linux-kernel - Re: [kernel-hardening] [PATCH] [RFC] Introduce mmap randomization

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1469563923.10218.13.camel@redhat.com>
Date:	Tue, 26 Jul 2016 16:12:03 -0400
From:	Rik van Riel <riel@...hat.com>
To:	kernel-hardening@...ts.openwall.com, jason@...edaemon.net,
	linux-mm@...r.kernel.org, linux-kernel@...r.kernel.org,
	akpm@...ux-foundation.org
Cc:	keescook@...omium.org, gregkh@...uxfoundation.org, nnk@...gle.com,
	jeffv@...gle.com, salyzyn@...roid.com, dcashman@...roid.com,
	William Roberts <william.c.roberts@...el.com>
Subject: Re: [kernel-hardening] [PATCH] [RFC] Introduce mmap randomization

On Tue, 2016-07-26 at 11:22 -0700, william.c.roberts@...el.com wrote:
> From: William Roberts <william.c.roberts@...el.com>
> 
> This patch introduces the ability randomize mmap locations where the
> address is not requested, for instance when ld is allocating pages
> for
> shared libraries. It chooses to randomize based on the current
> personality for ASLR.
> 
> Currently, allocations are done sequentially within unmapped address
> space gaps. This may happen top down or bottom up depending on
> scheme.
> 
> For instance these mmap calls produce contiguous mappings:
> int size = getpagesize();
> mmap(NULL, size, flags, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
> 0x40026000
> mmap(NULL, size, flags, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
> 0x40027000
> 
> Note no gap between.
> 
> After patches:
> int size = getpagesize();
> mmap(NULL, size, flags, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
> 0x400b4000
> mmap(NULL, size, flags, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
> 0x40055000
> 
> Note gap between.

I suspect this randomization will be more useful
for file mappings than for anonymous mappings.

I don't know whether there are downsides to creating
more anonymous VMAs than we have to, with malloc
libraries that may perform various kinds of tricks
with mmap for their own performance reasons.

Does anyone have convincing reasons why mmap
randomization should do both file and anon, or
whether it should do just file mappings?

-- 
All rights reversed

Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)