linux-kernel - Re: [PATCH prototype] [0/8] Predictive bitmaps for ELF executables

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1206335761.2438.63.camel@entropy>
Date:	Sun, 23 Mar 2008 22:16:01 -0700
From:	Nicholas Miell <nmiell@...cast.net>
To:	Ulrich Drepper <drepper@...il.com>
Cc:	Andi Kleen <andi@...stfloor.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel@...r.kernel.org, linux-mm@...ck.org
Subject: Re: [PATCH prototype] [0/8] Predictive bitmaps for ELF executables

On Sun, 2008-03-23 at 21:20 -0700, Ulrich Drepper wrote:
> On Sat, Mar 22, 2008 at 2:10 AM, Andi Kleen <andi@...stfloor.org> wrote:
> > > Why not stick the bitmap in an xattr?
> >
> >  xattrs are too small for potentially large binaries and a mess to manage
> >  (a lot of tools don't know about them)
> 
> It does not matter a bit whether any other tool know about the xattrs.
>  Binaries will not change after they are created to require changing
> the attributes.  And it is no problem to not back the data up etc.
> One really doesn't want to waste these resources.

Actually, yeah, the tools issue is a bit of a red herring now that you
mention it -- the only thing that's going to create and use these
bitmaps is the kernel, and if bitmap gets lost due to the use of ancient
tools, the kernel will just recreate the bitmap the next time the binary
runs.

> And as far as the size limitation is concerned.  It depends on the
> limit, which I don't know off hand.  But really, really big binaries
> don't have to be treated like this anyway.  They are not started
> frequently enough to justify this.

The limit is filesystem dependent -- I think ext2/3s is something like
4k total for attribute names and values per inode.

That's more than enough space for the largest executable on my system
(emacs at 36788160 bytes) which would have a 1123 byte predictive bitmap
(plus space for the name e.g. "system.predictive_bitmap"). The bitmap
also could be compressed.

-- 
Nicholas Miell <nmiell@...cast.net>

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/