Files
kernel_google_wahoo/include/linux
Kees Cook bfd3de058f UPSTREAM: arch: Introduce post-init read-only memory
One of the easiest ways to protect the kernel from attack is to reduce
the internal attack surface exposed when a "write" flaw is available. By
making as much of the kernel read-only as possible, we reduce the
attack surface.

Many things are written to only during __init, and never changed
again. These cannot be made "const" since the compiler will do the wrong
thing (we do actually need to write to them). Instead, move these items
into a memory region that will be made read-only during mark_rodata_ro()
which happens after all kernel __init code has finished.

This introduces __ro_after_init as a way to mark such memory, and adds
some documentation about the existing __read_mostly marking.

This improves the security of the Linux kernel by marking formerly
read-write memory regions as read-only on a fully booted up system.

Based on work by PaX Team and Brad Spengler.

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brad Spengler <spender@grsecurity.net>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: David Brown <david.brown@linaro.org>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Emese Revfy <re.emese@gmail.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mathias Krause <minipli@googlemail.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: PaX Team <pageexec@freemail.hu>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: kernel-hardening@lists.openwall.com
Cc: linux-arch <linux-arch@vger.kernel.org>
Link: http://lkml.kernel.org/r/1455748879-21872-5-git-send-email-keescook@chromium.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>

Bug: 31660652
Change-Id: I640f6d858d9770a5e480d12a1c716adf8842feb0
(cherry picked from commit c74ba8b3480da6ddaea17df2263ec09b869ac496)
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
2016-09-23 10:04:12 -07:00
..
2015-10-01 12:48:11 -07:00
2015-06-25 11:49:31 +03:00
2015-10-17 21:22:08 -07:00
2015-10-07 18:08:15 +01:00
2015-08-27 20:47:09 +01:00
2016-09-08 00:46:58 +00:00
2015-08-03 12:01:54 -04:00
2015-11-07 10:40:47 -07:00
2016-02-16 13:52:32 -08:00
2015-09-04 16:54:41 -07:00
2015-09-08 15:35:28 -07:00
2015-10-18 10:14:39 -07:00
2015-06-24 17:49:45 -07:00
2016-02-16 13:50:55 -08:00
2015-09-08 15:35:28 -07:00
2015-10-23 05:44:28 -07:00
2015-08-27 19:40:58 -04:00
2015-10-01 15:06:43 +02:00
2015-10-13 19:01:25 +02:00
2015-06-25 12:06:45 +02:00
2015-08-18 15:49:15 -07:00
2015-07-28 08:50:42 +01:00
2015-11-23 09:44:58 +01:00
2015-10-27 18:55:31 -07:00
2015-06-24 17:49:41 -07:00
2016-09-06 15:53:07 +00:00
2015-10-20 22:10:45 +08:00
2015-07-21 10:39:05 -07:00
2015-06-25 04:20:04 -04:00
2015-08-17 13:32:56 -05:00
2015-09-10 13:29:01 -07:00
2015-09-10 13:29:01 -07:00
2015-11-06 17:50:42 -08:00
2015-10-09 17:00:32 -04:00
2015-10-06 17:08:19 +02:00
2015-05-26 15:23:23 +02:00
2015-06-25 01:13:43 +02:00
2016-09-06 15:53:36 +00:00
2015-09-10 15:36:59 -04:00
2015-06-25 17:00:39 -07:00
2015-11-05 14:36:09 -05:00
2015-08-17 11:25:28 -07:00
2015-10-01 09:57:59 -07:00
2015-10-19 01:01:21 +02:00
2015-11-20 16:19:54 -08:00
2015-11-23 09:44:58 +01:00
2015-12-04 08:38:42 -07:00
2015-12-13 14:30:59 -08:00
2015-11-13 20:34:33 -05:00
2015-09-08 15:35:28 -07:00