linux-kernel - Re: [PATCHv2 5/7] printk: allow kmsg to be encrypted using public key encryption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 14 Jan 2018 10:01:08 +0200
From:   Dan Aloni <dan@...nelim.com>
To:     Sergey Senozhatsky <sergey.senozhatsky@...il.com>
Cc:     linux-kernel@...r.kernel.org, kernel-hardening@...ts.openwall.com,
        Petr Mladek <pmladek@...e.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        Kees Cook <keescook@...omium.org>
Subject: Re: [PATCHv2 5/7] printk: allow kmsg to be encrypted using public
 key encryption

On Sun, Jan 14, 2018 at 10:48:01AM +0900, Sergey Senozhatsky wrote:
> Ccing Kees, Peter, Andrew, Steven
> 
> On (01/13/18 23:34), Dan Aloni wrote:
> > This commit enables the kernel to encrypt the free-form text that
> > is generated by printk() before it is brought up to `dmesg` in
> > userspace.
> > 
> > The encryption is made using one of the trusted public keys which
> > are kept built-in inside the kernel. These keys are presently
> > also used for verifying kernel modules and userspace-supplied
> > firmwares.
> 
> OK, this is the first time I'm receiving it, yet it's v2 already.
> I'm Cc-ed on only this particular patch, not the entire patch set;
> so it's hard to tell what else is being touched and why, so I'm
> going to start with the basic questions.

Sorry, here the link to cover letter:

    https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1585442.html

I guess --cc-cover && --to-cover should be default.

> are you fixing the real problem? that's because you see unhashed
> kernel pointers in dmesg or is there anything else?

In brief, the problem is that any information leak has the potential
to make exploitation easier. The changes include documentation for
the feature, where more details are provided.

-- 
Dan Aloni