* [PATCH] linux: Enforce userspace page table checks
@ 2024-09-21 19:48 Peter Müller
2024-09-22 14:50 ` Michael Tremer
0 siblings, 1 reply; 2+ messages in thread
From: Peter Müller @ 2024-09-21 19:48 UTC (permalink / raw)
To: development
[-- Attachment #1: Type: text/plain, Size: 4435 bytes --]
This feature is already supported by and enabled on all
architectures we support, this patch ensures IPFire will
always make use of it to rule out memory page tampering by
userspace applications.
Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>
---
config/kernel/kernel.config.aarch64-ipfire | 2 +-
config/kernel/kernel.config.riscv64-ipfire | 2 +-
config/kernel/kernel.config.x86_64-ipfire | 2 +-
config/rootfiles/common/aarch64/linux | 1 +
config/rootfiles/common/riscv64/linux | 1 +
config/rootfiles/common/x86_64/linux | 1 +
6 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire
index 74085de00..b7f64d10c 100644
--- a/config/kernel/kernel.config.aarch64-ipfire
+++ b/config/kernel/kernel.config.aarch64-ipfire
@@ -8661,7 +8661,7 @@ CONFIG_PAGE_EXTENSION=y
# CONFIG_SLUB_DEBUG is not set
# CONFIG_PAGE_OWNER is not set
CONFIG_PAGE_TABLE_CHECK=y
-# CONFIG_PAGE_TABLE_CHECK_ENFORCED is not set
+CONFIG_PAGE_TABLE_CHECK_ENFORCED=y
# CONFIG_PAGE_POISONING is not set
# CONFIG_DEBUG_PAGE_REF is not set
# CONFIG_DEBUG_RODATA_TEST is not set
diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire
index 451607c17..e186bb9a8 100644
--- a/config/kernel/kernel.config.riscv64-ipfire
+++ b/config/kernel/kernel.config.riscv64-ipfire
@@ -7243,7 +7243,7 @@ CONFIG_PAGE_EXTENSION=y
# CONFIG_SLUB_DEBUG is not set
# CONFIG_PAGE_OWNER is not set
CONFIG_PAGE_TABLE_CHECK=y
-# CONFIG_PAGE_TABLE_CHECK_ENFORCED is not set
+CONFIG_PAGE_TABLE_CHECK_ENFORCED=y
CONFIG_PAGE_POISONING=y
# CONFIG_DEBUG_PAGE_REF is not set
# CONFIG_DEBUG_RODATA_TEST is not set
diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire
index 6f0f1bfa5..de6f76ce7 100644
--- a/config/kernel/kernel.config.x86_64-ipfire
+++ b/config/kernel/kernel.config.x86_64-ipfire
@@ -7800,7 +7800,7 @@ CONFIG_PAGE_EXTENSION=y
# CONFIG_SLUB_DEBUG is not set
# CONFIG_PAGE_OWNER is not set
CONFIG_PAGE_TABLE_CHECK=y
-# CONFIG_PAGE_TABLE_CHECK_ENFORCED is not set
+CONFIG_PAGE_TABLE_CHECK_ENFORCED=y
CONFIG_PAGE_POISONING=y
# CONFIG_DEBUG_PAGE_REF is not set
# CONFIG_DEBUG_RODATA_TEST is not set
diff --git a/config/rootfiles/common/aarch64/linux b/config/rootfiles/common/aarch64/linux
index 53dedd2f3..3c9760570 100644
--- a/config/rootfiles/common/aarch64/linux
+++ b/config/rootfiles/common/aarch64/linux
@@ -10154,6 +10154,7 @@ etc/modprobe.d/ipv6.conf
#lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_256KB
#lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_64KB
#lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK
+#lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK_ENFORCED
#lib/modules/KVER/build/include/config/PAHOLE_VERSION
#lib/modules/KVER/build/include/config/PANIC_ON_OOPS_VALUE
#lib/modules/KVER/build/include/config/PANIC_TIMEOUT
diff --git a/config/rootfiles/common/riscv64/linux b/config/rootfiles/common/riscv64/linux
index dca2c7370..578e0d9fb 100644
--- a/config/rootfiles/common/riscv64/linux
+++ b/config/rootfiles/common/riscv64/linux
@@ -9249,6 +9249,7 @@ etc/modprobe.d/ipv6.conf
#lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_256KB
#lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_64KB
#lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK
+#lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK_ENFORCED
#lib/modules/KVER/build/include/config/PAHOLE_VERSION
#lib/modules/KVER/build/include/config/PANIC_ON_OOPS_VALUE
#lib/modules/KVER/build/include/config/PANIC_TIMEOUT
diff --git a/config/rootfiles/common/x86_64/linux b/config/rootfiles/common/x86_64/linux
index cecaf36fa..2469ad645 100644
--- a/config/rootfiles/common/x86_64/linux
+++ b/config/rootfiles/common/x86_64/linux
@@ -9922,6 +9922,7 @@ etc/modprobe.d/ipv6.conf
#lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_256KB
#lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_64KB
#lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK
+#lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK_ENFORCED
#lib/modules/KVER/build/include/config/PAGE_TABLE_ISOLATION
#lib/modules/KVER/build/include/config/PAHOLE_VERSION
#lib/modules/KVER/build/include/config/PANASONIC_LAPTOP
--
2.39.5
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] linux: Enforce userspace page table checks
2024-09-21 19:48 [PATCH] linux: Enforce userspace page table checks Peter Müller
@ 2024-09-22 14:50 ` Michael Tremer
0 siblings, 0 replies; 2+ messages in thread
From: Michael Tremer @ 2024-09-22 14:50 UTC (permalink / raw)
To: development
[-- Attachment #1: Type: text/plain, Size: 5000 bytes --]
Hello,
This is a configuration option only available from kernel 6.10 onwards.
*Please build* those changes that you are submitting and *test* them first. We don’t want to avoid any regressions for the sake of hardening tiny things. We need to collect evidence ourselves how these things perform for our use case.
-Michael
> On 21 Sep 2024, at 20:48, Peter Müller <peter.mueller(a)ipfire.org> wrote:
>
> This feature is already supported by and enabled on all
> architectures we support, this patch ensures IPFire will
> always make use of it to rule out memory page tampering by
> userspace applications.
>
> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>
> ---
> config/kernel/kernel.config.aarch64-ipfire | 2 +-
> config/kernel/kernel.config.riscv64-ipfire | 2 +-
> config/kernel/kernel.config.x86_64-ipfire | 2 +-
> config/rootfiles/common/aarch64/linux | 1 +
> config/rootfiles/common/riscv64/linux | 1 +
> config/rootfiles/common/x86_64/linux | 1 +
> 6 files changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire
> index 74085de00..b7f64d10c 100644
> --- a/config/kernel/kernel.config.aarch64-ipfire
> +++ b/config/kernel/kernel.config.aarch64-ipfire
> @@ -8661,7 +8661,7 @@ CONFIG_PAGE_EXTENSION=y
> # CONFIG_SLUB_DEBUG is not set
> # CONFIG_PAGE_OWNER is not set
> CONFIG_PAGE_TABLE_CHECK=y
> -# CONFIG_PAGE_TABLE_CHECK_ENFORCED is not set
> +CONFIG_PAGE_TABLE_CHECK_ENFORCED=y
> # CONFIG_PAGE_POISONING is not set
> # CONFIG_DEBUG_PAGE_REF is not set
> # CONFIG_DEBUG_RODATA_TEST is not set
> diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire
> index 451607c17..e186bb9a8 100644
> --- a/config/kernel/kernel.config.riscv64-ipfire
> +++ b/config/kernel/kernel.config.riscv64-ipfire
> @@ -7243,7 +7243,7 @@ CONFIG_PAGE_EXTENSION=y
> # CONFIG_SLUB_DEBUG is not set
> # CONFIG_PAGE_OWNER is not set
> CONFIG_PAGE_TABLE_CHECK=y
> -# CONFIG_PAGE_TABLE_CHECK_ENFORCED is not set
> +CONFIG_PAGE_TABLE_CHECK_ENFORCED=y
> CONFIG_PAGE_POISONING=y
> # CONFIG_DEBUG_PAGE_REF is not set
> # CONFIG_DEBUG_RODATA_TEST is not set
> diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire
> index 6f0f1bfa5..de6f76ce7 100644
> --- a/config/kernel/kernel.config.x86_64-ipfire
> +++ b/config/kernel/kernel.config.x86_64-ipfire
> @@ -7800,7 +7800,7 @@ CONFIG_PAGE_EXTENSION=y
> # CONFIG_SLUB_DEBUG is not set
> # CONFIG_PAGE_OWNER is not set
> CONFIG_PAGE_TABLE_CHECK=y
> -# CONFIG_PAGE_TABLE_CHECK_ENFORCED is not set
> +CONFIG_PAGE_TABLE_CHECK_ENFORCED=y
> CONFIG_PAGE_POISONING=y
> # CONFIG_DEBUG_PAGE_REF is not set
> # CONFIG_DEBUG_RODATA_TEST is not set
> diff --git a/config/rootfiles/common/aarch64/linux b/config/rootfiles/common/aarch64/linux
> index 53dedd2f3..3c9760570 100644
> --- a/config/rootfiles/common/aarch64/linux
> +++ b/config/rootfiles/common/aarch64/linux
> @@ -10154,6 +10154,7 @@ etc/modprobe.d/ipv6.conf
> #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_256KB
> #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_64KB
> #lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK
> +#lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK_ENFORCED
> #lib/modules/KVER/build/include/config/PAHOLE_VERSION
> #lib/modules/KVER/build/include/config/PANIC_ON_OOPS_VALUE
> #lib/modules/KVER/build/include/config/PANIC_TIMEOUT
> diff --git a/config/rootfiles/common/riscv64/linux b/config/rootfiles/common/riscv64/linux
> index dca2c7370..578e0d9fb 100644
> --- a/config/rootfiles/common/riscv64/linux
> +++ b/config/rootfiles/common/riscv64/linux
> @@ -9249,6 +9249,7 @@ etc/modprobe.d/ipv6.conf
> #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_256KB
> #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_64KB
> #lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK
> +#lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK_ENFORCED
> #lib/modules/KVER/build/include/config/PAHOLE_VERSION
> #lib/modules/KVER/build/include/config/PANIC_ON_OOPS_VALUE
> #lib/modules/KVER/build/include/config/PANIC_TIMEOUT
> diff --git a/config/rootfiles/common/x86_64/linux b/config/rootfiles/common/x86_64/linux
> index cecaf36fa..2469ad645 100644
> --- a/config/rootfiles/common/x86_64/linux
> +++ b/config/rootfiles/common/x86_64/linux
> @@ -9922,6 +9922,7 @@ etc/modprobe.d/ipv6.conf
> #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_256KB
> #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_64KB
> #lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK
> +#lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK_ENFORCED
> #lib/modules/KVER/build/include/config/PAGE_TABLE_ISOLATION
> #lib/modules/KVER/build/include/config/PAHOLE_VERSION
> #lib/modules/KVER/build/include/config/PANASONIC_LAPTOP
> --
> 2.39.5
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-09-22 14:50 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-09-21 19:48 [PATCH] linux: Enforce userspace page table checks Peter Müller
2024-09-22 14:50 ` Michael Tremer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox