From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753533AbcFGGmP (ORCPT ); Tue, 7 Jun 2016 02:42:15 -0400 Received: from mx1.redhat.com ([209.132.183.28]:34808 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751507AbcFGGmO (ORCPT ); Tue, 7 Jun 2016 02:42:14 -0400 Date: Tue, 7 Jun 2016 02:42:10 -0400 From: Jessica Yu To: Rusty Russell Cc: Kees Cook , LKML , Laura Abbott Subject: Re: Adding module support for __ro_after_init Message-ID: <20160607064210.GA13671@packer-debian-8-amd64.digitalocean.com> References: <87fuss6x3f.fsf@rustcorp.com.au> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Disposition: inline In-Reply-To: <87fuss6x3f.fsf@rustcorp.com.au> X-OS: Linux eisen.io 3.16.0-4-amd64 x86_64 User-Agent: Mutt/1.5.23 (2014-03-12) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Tue, 07 Jun 2016 06:42:13 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org +++ Rusty Russell [05/06/16 14:39 +0930]: >Kees Cook writes: >> Hi Rusty, >> >> I'd love to get your thoughts on the best way to support >> __ro_after_init markings for modules. Are the r/o markings done after >> module __init runs? If so, this should make things easy, and then we >> just need to move .data..ro_after_init into .rodata at link time. If >> not, then we'd need to explicitly make this section read-only after >> _init. > >As you might expect, the sections are made read-only before anything >runs. We'll need to do the latter, which means it needs to be >page-aligned. (Well we could put it in the same page as .rodata, and >just not protect that fully until after init). Hi Rusty, Kees, :-) Right, RO protection is enabled in load_module() before module __init gets to run. So I guess there are two ways to go about this: either (1) keep __ro_after_init with the rest of rodata and toggle RO protection after __init runs, but I think we'd probably want to keep this protection before anything executes. Or (2) modify layout_sections() in the module loader to place .data..ro_after_init data in its own set of page(s) so that we can toggle RO on/off independently of the other module sections, and set them to RO only after module init runs. So perhaps the modified module memory layout might look like.. [text] [rodata] [ro after init] [writable data] I don't think (2) should be hard to implement in the module loader (well, at first glance :-), maybe I'm missing something), but I could go ahead and give a patch a shot. Jessica