linux-kernel - Re: [PATCH] KERNEL: resource: Fix bug on leakage in /proc/iomem file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGXu5j+gQT6pseNasW2qKSQ=wagcx06sfNqsmv5NSh8=MS4zAA@mail.gmail.com>
Date:	Wed, 6 Apr 2016 11:37:02 -0700
From:	Kees Cook <keescook@...omium.org>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	Emrah Demir <ed@...sec.com>,
	Dan Rosenberg <dan.j.rosenberg@...il.com>,
	Dave Jones <davej@...hat.com>,
	Kernel Hardening <kernel-hardening@...ts.openwall.com>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] KERNEL: resource: Fix bug on leakage in /proc/iomem file

On Wed, Apr 6, 2016 at 11:31 AM, Linus Torvalds
<torvalds@...ux-foundation.org> wrote:
> On Wed, Apr 6, 2016 at 11:05 AM,  <ed@...sec.com> wrote:
>>
>> Most distros don't use KASLR, but they use kptr_restrict. Without KASLR,
>> kptr_restirct most likely useless.
>
> Well, yes kaslr is effectively useless right now due to the fact that
> people still use hibernation in effectively every single distro out
> there.

At some point I'd like to see if distros would be interested in
inverting the default logic (maybe with a CONFIG to avoid changing the
current behavior) where instead of needing to put "kaslr" on the
command line to prefer kaslr over hibernation, end users would need to
add "nokaslr" to perfer hibernation for that boot. (Bike shed config
name: CONFIG_RANDOMIZE_BASE_ENABLED.)

-Kees

-- 
Kees Cook
Chrome OS & Brillo Security