Re: [PATCH] fs/proc/kcore.c: Omit kernel text area for hardened usercopy feature

[Linus Torvalds]

On Tue, Sep 6, 2016 at 12:41 PM, Andi Kleen <andi@xxxxxxxxxxxxxx> wrote:
>
> I suspect it's more than just /proc/kcore, there could be also
> legitimate cases to read kernel text from /dev/mem or /dev/kmem

Yes, that's probably true. Although I suspect that we should just say
that user-copy hardening is incompatible with /dev/kmem and
!STRICT_DEVMEM.

At least Fedora seems to have

  CONFIG_DEVMEM=y
  # CONFIG_DEVKMEM is not set
  CONFIG_STRICT_DEVMEM=y

which should mean that you already should not be able to access normal
RAM using /dev/[k]mem - ie it's purely for legacy X server kind of
situations.

So we could just make  HARDENED_USERCOPY force those settings. It's
not like you should ever have anything else in any situation where you
care about security *anyway*, so...

                 Linus