linux-kernel - Re: [RFC PATCH v2 0/2] Randomization of address chosen by mmap.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <7e41ef7a-0bac-02fe-21fd-a1ed86c22230@landley.net>
Date:   Tue, 27 Mar 2018 23:50:02 -0500
From:   Rob Landley <rob@...dley.net>
To:     Matthew Wilcox <willy@...radead.org>, Rich Felker <dalias@...c.org>
Cc:     Ilya Smith <blackzert@...il.com>, rth@...ddle.net,
        ink@...assic.park.msu.ru, mattst88@...il.com, vgupta@...opsys.com,
        linux@...linux.org.uk, tony.luck@...el.com, fenghua.yu@...el.com,
        jhogan@...nel.org, ralf@...ux-mips.org, jejb@...isc-linux.org,
        deller@....de, benh@...nel.crashing.org, paulus@...ba.org,
        mpe@...erman.id.au, schwidefsky@...ibm.com,
        heiko.carstens@...ibm.com, ysato@...rs.sourceforge.jp,
        davem@...emloft.net, tglx@...utronix.de, mingo@...hat.com,
        hpa@...or.com, x86@...nel.org, nyc@...omorphy.com,
        viro@...iv.linux.org.uk, arnd@...db.de, gregkh@...uxfoundation.org,
        deepa.kernel@...il.com, mhocko@...e.com, hughd@...gle.com,
        kstewart@...uxfoundation.org, pombredanne@...b.com,
        akpm@...ux-foundation.org, steve.capper@....com,
        punit.agrawal@....com, paul.burton@...s.com,
        aneesh.kumar@...ux.vnet.ibm.com, npiggin@...il.com,
        keescook@...omium.org, bhsharma@...hat.com, riel@...hat.com,
        nitin.m.gupta@...cle.com, kirill.shutemov@...ux.intel.com,
        dan.j.williams@...el.com, jack@...e.cz,
        ross.zwisler@...ux.intel.com, jglisse@...hat.com,
        aarcange@...hat.com, oleg@...hat.com, linux-alpha@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-snps-arc@...ts.infradead.org,
        linux-arm-kernel@...ts.infradead.org, linux-ia64@...r.kernel.org,
        linux-metag@...r.kernel.org, linux-mips@...ux-mips.org,
        linux-parisc@...r.kernel.org, linuxppc-dev@...ts.ozlabs.org,
        linux-s390@...r.kernel.org, linux-sh@...r.kernel.org,
        sparclinux@...r.kernel.org, linux-mm@...ck.org
Subject: Re: [RFC PATCH v2 0/2] Randomization of address chosen by mmap.

On 03/23/2018 02:06 PM, Matthew Wilcox wrote:
> On Fri, Mar 23, 2018 at 02:00:24PM -0400, Rich Felker wrote:
>> On Fri, Mar 23, 2018 at 05:48:06AM -0700, Matthew Wilcox wrote:
>>> On Thu, Mar 22, 2018 at 07:36:36PM +0300, Ilya Smith wrote:
>>>> Current implementation doesn't randomize address returned by mmap.
>>>> All the entropy ends with choosing mmap_base_addr at the process
>>>> creation. After that mmap build very predictable layout of address
>>>> space. It allows to bypass ASLR in many cases. This patch make
>>>> randomization of address on any mmap call.
>>>
>>> Why should this be done in the kernel rather than libc?  libc is perfectly
>>> capable of specifying random numbers in the first argument of mmap.
>>
>> Generally libc does not have a view of the current vm maps, and thus
>> in passing "random numbers", they would have to be uniform across the
>> whole vm space and thus non-uniform once the kernel rounds up to avoid
>> existing mappings.
> 
> I'm aware that you're the musl author, but glibc somehow manages to
> provide etext, edata and end, demonstrating that it does know where at
> least some of the memory map lies.

You can parse /proc/self/maps, but it's really expensive and disgusting.

Rob