Files
kernel/include/linux
Kees Cook c74ba8b348 arch: Introduce post-init read-only memory
One of the easiest ways to protect the kernel from attack is to reduce
the internal attack surface exposed when a "write" flaw is available. By
making as much of the kernel read-only as possible, we reduce the
attack surface.

Many things are written to only during __init, and never changed
again. These cannot be made "const" since the compiler will do the wrong
thing (we do actually need to write to them). Instead, move these items
into a memory region that will be made read-only during mark_rodata_ro()
which happens after all kernel __init code has finished.

This introduces __ro_after_init as a way to mark such memory, and adds
some documentation about the existing __read_mostly marking.

This improves the security of the Linux kernel by marking formerly
read-write memory regions as read-only on a fully booted up system.

Based on work by PaX Team and Brad Spengler.

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brad Spengler <spender@grsecurity.net>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: David Brown <david.brown@linaro.org>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Emese Revfy <re.emese@gmail.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mathias Krause <minipli@googlemail.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: PaX Team <pageexec@freemail.hu>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: kernel-hardening@lists.openwall.com
Cc: linux-arch <linux-arch@vger.kernel.org>
Link: http://lkml.kernel.org/r/1455748879-21872-5-git-send-email-keescook@chromium.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2016-02-22 08:51:38 +01:00
..
2016-02-04 18:26:08 +01:00
2016-01-05 18:04:58 +01:00
2015-11-16 15:41:49 +00:00
2015-12-23 08:37:10 -07:00
2015-12-22 09:38:34 -07:00
2015-12-06 12:46:31 +01:00
2016-01-30 13:35:32 -08:00
2016-01-08 01:12:06 +01:00
2015-12-28 13:41:50 +01:00
2016-01-15 17:56:32 -08:00
2015-11-25 09:22:00 -07:00
2016-01-20 17:09:18 -08:00
2015-12-14 10:03:46 +01:00
2016-01-15 17:56:32 -08:00
2016-01-15 17:56:32 -08:00
2016-01-15 17:56:32 -08:00
2016-02-03 08:28:43 -08:00
2016-02-03 08:28:43 -08:00
2016-01-04 13:19:55 -05:00
2016-01-22 17:02:18 -08:00
2016-02-11 18:35:48 -08:00
2016-02-11 18:35:48 -08:00
2016-01-07 14:31:27 -05:00
2015-11-16 09:23:47 +01:00
2016-01-10 22:13:15 -05:00
2015-12-13 19:59:48 -08:00
2016-01-04 16:11:11 -05:00
2016-02-09 04:28:06 -05:00
2016-01-04 10:20:19 -05:00
2015-11-05 14:36:09 -05:00
2016-01-15 22:34:39 +01:00
2015-11-23 09:44:58 +01:00
2015-12-21 15:28:11 -07:00
2016-01-12 20:47:02 +02:00
2016-01-15 17:56:32 -08:00
2016-01-14 16:00:49 -08:00
2015-12-03 07:24:29 -08:00