Re: [PATCH v2] module: Harden STRICT_MODULE_RWX

[Jessica Yu]

+++ Masahiro Yamada [31/08/20 19:42 +0900]:
[snipped for brevity]
> Sorry for the delay.
>
> Please try the attached patch.

Hi Masahiro,

Thank you for the patch. Sorry for the delay, I just wanted to report back
after briefly testing your patch. It works great, at the moment I've only
tested with arm64.

I made the following change to arch/arm64/include/asm/module.lds.h:

diff --git a/arch/arm64/include/asm/module.lds.h b/arch/arm64/include/asm/module.lds.h
index 691f15af788e..d8e786e5fcdb 100644
--- a/arch/arm64/include/asm/module.lds.h
+++ b/arch/arm64/include/asm/module.lds.h
@@ -2,6 +2,8 @@
SECTIONS {
       .plt (NOLOAD) : { BYTE(0) }
       .init.plt (NOLOAD) : { BYTE(0) }
+#ifdef CONFIG_DYNAMIC_FTRACE
       .text.ftrace_trampoline (NOLOAD) : { BYTE(0) }
+#endif
}
#endif

Since originally we wanted to include .text.ftrace_trampoline only conditionally.

The resulting scripts/module.lds looks correct with CONFIG_DYNAMIC_FTRACE=y:

SECTIONS {
/DISCARD/ : {
 *(.discard)
 *(.discard.*)
}
__ksymtab 0 : { *(SORT(___ksymtab+*)) }
__ksymtab_gpl 0 : { *(SORT(___ksymtab_gpl+*)) }
__ksymtab_unused 0 : { *(SORT(___ksymtab_unused+*)) }
__ksymtab_unused_gpl 0 : { *(SORT(___ksymtab_unused_gpl+*)) }
__ksymtab_gpl_future 0 : { *(SORT(___ksymtab_gpl_future+*)) }
__kcrctab 0 : { *(SORT(___kcrctab+*)) }
__kcrctab_gpl 0 : { *(SORT(___kcrctab_gpl+*)) }
__kcrctab_unused 0 : { *(SORT(___kcrctab_unused+*)) }
__kcrctab_unused_gpl 0 : { *(SORT(___kcrctab_unused_gpl+*)) }
__kcrctab_gpl_future 0 : { *(SORT(___kcrctab_gpl_future+*)) }
.init_array 0 : ALIGN(8) { *(SORT(.init_array.*)) *(.init_array) }
__jump_table 0 : ALIGN(8) { KEEP(*(__jump_table)) }
}
SECTIONS {
.plt (NOLOAD) : { BYTE(0) }
.init.plt (NOLOAD) : { BYTE(0) }
.text.ftrace_trampoline (NOLOAD) : { BYTE(0) }
} 

And with CONFIG_DYNAMIC_FTRACE=n as well:

SECTIONS {
.plt (NOLOAD) : { BYTE(0) }
.init.plt (NOLOAD) : { BYTE(0) }
}

I will test on more arches in the next days but in the meantime you could add my

   Tested-by: Jessica Yu <jeyu@xxxxxxxxxx>

Thank you for working on this!