linux-kernel - Re: [PATCH 0/5] add printk specifier %px, unique identifier

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20171128014343.GR17858@eros>
Date:   Tue, 28 Nov 2017 12:43:43 +1100
From:   "Tobin C. Harding" <me@...in.cc>
To:     Kees Cook <keescook@...omium.org>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        "Jason A. Donenfeld" <Jason@...c4.com>,
        Theodore Ts'o <tytso@....edu>,
        Paolo Bonzini <pbonzini@...hat.com>,
        Tycho Andersen <tycho@...ho.ws>,
        "Roberts, William C" <william.c.roberts@...el.com>,
        Tejun Heo <tj@...nel.org>,
        Jordan Glover <Golden_Miller83@...tonmail.ch>,
        Greg KH <gregkh@...uxfoundation.org>,
        Petr Mladek <pmladek@...e.com>, Joe Perches <joe@...ches.com>,
        Ian Campbell <ijc@...lion.org.uk>,
        Sergey Senozhatsky <sergey.senozhatsky@...il.com>,
        Catalin Marinas <catalin.marinas@....com>,
        Will Deacon <wilal.deacon@....com>,
        Steven Rostedt <rostedt@...dmis.org>,
        Chris Fries <cfries@...gle.com>,
        Dave Weinstein <olorin@...gle.com>,
        Daniel Micay <danielmicay@...il.com>,
        Djalal Harouni <tixxdz@...il.com>,
        Radim Krčmář <rkrcmar@...hat.com>,
        LKML <linux-kernel@...r.kernel.org>, KVM <kvm@...r.kernel.org>,
        kernel-hardening@...ts.openwall.com
Subject: Re: [PATCH 0/5] add printk specifier %px, unique identifier

On Mon, Nov 27, 2017 at 04:57:18PM -0800, Kees Cook wrote:
> On Mon, Nov 27, 2017 at 3:40 PM, Tobin C. Harding <me@...in.cc> wrote:
> > Linus,
> >
> > I know you are bored of this patch set already and this pits your vast
> > experience against my eight months kernel dev experience ;)
> >
> > I humbly maintain that hashing %p and suggesting people use %x
> > _correctly_ isn't a WIN solution.
> >
> > Please don't go easy on me because I'm new, if I'm out of line - say
> > so.
> >
> > This set is based on the following assumptions.
> >
> > 1. We now have leaking_addresses.pl illuminating leaking addresses.
> > 2. We have no _clear_ strategy for fixing leaks once found.
> > 3. We do not have a proposed non opt-in solution.
> > 4. There is a distinct use case for this specifier.
> >
> > Patch 1: Corrects the docs for %pK.
> >
> > Patch 2: Refactors %pK code out of pointer() into helper function.
> >
> > Patch 3: Adds specifier %px, small 'x' was chosen because the hashed hex
> >          value is printed in lower case.
> >
> > Patch 4/5: Provides example usage of new specifier.
> >
> > The hashing code is based on the work done hashing %p during 4.14 dev
> > cycle.
> >
> > Finally, with this patch set in place, we have the added benefit that
> > newbies (me) can quietly go around the kernel 'sweeping up' after
> > leaking addresses. This as apposed to using a hammer and hashing all
> > %p. And if this is deemed too little and too slow we can always search
> > and replace '%p' with '%px'.
> 
> How does this opt-in to %px help? We'll still have %p everywhere. :(
> Why not invert this? %p is hashed and %px is the old %p? Then we can
> move %x users to %px.

This is a really nice twist, I don't know why it hasn't come up
before. For the record it

- Plugs a bunch of potential current leaks.
- Is on by default (*not* opt-in).
- Is easy to use (%p if you don't care, %px if you _really_ want the address).
- Reduces risk of future developers creating grep hell by using %x

(- makes Linus happy because it does everything he has suggested except
promote use of %x)

> I'd still like to see a default-on solution for this class of leaks...

I'll re-spin this tomorrow and see if we can't stop bothering everyone
with it :)

thanks,
Tobin.