This feature is already supported by and enabled on all architectures we support, this patch ensures IPFire will always make use of it to rule out memory page tampering by userspace applications.
Signed-off-by: Peter Müller peter.mueller@ipfire.org --- config/kernel/kernel.config.aarch64-ipfire | 2 +- config/kernel/kernel.config.riscv64-ipfire | 2 +- config/kernel/kernel.config.x86_64-ipfire | 2 +- config/rootfiles/common/aarch64/linux | 1 + config/rootfiles/common/riscv64/linux | 1 + config/rootfiles/common/x86_64/linux | 1 + 6 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index 74085de00..b7f64d10c 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -8661,7 +8661,7 @@ CONFIG_PAGE_EXTENSION=y # CONFIG_SLUB_DEBUG is not set # CONFIG_PAGE_OWNER is not set CONFIG_PAGE_TABLE_CHECK=y -# CONFIG_PAGE_TABLE_CHECK_ENFORCED is not set +CONFIG_PAGE_TABLE_CHECK_ENFORCED=y # CONFIG_PAGE_POISONING is not set # CONFIG_DEBUG_PAGE_REF is not set # CONFIG_DEBUG_RODATA_TEST is not set diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire index 451607c17..e186bb9a8 100644 --- a/config/kernel/kernel.config.riscv64-ipfire +++ b/config/kernel/kernel.config.riscv64-ipfire @@ -7243,7 +7243,7 @@ CONFIG_PAGE_EXTENSION=y # CONFIG_SLUB_DEBUG is not set # CONFIG_PAGE_OWNER is not set CONFIG_PAGE_TABLE_CHECK=y -# CONFIG_PAGE_TABLE_CHECK_ENFORCED is not set +CONFIG_PAGE_TABLE_CHECK_ENFORCED=y CONFIG_PAGE_POISONING=y # CONFIG_DEBUG_PAGE_REF is not set # CONFIG_DEBUG_RODATA_TEST is not set diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index 6f0f1bfa5..de6f76ce7 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -7800,7 +7800,7 @@ CONFIG_PAGE_EXTENSION=y # CONFIG_SLUB_DEBUG is not set # CONFIG_PAGE_OWNER is not set CONFIG_PAGE_TABLE_CHECK=y -# CONFIG_PAGE_TABLE_CHECK_ENFORCED is not set +CONFIG_PAGE_TABLE_CHECK_ENFORCED=y CONFIG_PAGE_POISONING=y # CONFIG_DEBUG_PAGE_REF is not set # CONFIG_DEBUG_RODATA_TEST is not set diff --git a/config/rootfiles/common/aarch64/linux b/config/rootfiles/common/aarch64/linux index 53dedd2f3..3c9760570 100644 --- a/config/rootfiles/common/aarch64/linux +++ b/config/rootfiles/common/aarch64/linux @@ -10154,6 +10154,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_256KB #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_64KB #lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK +#lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK_ENFORCED #lib/modules/KVER/build/include/config/PAHOLE_VERSION #lib/modules/KVER/build/include/config/PANIC_ON_OOPS_VALUE #lib/modules/KVER/build/include/config/PANIC_TIMEOUT diff --git a/config/rootfiles/common/riscv64/linux b/config/rootfiles/common/riscv64/linux index dca2c7370..578e0d9fb 100644 --- a/config/rootfiles/common/riscv64/linux +++ b/config/rootfiles/common/riscv64/linux @@ -9249,6 +9249,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_256KB #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_64KB #lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK +#lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK_ENFORCED #lib/modules/KVER/build/include/config/PAHOLE_VERSION #lib/modules/KVER/build/include/config/PANIC_ON_OOPS_VALUE #lib/modules/KVER/build/include/config/PANIC_TIMEOUT diff --git a/config/rootfiles/common/x86_64/linux b/config/rootfiles/common/x86_64/linux index cecaf36fa..2469ad645 100644 --- a/config/rootfiles/common/x86_64/linux +++ b/config/rootfiles/common/x86_64/linux @@ -9922,6 +9922,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_256KB #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_64KB #lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK +#lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK_ENFORCED #lib/modules/KVER/build/include/config/PAGE_TABLE_ISOLATION #lib/modules/KVER/build/include/config/PAHOLE_VERSION #lib/modules/KVER/build/include/config/PANASONIC_LAPTOP
Hello,
This is a configuration option only available from kernel 6.10 onwards.
*Please build* those changes that you are submitting and *test* them first. We don’t want to avoid any regressions for the sake of hardening tiny things. We need to collect evidence ourselves how these things perform for our use case.
-Michael
On 21 Sep 2024, at 20:48, Peter Müller peter.mueller@ipfire.org wrote:
This feature is already supported by and enabled on all architectures we support, this patch ensures IPFire will always make use of it to rule out memory page tampering by userspace applications.
Signed-off-by: Peter Müller peter.mueller@ipfire.org
config/kernel/kernel.config.aarch64-ipfire | 2 +- config/kernel/kernel.config.riscv64-ipfire | 2 +- config/kernel/kernel.config.x86_64-ipfire | 2 +- config/rootfiles/common/aarch64/linux | 1 + config/rootfiles/common/riscv64/linux | 1 + config/rootfiles/common/x86_64/linux | 1 + 6 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index 74085de00..b7f64d10c 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -8661,7 +8661,7 @@ CONFIG_PAGE_EXTENSION=y # CONFIG_SLUB_DEBUG is not set # CONFIG_PAGE_OWNER is not set CONFIG_PAGE_TABLE_CHECK=y -# CONFIG_PAGE_TABLE_CHECK_ENFORCED is not set +CONFIG_PAGE_TABLE_CHECK_ENFORCED=y # CONFIG_PAGE_POISONING is not set # CONFIG_DEBUG_PAGE_REF is not set # CONFIG_DEBUG_RODATA_TEST is not set diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire index 451607c17..e186bb9a8 100644 --- a/config/kernel/kernel.config.riscv64-ipfire +++ b/config/kernel/kernel.config.riscv64-ipfire @@ -7243,7 +7243,7 @@ CONFIG_PAGE_EXTENSION=y # CONFIG_SLUB_DEBUG is not set # CONFIG_PAGE_OWNER is not set CONFIG_PAGE_TABLE_CHECK=y -# CONFIG_PAGE_TABLE_CHECK_ENFORCED is not set +CONFIG_PAGE_TABLE_CHECK_ENFORCED=y CONFIG_PAGE_POISONING=y # CONFIG_DEBUG_PAGE_REF is not set # CONFIG_DEBUG_RODATA_TEST is not set diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index 6f0f1bfa5..de6f76ce7 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -7800,7 +7800,7 @@ CONFIG_PAGE_EXTENSION=y # CONFIG_SLUB_DEBUG is not set # CONFIG_PAGE_OWNER is not set CONFIG_PAGE_TABLE_CHECK=y -# CONFIG_PAGE_TABLE_CHECK_ENFORCED is not set +CONFIG_PAGE_TABLE_CHECK_ENFORCED=y CONFIG_PAGE_POISONING=y # CONFIG_DEBUG_PAGE_REF is not set # CONFIG_DEBUG_RODATA_TEST is not set diff --git a/config/rootfiles/common/aarch64/linux b/config/rootfiles/common/aarch64/linux index 53dedd2f3..3c9760570 100644 --- a/config/rootfiles/common/aarch64/linux +++ b/config/rootfiles/common/aarch64/linux @@ -10154,6 +10154,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_256KB #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_64KB #lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK +#lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK_ENFORCED #lib/modules/KVER/build/include/config/PAHOLE_VERSION #lib/modules/KVER/build/include/config/PANIC_ON_OOPS_VALUE #lib/modules/KVER/build/include/config/PANIC_TIMEOUT diff --git a/config/rootfiles/common/riscv64/linux b/config/rootfiles/common/riscv64/linux index dca2c7370..578e0d9fb 100644 --- a/config/rootfiles/common/riscv64/linux +++ b/config/rootfiles/common/riscv64/linux @@ -9249,6 +9249,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_256KB #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_64KB #lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK +#lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK_ENFORCED #lib/modules/KVER/build/include/config/PAHOLE_VERSION #lib/modules/KVER/build/include/config/PANIC_ON_OOPS_VALUE #lib/modules/KVER/build/include/config/PANIC_TIMEOUT diff --git a/config/rootfiles/common/x86_64/linux b/config/rootfiles/common/x86_64/linux index cecaf36fa..2469ad645 100644 --- a/config/rootfiles/common/x86_64/linux +++ b/config/rootfiles/common/x86_64/linux @@ -9922,6 +9922,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_256KB #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_64KB #lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK +#lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK_ENFORCED #lib/modules/KVER/build/include/config/PAGE_TABLE_ISOLATION #lib/modules/KVER/build/include/config/PAHOLE_VERSION
#lib/modules/KVER/build/include/config/PANASONIC_LAPTOP
2.39.5
-
Michael Tremer -
Peter Müller