From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Tremer To: development@lists.ipfire.org Subject: Re: [PATCH] linux: Enforce userspace page table checks Date: Sun, 22 Sep 2024 15:50:24 +0100 Message-ID: In-Reply-To: <20240921194808.723280-1-peter.mueller@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============5367153340324408697==" List-Id: --===============5367153340324408697== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hello, This is a configuration option only available from kernel 6.10 onwards. *Please build* those changes that you are submitting and *test* them first. W= e don=E2=80=99t want to avoid any regressions for the sake of hardening tiny = things. We need to collect evidence ourselves how these things perform for ou= r use case. -Michael > On 21 Sep 2024, at 20:48, Peter M=C3=BCller wr= ote: >=20 > This feature is already supported by and enabled on all > architectures we support, this patch ensures IPFire will > always make use of it to rule out memory page tampering by > userspace applications. >=20 > Signed-off-by: Peter M=C3=BCller > --- > config/kernel/kernel.config.aarch64-ipfire | 2 +- > config/kernel/kernel.config.riscv64-ipfire | 2 +- > config/kernel/kernel.config.x86_64-ipfire | 2 +- > config/rootfiles/common/aarch64/linux | 1 + > config/rootfiles/common/riscv64/linux | 1 + > config/rootfiles/common/x86_64/linux | 1 + > 6 files changed, 6 insertions(+), 3 deletions(-) >=20 > diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/ker= nel.config.aarch64-ipfire > index 74085de00..b7f64d10c 100644 > --- a/config/kernel/kernel.config.aarch64-ipfire > +++ b/config/kernel/kernel.config.aarch64-ipfire > @@ -8661,7 +8661,7 @@ CONFIG_PAGE_EXTENSION=3Dy > # CONFIG_SLUB_DEBUG is not set > # CONFIG_PAGE_OWNER is not set > CONFIG_PAGE_TABLE_CHECK=3Dy > -# CONFIG_PAGE_TABLE_CHECK_ENFORCED is not set > +CONFIG_PAGE_TABLE_CHECK_ENFORCED=3Dy > # CONFIG_PAGE_POISONING is not set > # CONFIG_DEBUG_PAGE_REF is not set > # CONFIG_DEBUG_RODATA_TEST is not set > diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/ker= nel.config.riscv64-ipfire > index 451607c17..e186bb9a8 100644 > --- a/config/kernel/kernel.config.riscv64-ipfire > +++ b/config/kernel/kernel.config.riscv64-ipfire > @@ -7243,7 +7243,7 @@ CONFIG_PAGE_EXTENSION=3Dy > # CONFIG_SLUB_DEBUG is not set > # CONFIG_PAGE_OWNER is not set > CONFIG_PAGE_TABLE_CHECK=3Dy > -# CONFIG_PAGE_TABLE_CHECK_ENFORCED is not set > +CONFIG_PAGE_TABLE_CHECK_ENFORCED=3Dy > CONFIG_PAGE_POISONING=3Dy > # CONFIG_DEBUG_PAGE_REF is not set > # CONFIG_DEBUG_RODATA_TEST is not set > diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kern= el.config.x86_64-ipfire > index 6f0f1bfa5..de6f76ce7 100644 > --- a/config/kernel/kernel.config.x86_64-ipfire > +++ b/config/kernel/kernel.config.x86_64-ipfire > @@ -7800,7 +7800,7 @@ CONFIG_PAGE_EXTENSION=3Dy > # CONFIG_SLUB_DEBUG is not set > # CONFIG_PAGE_OWNER is not set > CONFIG_PAGE_TABLE_CHECK=3Dy > -# CONFIG_PAGE_TABLE_CHECK_ENFORCED is not set > +CONFIG_PAGE_TABLE_CHECK_ENFORCED=3Dy > CONFIG_PAGE_POISONING=3Dy > # CONFIG_DEBUG_PAGE_REF is not set > # CONFIG_DEBUG_RODATA_TEST is not set > diff --git a/config/rootfiles/common/aarch64/linux b/config/rootfiles/commo= n/aarch64/linux > index 53dedd2f3..3c9760570 100644 > --- a/config/rootfiles/common/aarch64/linux > +++ b/config/rootfiles/common/aarch64/linux > @@ -10154,6 +10154,7 @@ etc/modprobe.d/ipv6.conf > #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_256KB > #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_64KB > #lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK > +#lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK_ENFORCED > #lib/modules/KVER/build/include/config/PAHOLE_VERSION > #lib/modules/KVER/build/include/config/PANIC_ON_OOPS_VALUE > #lib/modules/KVER/build/include/config/PANIC_TIMEOUT > diff --git a/config/rootfiles/common/riscv64/linux b/config/rootfiles/commo= n/riscv64/linux > index dca2c7370..578e0d9fb 100644 > --- a/config/rootfiles/common/riscv64/linux > +++ b/config/rootfiles/common/riscv64/linux > @@ -9249,6 +9249,7 @@ etc/modprobe.d/ipv6.conf > #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_256KB > #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_64KB > #lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK > +#lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK_ENFORCED > #lib/modules/KVER/build/include/config/PAHOLE_VERSION > #lib/modules/KVER/build/include/config/PANIC_ON_OOPS_VALUE > #lib/modules/KVER/build/include/config/PANIC_TIMEOUT > diff --git a/config/rootfiles/common/x86_64/linux b/config/rootfiles/common= /x86_64/linux > index cecaf36fa..2469ad645 100644 > --- a/config/rootfiles/common/x86_64/linux > +++ b/config/rootfiles/common/x86_64/linux > @@ -9922,6 +9922,7 @@ etc/modprobe.d/ipv6.conf > #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_256KB > #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_64KB > #lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK > +#lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK_ENFORCED > #lib/modules/KVER/build/include/config/PAGE_TABLE_ISOLATION > #lib/modules/KVER/build/include/config/PAHOLE_VERSION > #lib/modules/KVER/build/include/config/PANASONIC_LAPTOP > --=20 > 2.39.5 >=20 --===============5367153340324408697==--