From patchwork Sat Sep 21 19:48:08 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Peter_M=C3=BCller?= X-Patchwork-Id: 8147 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R10" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4XB0DK0tNPz3wxp for ; Sat, 21 Sep 2024 19:48:17 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) client-signature ECDSA (secp384r1)) (Client CN "mail02.haj.ipfire.org", Issuer "E6" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4XB0DF5xxvz1Fs; Sat, 21 Sep 2024 19:48:13 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4XB0DF3Qkvz343j; Sat, 21 Sep 2024 19:48:13 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R10" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4XB0DC1f0Nz2xkm for ; Sat, 21 Sep 2024 19:48:11 +0000 (UTC) Received: from people01.haj.ipfire.org (people01.haj.ipfire.org [172.28.1.161]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature ECDSA (secp384r1) client-digest SHA384) (Client CN "people01.haj.ipfire.org", Issuer "E5" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4XB0DB0MFJzJD; Sat, 21 Sep 2024 19:48:10 +0000 (UTC) Received: by people01.haj.ipfire.org (Postfix, from userid 1078) id 4XB0D95HNTz2xQH; Sat, 21 Sep 2024 19:48:09 +0000 (UTC) From: =?utf-8?q?Peter_M=C3=BCller?= To: development@lists.ipfire.org Subject: [PATCH] linux: Enforce userspace page table checks Date: Sat, 21 Sep 2024 19:48:08 +0000 Message-Id: <20240921194808.723280-1-peter.mueller@ipfire.org> X-Mailer: git-send-email 2.39.5 MIME-Version: 1.0 Message-ID-Hash: KOH6773JU57KCZVTJMQYTTAYBGYGCMG4 X-Message-ID-Hash: KOH6773JU57KCZVTJMQYTTAYBGYGCMG4 X-MailFrom: pmueller@people01.haj.ipfire.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: =?utf-8?q?Peter_M=C3=BCller?= X-Mailman-Version: 3.3.8 Precedence: list List-Id: IPFire development talk Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: This feature is already supported by and enabled on all architectures we support, this patch ensures IPFire will always make use of it to rule out memory page tampering by userspace applications. Signed-off-by: Peter Müller --- config/kernel/kernel.config.aarch64-ipfire | 2 +- config/kernel/kernel.config.riscv64-ipfire | 2 +- config/kernel/kernel.config.x86_64-ipfire | 2 +- config/rootfiles/common/aarch64/linux | 1 + config/rootfiles/common/riscv64/linux | 1 + config/rootfiles/common/x86_64/linux | 1 + 6 files changed, 6 insertions(+), 3 deletions(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index 74085de00..b7f64d10c 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -8661,7 +8661,7 @@ CONFIG_PAGE_EXTENSION=y # CONFIG_SLUB_DEBUG is not set # CONFIG_PAGE_OWNER is not set CONFIG_PAGE_TABLE_CHECK=y -# CONFIG_PAGE_TABLE_CHECK_ENFORCED is not set +CONFIG_PAGE_TABLE_CHECK_ENFORCED=y # CONFIG_PAGE_POISONING is not set # CONFIG_DEBUG_PAGE_REF is not set # CONFIG_DEBUG_RODATA_TEST is not set diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire index 451607c17..e186bb9a8 100644 --- a/config/kernel/kernel.config.riscv64-ipfire +++ b/config/kernel/kernel.config.riscv64-ipfire @@ -7243,7 +7243,7 @@ CONFIG_PAGE_EXTENSION=y # CONFIG_SLUB_DEBUG is not set # CONFIG_PAGE_OWNER is not set CONFIG_PAGE_TABLE_CHECK=y -# CONFIG_PAGE_TABLE_CHECK_ENFORCED is not set +CONFIG_PAGE_TABLE_CHECK_ENFORCED=y CONFIG_PAGE_POISONING=y # CONFIG_DEBUG_PAGE_REF is not set # CONFIG_DEBUG_RODATA_TEST is not set diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index 6f0f1bfa5..de6f76ce7 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -7800,7 +7800,7 @@ CONFIG_PAGE_EXTENSION=y # CONFIG_SLUB_DEBUG is not set # CONFIG_PAGE_OWNER is not set CONFIG_PAGE_TABLE_CHECK=y -# CONFIG_PAGE_TABLE_CHECK_ENFORCED is not set +CONFIG_PAGE_TABLE_CHECK_ENFORCED=y CONFIG_PAGE_POISONING=y # CONFIG_DEBUG_PAGE_REF is not set # CONFIG_DEBUG_RODATA_TEST is not set diff --git a/config/rootfiles/common/aarch64/linux b/config/rootfiles/common/aarch64/linux index 53dedd2f3..3c9760570 100644 --- a/config/rootfiles/common/aarch64/linux +++ b/config/rootfiles/common/aarch64/linux @@ -10154,6 +10154,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_256KB #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_64KB #lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK +#lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK_ENFORCED #lib/modules/KVER/build/include/config/PAHOLE_VERSION #lib/modules/KVER/build/include/config/PANIC_ON_OOPS_VALUE #lib/modules/KVER/build/include/config/PANIC_TIMEOUT diff --git a/config/rootfiles/common/riscv64/linux b/config/rootfiles/common/riscv64/linux index dca2c7370..578e0d9fb 100644 --- a/config/rootfiles/common/riscv64/linux +++ b/config/rootfiles/common/riscv64/linux @@ -9249,6 +9249,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_256KB #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_64KB #lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK +#lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK_ENFORCED #lib/modules/KVER/build/include/config/PAHOLE_VERSION #lib/modules/KVER/build/include/config/PANIC_ON_OOPS_VALUE #lib/modules/KVER/build/include/config/PANIC_TIMEOUT diff --git a/config/rootfiles/common/x86_64/linux b/config/rootfiles/common/x86_64/linux index cecaf36fa..2469ad645 100644 --- a/config/rootfiles/common/x86_64/linux +++ b/config/rootfiles/common/x86_64/linux @@ -9922,6 +9922,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_256KB #lib/modules/KVER/build/include/config/PAGE_SIZE_LESS_THAN_64KB #lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK +#lib/modules/KVER/build/include/config/PAGE_TABLE_CHECK_ENFORCED #lib/modules/KVER/build/include/config/PAGE_TABLE_ISOLATION #lib/modules/KVER/build/include/config/PAHOLE_VERSION #lib/modules/KVER/build/include/config/PANASONIC_LAPTOP