From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 36A2D83D for ; Thu, 4 Aug 2016 14:17:17 +0000 (UTC) Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by smtp1.linuxfoundation.org (Postfix) with ESMTP id DF4D01A0 for ; Thu, 4 Aug 2016 14:17:16 +0000 (UTC) To: Kees Cook , Catalin Marinas References: <3aa8df3e-3705-9fd5-640c-37c0be2af561@imgtec.com> <0E98DCC5-01EE-4FA7-B6D4-72772279BDFF@arm.com> From: Dave Hansen Message-ID: <57A34E66.1040608@linux.intel.com> Date: Thu, 4 Aug 2016 07:17:10 -0700 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Cc: Jann Horn , "ksummit-discuss@lists.linuxfoundation.org" Subject: Re: [Ksummit-discuss] [TOPIC] kernel hardening / self-protection / whatever List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , On 08/03/2016 10:32 PM, Kees Cook wrote: >> > BTW, while not a kernel security feature, I've been asked in the past to enable >> > execute-only (no read) permissions on arm64 (e.g. mmap(PROT_EXEC)). >> > I have a simple patch for this, though I'm not 100% sure about user ABI implications. >> > So far I'm not aware of any user application using PROT_EXEC only and also >> > expecting PROT_READ. > x86 is working on this too, and IIRC, they uncovered some "fun" ELF > corner cases. I've added Dave for some more background... I haven't been able to find anything in the wild that actually uses PROT_EXEC by itself. The corner cases I hit were because I took a PROT_READ|PROT_EXEC mapping and munged it to really be PROT_EXEC only as an experiment. It blew up pretty spectacularly because of non-page-aligned ELF sections creating pages that really do contain instructions _and_ read-only data. The exec-only support got in 4.6 and does work under qemu today if anyone wants to give it a try.