full-disclosure - "Advances in Security" in the Linux Kernel and RedHat idiocy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20050127172811.GD26997@devserv.devel.redhat.com>
From: arjanv at redhat.com (Arjan van de Ven)
Subject: "Advances in Security" in the Linux Kernel and
	RedHat idiocy

On Thu, Jan 27, 2005 at 11:10:43AM -0500, Brad Spengler wrote:
> Just wanted to point out to you guys the INCREDIBLE advances in Linux 
> security underway on LKML from security expert Arjan van de Ven:
> 
> http://lkml.org/lkml/2005/1/27/62
> 
> On the subject of his i386-only mmap randomization patch:
> 
> The randomisation range is 1 megabyte (this is bigger than the stack
> randomisation since the stack randomisation only needs 16 bytes alignment
> while the mmap needs page alignment, a 64kb range would not have given
> enough entropy to be effective)
> 
> If we do a little math..
> 1048576 / 4096 = 256
> 65536 / 16 = 4096
> 
> 256 different locations for the mmap base, 4096 different locations for 
> the stack (and apparently argv/envp pages get no randomization)
> 
> Anyone with half a brain would see this is a joke, but not security 
> expert Arjan van de Ven:

I think the joke is on you in this case. There is a large patch series of
which you judge the first steps only. Those steps introduce the
infrastructure and concepts into the kernel, and later patches will tweak
the exact numbers to values with more entropy. ONCE THEY EXISTING
INFRASTRUCTURE IS ACCEPTED AND DEBUGGED.

Maybe you don't understand that, I assume a lot of the other readers of this
list do. You don't plop a huge patch in the linux kernel in one chunk. You
do it in nice small, incremental and debuggable steps.