Commit 40982fd6 authored Aug 25, 2016 by Mark Rutland Committed by Will Deacon Aug 26, 2016

arm64: always enable DEBUG_RODATA and remove the Kconfig option



Follow the example set by x86 in commit 9ccaf77c ("x86/mm:
Always enable CONFIG_DEBUG_RODATA and remove the Kconfig option"), and
make these protections a fundamental security feature rather than an
opt-in. This also results in a minor code simplification.

For those rare cases when users wish to disable this protection (e.g.
for debugging), this can be done by passing 'rodata=off' on the command
line.

As DEBUG_RODATA_ALIGN is only intended to address a performance/memory
tradeoff, and does not affect correctness, this is left user-selectable.
DEBUG_MODULE_RONX is also left user-selectable until the core code
provides a boot-time option to disable the protection for debugging
use-cases.

Cc: Catalin Marinas <catalin.marinas@arm.com>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Acked-by: Kees Cook <keescook@chromium.org>
Acked-by: Laura Abbott <labbott@redhat.com>
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

parent e7cd1903

arch/arm64/Kconfig

+3 −0

Original line number	Diff line number	Diff line
		@@ -122,6 +122,9 @@ config ARCH_PHYS_ADDR_T_64BIT
		config MMU
		def_bool y

		config DEBUG_RODATA
		def_bool y

		config ARM64_PAGE_SHIFT
		int
		default 16 if ARM64_64K_PAGES

arch/arm64/Kconfig.debug

+0 −10

Original line number	Diff line number	Diff line
		@@ -49,16 +49,6 @@ config DEBUG_SET_MODULE_RONX

		If in doubt, say Y.

		config DEBUG_RODATA
		bool "Make kernel text and rodata read-only"
		default y
		help
		If this is set, kernel text and rodata will be made read-only. This
		is to help catch accidental or malicious attempts to change the
		kernel's executable code.

		If in doubt, say Y.

		config DEBUG_ALIGN_RODATA
		depends on DEBUG_RODATA
		bool "Align linker sections up to SECTION_SIZE"

arch/arm64/kernel/insn.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -96,7 +96,7 @@ static void __kprobes patch_map(void addr, int fixmap)

		if (module && IS_ENABLED(CONFIG_DEBUG_SET_MODULE_RONX))
		page = vmalloc_to_page(addr);
		else if (!module && IS_ENABLED(CONFIG_DEBUG_RODATA))
		else if (!module)
		page = pfn_to_page(PHYS_PFN(__pa(addr)));
		else
		return addr;

Admin message