* Arjan van de Ven <ar...@linux.intel.com> wrote:
> On 1/5/2017 9:54 AM, Thomas Garnier wrote:
>
> > That's my goal too. I started by doing a RO remap and got couple problems
> > with
> > hibernation. I can try again for the next iteration or delay it for another
> > patch. I also need to look at KVM GDT usage, I am not familiar with it yet.
>
> don't we write to the GDT as part of the TLS segment stuff for glibc ?
Yes - but the idea would be to have two virtual memory aliases:
1) A world-readable RO mapping of the GDT put into the fixmap area
(randomization
is not really required as the SGDT instruction exposes it anyway).
This read-only GDT mapping has two advantages:
- Because the GDT address is read-only it cannot be used by exploits as an
easy trampoline for 100% safe, deterministic rooting of the system from
a
local process.
- Even on older CPUs the SGDT instruction won't expose the absolute
address
of critical kernel data structures.
2) A kernel-only RW mapping in the linear kernel memory map where the original
page is - randomized (as a natural part of kernel physical and virtual
memory
randomization) and only known and accessible to the kernel, SGDT doesn't
expose it even on older CPUs.
This way we IMHO have the best of both worlds.
Assuming there are no strange CPU errata surfacing if we use a RO GDT - OTOH
that
should be fairly easy to test for, and worst-case we could quirk-off the
feature
on CPUs where this cannot be done safely.
Thanks,
Ingo
