The purpose of this patch is produce hardened kernel for Embedded
or Production systems.
Typically debuggers, such as gdb, write to read-only code [text]
sections of target process.(ptrace)
This kind of page protectiion violation raises minor page fault, but
kernel's fault handler allows it by default.
This is clearly attack surface for adversary.
The proposed kernel hardening configuration option checks the type of
protection of the foreign vma and blocks writes to read only vma.
When enabled, it will stop attacks modifying code or jump tables, etc.
Lev Olshvang (5):
security : hardening : prevent write to proces's read-only pages from
another process
Prevent write to read-only pages (text, PLT/GOT tables from another
process
Prevent write to read-only pages (text, PLT/GOT tables from another
process
X86:Prevent write to read-only pages (text, PLT/GOT tables from
another process
UM:Prevent write to read-only pages (text, PLT/GOT tables from another
process
arch/powerpc/include/asm/mmu_context.h | 7 ++++++-
arch/powerpc/mm/book3s64/pkeys.c | 5 +++++
arch/um/include/asm/mmu_context.h | 11 ++++++++---
arch/unicore32/include/asm/mmu_context.h | 7 ++++++-
arch/x86/include/asm/mmu_context.h | 9 ++++++++-
include/asm-generic/mm_hooks.h | 5 +++++
security/Kconfig | 10 ++++++++++
7 files changed, 48 insertions(+), 6 deletions(-)
--
2.17.1
