| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20081019025323.GA7887@ime.usp.br> Date: Sat, 18 Oct 2008 23:53:23 -0300 From: Rogério Brito <rbrito@....usp.br> To: Scott Wood <scottwood@...escale.com> Cc: Guennadi Liakhovetski <g.liakhovetski@....de>, linuxppc-dev@...abs.org, akpm@...ux-foundation.org, linux-kernel@...r.kernel.org, paulus@...ba.org, benh@...nel.crashing.org Subject: Re: [PATCH] powerpc: enable heap randomization for linkstations Hi. On Oct 13 2008, Scott Wood wrote: > On Mon, Oct 13, 2008 at 08:05:09PM +0200, Guennadi Liakhovetski wrote: > > On Mon, 13 Oct 2008, Rogério Brito wrote: > > > The current defconfig for Linkstation/Kuroboxes has the "Disable > > > Heap Randomization" option enabled. > > > > > > Since some of these machines are facing the internet, it helps to > > > have heap randomization enabled. This patch enables it. > > > > Same as the previous patch - this is one of options, that users > > select according to their needs. If any specific distribution > > enables this option by default in their kernels, they can do this > > too, don't think this is critical enough to patch the defconfig. I guess, Guennadi, that this is questionable. Many people would base their configs on the defconfig. Also, the defconfig has many questionable settings for an embedded platform like the Kurobox. And it seems that there is something not quite right for these embedded systems. Here is something that I get with a vanilla linkstation_defconfig: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - drivers/rtc/hctosys.c: unable to open rtc device (rtc0) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - This gets me (with bootlogd enabled): - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Wed Dec 31 21:00:15 1969: Cannot access the Hardware Clock via any known method. Wed Dec 31 21:00:15 1969: Use the --debug option to see the details of our search for an access method. Wed Dec 31 21:00:15 1969: Unable to set System Clock to: Thu Jan 1 00:00:15 UTC 1970 ^[[33m(warning).^[[39;49m - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - I just saw that in the default config: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - # CONFIG_PPC_CLOCK is not set - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Maybe this should be enabled? I can iterate once more to see if this option would make any difference here. > Just because users/distros can change it doesn't mean it's pointless > to discuss what default is sane, and make changes if the current > default isn't. 100% agreed again, Scott. To repeat myself here, I think that the defconfig should show the users the best current practices. > For security-related options it's usually best to default to the more > secure state, especially since the option description talks about it > being needed mainly for libc5 compatibility -- did libc5 ever even > exist for powerpc? > > The only reason it was turned on in the first place was likely the > "default y", which in turn is there to avoid breaking old x86 distros. I'm including both Paul and BenH here. Regards, Rogério Brito. -- Rogério Brito : rbrito@...ckenzie,ime.usp}.br : GPG key 1024D/7C2CAEB8 http://www.ime.usp.br/~rbrito : http://meusite.mackenzie.com.br/rbrito Projects: algorithms.berlios.de : lame.sf.net : vrms.alioth.debian.org -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists