linD026 cccc98ab2c Fix disallowed cr0 write protection and close_fd (#80) ... Since the commit 8dbec27a242cd3e2816eeb98d3237b9f57cf6232 [1] (kernel version v5.3+ [2]) the sensitive CR0 bits in x86 is pinned, we need to use the inline asm [3][4] to bypass it. commit 8dbec27a242cd3e2816eeb98d3237b9f57cf6232 : > With sensitive CR4 bits pinned now, it's possible that the WP bit for > CR0 might become a target as well. > > Following the same reasoning for the CR4 pinning, pin CR0's WP > bit. Contrary to the cpu feature dependend CR4 pinning this can be done > with a constant value. Also, getting "sys_call_table" [8] from the symbol lookup by using the address of "close_fd" does not work for v5.11+ [5][6]. The reason is the entry of "sys_call_table[__NR_close]" is not the address of "close_fd", actually it is "__x64_sys_close" in x86. Two solutions were proposed: using "kallsyms_lookup_name" [7] or just specifying the address into the module. The symbol "kallsyms_lookup_name" is unexported since v5.7; the address of "sys_call_table" can be found in "/boot/System.map" or "/proc/kallsyms". Since v5.7, the manual symbol lookup is not guaranteed to work because of control-flow integrity (or control-flow enforcement [9][10]) is added [11] for x86, but it is disabled since v5.11 [12][13]. To make sure manual symbol lookup work, it only uses up to v5.4. Reference: [1] 8dbec27a24 [2] https://outflux.net/blog/archives/2019/11/14/security-things-in-linux-v5-3/ [3] https://patchwork.kernel.org/project/linux-kbuild/patch/20200903203053.3411268-3-samitolvanen@google.com/ [4] https://stackoverflow.com/questions/58512430/how-to-write-to-protected-pages-in-the-linux-kernel [5] https://lore.kernel.org/bpf/20201120231441.29911-21-ebiederm@xmission.com/ [6] https://lore.kernel.org/bpf/87blj83ysq.fsf@x220.int.ebiederm.org/ [7] 0bd476e6c6 [8] 8f27766a88 [9] https://lore.kernel.org/lkml/20200204171425.28073-1-yu-cheng.yu@intel.com/ [10] https://lore.kernel.org/linux-doc/20201110162211.9207-1-yu-cheng.yu@intel.com/T/ [11] 5790921bc1 [12] 20bf2b3787 [13] https://lore.kernel.org/bpf/20210128123842.c9e33949e62f504b84bfadf5@gmail.com/		2021-08-31 11:07:01 +08:00
..
other	Fix: errno assignment should be comparison.	2021-08-24 11:16:25 -04:00
.clang-format	Enforce the customized style for example code	2021-07-22 06:58:13 +08:00
bottomhalf.c	Update several example code for newer kernel	2021-08-23 21:30:43 +08:00
chardev.c	Apply editorial changes	2021-08-08 01:24:59 +08:00
chardev.h	Apply editorial changes	2021-08-08 01:24:59 +08:00
chardev2.c	Fix incorrect major number registration in chardev (#77)	2021-08-26 03:16:17 +08:00
completions.c	Apply editorial changes	2021-08-08 01:24:59 +08:00
cryptosha256.c	Apply editorial changes	2021-08-08 01:24:59 +08:00
cryptosk.c	Update several example code for newer kernel	2021-08-23 21:30:43 +08:00
devicemodel.c	Apply editorial changes	2021-08-08 01:24:59 +08:00
example_atomic.c	Apply editorial changes	2021-08-08 01:24:59 +08:00
example_mutex.c	Apply editorial changes	2021-08-08 01:24:59 +08:00
example_rwlock.c	Apply editorial changes	2021-08-08 01:24:59 +08:00
example_spinlock.c	Apply editorial changes	2021-08-08 01:24:59 +08:00
example_tasklet.c	Update several example code for newer kernel	2021-08-23 21:30:43 +08:00
hello-1.c	Mention pr_info() rather than KERN_INFO	2021-08-16 21:53:22 +02:00
hello-2.c	Mention pr_info() rather than KERN_INFO	2021-08-16 21:53:22 +02:00
hello-3.c	Mention pr_info() rather than KERN_INFO	2021-08-16 21:53:22 +02:00
hello-4.c	Mention pr_info() rather than KERN_INFO	2021-08-16 21:53:22 +02:00
hello-5.c	Apply editorial changes	2021-08-08 01:24:59 +08:00
hello-sysfs.c	Apply editorial changes	2021-08-08 01:24:59 +08:00
intrpt.c	Apply editorial changes	2021-08-08 01:24:59 +08:00
ioctl.c	Apply editorial changes	2021-08-08 01:24:59 +08:00
kbleds.c	Update some file path to kernel v5.x+ in example/kbleds.c	2021-08-21 14:51:37 +08:00
Makefile	Emphasize on 5.x kernel	2021-07-22 08:31:47 +08:00
print_string.c	print_string: Validate tty before accessing its operations	2021-08-30 01:41:57 +08:00
procfs1.c	Apply editorial changes	2021-08-08 01:24:59 +08:00
procfs2.c	Apply editorial changes	2021-08-08 01:24:59 +08:00
procfs3.c	Apply editorial changes	2021-08-08 01:24:59 +08:00
procfs4.c	Fix alignment problem in code block (#45)	2021-08-08 01:29:50 +08:00
sched.c	Apply editorial changes	2021-08-08 01:24:59 +08:00
sleep.c	Fix init message	2021-08-10 00:48:19 +08:00
start.c	Apply editorial changes	2021-08-08 01:24:59 +08:00
stop.c	Apply editorial changes	2021-08-08 01:24:59 +08:00
syscall.c	Fix disallowed cr0 write protection and close_fd (#80)	2021-08-31 11:07:01 +08:00