Re: [kernel-hardening] [PATCH 1/1] Sealable memory support
On 20/05/17 11:51, Greg KH wrote: > On Fri, May 19, 2017 at 01:38:11PM +0300, Igor Stoppa wrote: >> Dynamically allocated variables can be made read only, [...] > This is really nice, do you have a follow-on patch showing how any of > the kernel can be changed to use this new subsystem? Yes, actually I started from the need of turning into R/O some data structures in both LSM Hooks and SE Linux. > Without that, it > might be hard to get this approved (we don't like adding new apis > without users.) Yes, I just wanted to give an early preview of the current implementation, since it is significantly different from what I initially proposed. So I was looking for early feedback. Right now, I'm fixing it up and adding some more structured debugging. Then I'll re-submit it together with the LSM Hooks example. --- thanks, igor
Re: [kernel-hardening] [PATCH 1/1] Sealable memory support
On Fri, May 19, 2017 at 01:38:11PM +0300, Igor Stoppa wrote: > Dynamically allocated variables can be made read only, > after they have been initialized, provided that they reside in memory > pages devoid of any RW data. > > The implementation supplies means to create independent pools of memory, > which can be individually created, sealed/unsealed and destroyed. > > A global pool is made available for those kernel modules that do not > need to manage an independent pool. > > Signed-off-by: Igor Stoppa > --- > mm/Makefile | 2 +- > mm/smalloc.c | 200 > +++ > mm/smalloc.h | 61 ++ > 3 files changed, 262 insertions(+), 1 deletion(-) > create mode 100644 mm/smalloc.c > create mode 100644 mm/smalloc.h This is really nice, do you have a follow-on patch showing how any of the kernel can be changed to use this new subsystem? Without that, it might be hard to get this approved (we don't like adding new apis without users.) thanks, greg k-h
