Re: [gentoo-hardened] Kernel Oops at Boot with hardened-sources

On 19 Mar 2007 at 22:09, Charles Taylor wrote:

> What is the purpose of DEBUG_RODATA?? It sounded like
> a good idea when I read its description.

it's a good idea (after all, PaX has had it for 4 years now ;)
but it's useful for debugging only, not security (to catch write
attempts of read-only data, typically stuff that's declared as
'const' in C).

> I will not pretend to have anything more than an
> superficial understanding of the various protected
> mode descriptor tables, I'm just curious.

KERNEXEC in PaX implements the same feature as DEBUG_RODATA and
many others that actually improve security. one of these features
is to mark more data read-only than usual (i.e. stuff that would
remain writable even under DEBUG_RODATA). the GDT mentioned in
particular is an i386 specific data structure that controls at
the lowest level how virtual memory is segmented for both the
kernel and userland use. there are two other descriptor tables,
in particular the IDT (interrupt DT), that controls entry points
into the kernel, this is also read-only under PaX (the third one
is the Local DT/LDT and userland is allowed to manipulate it to
an extent).

in short, playing with these in a kernel exploit is of primary
importance (google for 'call gate' and 'exploit' to see it in
action).

-- 
gentoo-hardened@g.o mailing list