linux-kernel - Re: [RFC PATCH 0/3] Salted build ids via linker sections

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAK7LNAQTf_tVvks==_wGsEeNs6Bpdcfy9k39fpzneFvVZGAOiA@mail.gmail.com>
Date:   Mon, 26 Mar 2018 16:48:11 +0900
From:   Masahiro Yamada <yamada.masahiro@...ionext.com>
To:     Laura Abbott <labbott@...hat.com>
Cc:     Andy Lutomirski <luto@...nel.org>, mjw@...oraproject.org,
        "H . J . Lu" <hjl.tools@...il.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        X86 ML <x86@...nel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Nick Clifton <nickc@...hat.com>,
        Cary Coutant <ccoutant@...il.com>
Subject: Re: [RFC PATCH 0/3] Salted build ids via linker sections

2018-03-21 10:46 GMT+09:00 Laura Abbott <labbott@...hat.com>:
> Hi,
>
> This is a proposal that's come out of several discussion for Fedora but
> may be of interest to other distributions.
>
> In Fedora, the debug information is packaged separately (foo-debuginfo) and
> can be installed separately. There's been a long standing issue where only one
> version of a debuginfo info package can be installed at a time. Mark Wielaard
> made an effort for Fedora 27 to allow parallel installation of debuginfo (see
> https://fedoraproject.org/wiki/Changes/ParallelInstallableDebuginfo for
> more details)

Is this a kernel-specific problem?

IIUC, the URL above is discussing packages in general.

Any executable from slightly different versions
could result in identical ELF.
If so, will you tweak link process of every package
that needs parallel installation?




> Part of the requirement to allow this to work is that build ids are
> unique between builds. The existing upstream rpm implementation ensures
> this by re-calculating the build-id using the version and release as a
> seed. This doesn't work 100% for the kernel because of the vDSO which is
> its own binary and doesn't get updated. After poking holes in a few of my
> ideas, there was a discussion with some people from the binutils team about
> adding --build-id-salt to let ld do the calculation debugedit is doing. There
> was a counter proposal made about adding some extra information via a .comment
> which will affect the build id calculation but just get stripped out.
>
> This is an implementation of the counter proposal. If an environment variable
> is set, that value gets added as a .comment section to the necessary binaries.
> This is RFC mostly to see if this approach is plausible enough to be merged or
> if it's worth trying to update binutils with the --build-id-salt option.
> I don't care about any names, I was pretty inconsistent. If people are
> roughly satisifed with this I'll probably just change all the names to
> build-salt or whatever gets bike shedded.
>
> Thanks,
> Laura
>
> Laura Abbott (3):
>   kbuild: Introduce build-salt generated header
>   kbuild: Link with generated build-salt header
>   x86/vdso: Add build salt to the vDSO
>
>  Makefile                              | 13 +++++++++++--
>  arch/x86/entry/vdso/vdso-layout.lds.S |  3 +++
>  scripts/.gitignore                    |  1 +
>  scripts/Makefile                      |  2 +-
>  scripts/build-id.lds.S                |  5 +++++
>  scripts/gencomment                    | 19 +++++++++++++++++++
>  scripts/link-vmlinux.sh               |  3 ++-
>  7 files changed, 42 insertions(+), 4 deletions(-)
>  create mode 100644 scripts/build-id.lds.S
>  create mode 100755 scripts/gencomment
>
> --
> 2.16.2
>



-- 
Best Regards
Masahiro Yamada