TD0675: Make FPT_W^X_EXT.1 Optional
Publication Date
2022.11.28
Protection Profiles
PP_OS_V4.3
Other References
A.1
Issue Description
The GPOS agreed to make FPT_W^X_EXT.1 optional for 4.3; however this was overlooked. Resolution
Protection Profile for General Purpose Operating Systems v4.3 is updated as follows:
Section 5.1.4 is amended as follows: FPT_W^X_EXT.1 Write XOR Execute Memory PagesThe OS shall prevent allocation of any memory region with both write and execute permissions except for [assignment: list of exceptions].
Application Note: Requesting a memory mapping with both write and execute permissions subverts the platform protection provided by DEP. If the OS provides no exceptions (such as for just-in-time compilation), then "no exceptions" should be indicated in the assignment. Full realization of this requirement requires hardware support, but this is commonly available.
The evaluator will inspect the vendor-provided developer documentation and verify that no memory-mapping can be made with write and execute permissions except for the cases listed in the assignment.
Tests
The evaluator will also perform the following tests.
To Table.2 in 5.1.8:
And To A.1 A.1.2 Protection of the TSF (FPT)FPT_W^X_EXT.1 Write XOR Execute Memory PagesThe OS shall prevent allocation of any memory region with both write and execute permissions except for [assignment: list of exceptions].
Application Note: Requesting a memory mapping with both write and execute permissions subverts the platform protection provided by DEP. If the OS provides no exceptions (such as for just-in-time compilation), then "no exceptions" should be indicated in the assignment. Full realization of this requirement requires hardware support, but this is commonly available.
The evaluator will inspect the vendor-provided developer documentation and verify that no memory-mapping can be made with write and execute permissions except for the cases listed in the assignment.
Tests
The evaluator will also perform the following tests.
Justification
See Description. |