kernel/module/strict_rwx.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  * Module strict rwx
   4  *
   5  * Copyright (C) 2015 Rusty Russell
   6  */
   7
   8 #include <linux/module.h>
   9 #include <linux/mm.h>
  10 #include <linux/vmalloc.h>
  11 #include <linux/set_memory.h>
  12 #include "internal.h"
  13
  14 static int module_set_memory(const struct module *mod, enum mod_mem_type type,
  15                              int (*set_memory)(unsigned long start, int num_pages))
  16 {
  17         const struct module_memory *mod_mem = &mod->mem[type];
  18
  19         if (!mod_mem->base)
  20                 return 0;
  21
  22         set_vm_flush_reset_perms(mod_mem->base);
  23         return set_memory((unsigned long)mod_mem->base, mod_mem->size >> PAGE_SHIFT);
  24 }
  25
  26 /*
  27  * Since some arches are moving towards PAGE_KERNEL module allocations instead
  28  * of PAGE_KERNEL_EXEC, keep module_enable_x() independent of
  29  * CONFIG_STRICT_MODULE_RWX because they are needed regardless of whether we
  30  * are strict.
  31  */
  32 int module_enable_text_rox(const struct module *mod)
  33 {
  34         for_class_mod_mem_type(type, text) {
  35                 int ret;
  36
  37                 if (mod->mem[type].is_rox)
  38                         continue;
  39
  40                 if (IS_ENABLED(CONFIG_STRICT_MODULE_RWX))
  41                         ret = module_set_memory(mod, type, set_memory_rox);
  42                 else
  43                         ret = module_set_memory(mod, type, set_memory_x);
  44                 if (ret)
  45                         return ret;
  46         }
  47         return 0;
  48 }
  49
  50 int module_enable_rodata_ro(const struct module *mod, bool after_init)
  51 {
  52         int ret;
  53
  54         if (!IS_ENABLED(CONFIG_STRICT_MODULE_RWX) || !rodata_enabled)
  55                 return 0;
  56
  57         ret = module_set_memory(mod, MOD_RODATA, set_memory_ro);
  58         if (ret)
  59                 return ret;
  60         ret = module_set_memory(mod, MOD_INIT_RODATA, set_memory_ro);
  61         if (ret)
  62                 return ret;
  63
  64         if (after_init)
  65                 return module_set_memory(mod, MOD_RO_AFTER_INIT, set_memory_ro);
  66
  67         return 0;
  68 }
  69
  70 int module_enable_data_nx(const struct module *mod)
  71 {
  72         if (!IS_ENABLED(CONFIG_STRICT_MODULE_RWX))
  73                 return 0;
  74
  75         for_class_mod_mem_type(type, data) {
  76                 int ret = module_set_memory(mod, type, set_memory_nx);
  77
  78                 if (ret)
  79                         return ret;
  80         }
  81         return 0;
  82 }
  83
  84 int module_enforce_rwx_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
  85                                 char *secstrings, struct module *mod)
  86 {
  87         const unsigned long shf_wx = SHF_WRITE | SHF_EXECINSTR;
  88         int i;
  89
  90         if (!IS_ENABLED(CONFIG_STRICT_MODULE_RWX))
  91                 return 0;
  92
  93         for (i = 0; i < hdr->e_shnum; i++) {
  94                 if ((sechdrs[i].sh_flags & shf_wx) == shf_wx) {
  95                         pr_err("%s: section %s (index %d) has invalid WRITE|EXEC flags\n",
  96                                mod->name, secstrings + sechdrs[i].sh_name, i);
  97                         return -ENOEXEC;
  98                 }
  99         }
 100
 101         return 0;
 102 }