linux-kernel - Re: [RFC PATCH 0/3] Salted build ids via linker sections

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20180326095855.GA9061@wildebeest.org>
Date:   Mon, 26 Mar 2018 11:58:55 +0200
From:   Mark Wielaard <mjw@...oraproject.org>
To:     Masahiro Yamada <yamada.masahiro@...ionext.com>
Cc:     Laura Abbott <labbott@...hat.com>,
        Andy Lutomirski <luto@...nel.org>,
        "H . J . Lu" <hjl.tools@...il.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        X86 ML <x86@...nel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Nick Clifton <nickc@...hat.com>,
        Cary Coutant <ccoutant@...il.com>
Subject: Re: [RFC PATCH 0/3] Salted build ids via linker sections

Hi,

On Mon, Mar 26, 2018 at 04:48:11PM +0900, Masahiro Yamada wrote:
> 2018-03-21 10:46 GMT+09:00 Laura Abbott <labbott@...hat.com>:
> > In Fedora, the debug information is packaged separately (foo-debuginfo) and
> > can be installed separately. There's been a long standing issue where only one
> > version of a debuginfo info package can be installed at a time. Mark Wielaard
> > made an effort for Fedora 27 to allow parallel installation of debuginfo (see
> > https://fedoraproject.org/wiki/Changes/ParallelInstallableDebuginfo for
> > more details)
> 
> Is this a kernel-specific problem?
> 
> IIUC, the URL above is discussing packages in general.
> 
> Any executable from slightly different versions
> could result in identical ELF.
> If so, will you tweak link process of every package
> that needs parallel installation?

For almost any package it isn't necessary to tweak the link process
because the build-id can be tweaked if necessary at any stage of the
package process (the most convenient is during debuginfo splitting,
because the debuginfo contains almost all the information of the
build environment). The kernel vdso build is a bit special because it
embeds the executable also inside the kernel image (so it shows up at
runtime again not from the file system, but by being inserted into the
process by the kernel), where packaging tools cannot easily find it.

Cheers,

Mark