + list[i] = list[j];
    > + list[j] = temp;
    > + }
    > +}
    > +
    > +/*
    > + * randomize_text()
    > + * Look through the core section looking for executable code sections.
    > + * Store sections in an array and then shuffle the sections
    > + * to reorder the functions.
    > + */
    > +static void randomize_text(struct module *mod, struct load_info *info)
    > +{
    > + int i;
    > + int num_text_sections = 0;
    > + Elf_Shdr **text_list;
    > + int size = 0;
    > + int max_sections = info->hdr->e_shnum;
    > + unsigned int sec = find_sec(info, ".text");
    > +
    > + if (sec == 0)
    > + return;
    > +
    > + text_list = kmalloc_array(max_sections, sizeof(*text_list), GFP_KERNEL);
    > + if (!text_list)
    > + return;
    > +
    > + for (i = 0; i < max_sections; i++) {
    > + Elf_Shdr *shdr = &info->sechdrs[i];
    > + const char *sname = info->secstrings + shdr->sh_name;
    > +
    > + if (!(shdr->sh_flags & SHF_ALLOC) ||
    > + !(shdr->sh_flags & SHF_EXECINSTR) ||
    > + strstarts(sname, ".init"))
    > + continue;
    > +
    > + text_list[num_text_sections] = shdr;
    > + num_text_sections++;
    > + }
    > +
    > + shuffle_text_list(text_list, num_text_sections);
    > +
    > + for (i = 0; i < num_text_sections; i++) {
    > + Elf_Shdr *shdr = text_list[i];
    > +
    > + /*
    > + * get_offset has a section index for it's last
    > + * argument, that is only used by arch_mod_section_prepend(),
    > + * which is only defined by parisc. Since this this type
    > + * of randomization isn't supported on parisc, we can
    > + * safely pass in zero as the last argument, as it is
    > + * ignored.
    > + */
    > + shdr->sh_entsize = get_offset(mod, &size, shdr, 0);
    > + }
    > +
    > + kfree(text_list);
    > +}
    > +
    > /* Lay out the SHF_ALLOC sections in a way not dissimilar to how ld
    > might -- code, read-only data, read-write data, small data. Tally
    > sizes, and place the offsets into sh_entsize fields: high bit means it
    > @@ -2460,6 +2538,9 @@ static void layout_sections(struct module *mod, struct load_info *info)
    > break;
    > }
    > }
    > +
    > + if (IS_ENABLED(CONFIG_MODULE_FG_KASLR))
    > + randomize_text(mod, info);
    > }
    >
    > static void set_license(struct module *mod, const char *license)
    > --
    > 2.20.1
    >

    Everything else looks good.

    --
    Kees Cook

    \
     
     \ /
      Last update: 2020-05-21 23:34    [W:4.121 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site