linux-kernel - Re: [PATCH v2 11/20] randstruct: Disable randomization of ACPICA structs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170528045522.GB5045@infradead.org>
Date:   Sat, 27 May 2017 21:55:22 -0700
From:   Christoph Hellwig <hch@...radead.org>
To:     Kees Cook <keescook@...omium.org>
Cc:     Christoph Hellwig <hch@...radead.org>,
        "kernel-hardening@...ts.openwall.com" 
        <kernel-hardening@...ts.openwall.com>,
        Laura Abbott <labbott@...hat.com>,
        "x86@...nel.org" <x86@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Bob Moore <robert.moore@...el.com>,
        Lv Zheng <lv.zheng@...el.com>,
        "Rafael J. Wysocki" <rafael.j.wysocki@...el.com>
Subject: Re: [PATCH v2 11/20] randstruct: Disable randomization of ACPICA
 structs

On Sat, May 27, 2017 at 01:03:23PM -0700, Kees Cook wrote:
> On Sat, May 27, 2017 at 1:42 AM, Christoph Hellwig <hch@...radead.org> wrote:
> > On Fri, May 26, 2017 at 01:17:15PM -0700, Kees Cook wrote:
> >> Since the ACPICA source is maintained externally to the kernel, we can
> >> neither switch it to designated initializers nor mark it
> >> __no_randomize_layout. Until ACPICA-upstream changes[1] land to handle the
> >> designated initialization, explicitly skip it in the plugin.
> >>
> >> [1] https://github.com/acpica/acpica/pull/248
> >
> > I'd just overried the ACPIA bullshit process and just include these
> > changes, as they are a major improvement independent of any
> > reandomization.
> 
> Well... I'd rather not. It's been explicitly NAKed by them already,
> which is why I sent the upstream solution (though it's being ignored
> currently).

Send it to linux-keernel again and we'll override their bulllshit.
We can make exceptions from our coding style and preference just because
they are idiots.  And the whole ACPI mess needs urgent de-obsfucation
anyway.