[ubuntu-hardened] 16.04 LTS: W^X detection - lack of a config options; X86_PTDUMP_CORE and DEBUG_WX

[daniel curtis]

Hello

A couple of weeks ago, about a month ago, I've found an information, that
W^X detection has been merged in Linux v4.4. As we can see in a commit
messages [1, 2], there are two config options; "X86_PTDUMP_CORE" and
"DEBUG_WX" (which depends on "DEBUG_RODATA".) In case of 16.04 LTS Release,
both options are not set, but DEBUG_RODATA associated with this
implementation is set and has "y" (see below).

[~]$ cat /boot/config-4.4.0-79-generic |grep X86_PTDUMP_CORE
# CONFIG_X86_PTDUMP_CORE is not set
[~]$ cat /boot/config-4.4.0-79-generic |grep DEBUG_WX
# CONFIG_DEBUG_WX is not set

Because in 16.04 LTS Release, Linux kernel v4.4 is used, I would like to
ask, why these options are marked as "not set"? Is there any reason? Maybe,
the reason is that Ubuntu Developers made such decision? Or maybe an
information, which I found is incorrect?

Generally, there should be such entry in a log files: "x86/mm: Checked W+X
mappings: passed, no W+X pages found." However, I found an interesting
thread with message about kernel 4.4.0 and "x86/mm: Found insecure W+X
mapping at address ..." on one of the mailing list [3]. Such message
appears on a failure when it prints a warning and a count of the failed
pages etc.

As we can see above, user is using a Linux kernel v4.4 with Xen 4.6 so he
must have "X86_PTDUMP_CORE" and "DEBUG_WX" options set to "y", right? Here
is another one "example": Arch Linux user, kernel 4.4 and the same message
as before - ""x86/mm: Found insecure W+X mapping..." [4]

So, is there any reason why these options are not included by default in
Ubuntu 16.04 LTS, which was released with a Linux kernel v4.4? (That's the
version where W^X detection has been added.)

Thanks, best regards.
____________________
[1, 2] commit: e1a58320a38dfa72be48a0f1a3a92273663ba6db
[3] https://www.spinics.net/lists/linux-mm/msg100542.html
[4] https://bugs.archlinux.org/task/47849
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/ubuntu-hardened/attachments/20170611/a47ae4b2/attachment.html>