linux-kernel - Re: [RFCv2 PATCH 0/3] Salted build ids via linker sections

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 14 May 2018 13:51:52 -0700
From:   Laura Abbott <labbott@...hat.com>
To:     Andy Lutomirski <luto@...nel.org>,
        Masahiro Yamada <yamada.masahiro@...ionext.com>
Cc:     Mark Wielaard <mjw@...oraproject.org>,
        "H. J. Lu" <hjl.tools@...il.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        X86 ML <x86@...nel.org>, LKML <linux-kernel@...r.kernel.org>,
        Nick Clifton <nickc@...hat.com>,
        Cary Coutant <ccoutant@...il.com>, linux-kbuild@...r.kernel.org
Subject: Re: [RFCv2 PATCH 0/3] Salted build ids via linker sections

On 05/07/2018 07:49 PM, Andy Lutomirski wrote:
> On Sun, May 6, 2018 at 11:59 PM Masahiro Yamada <
> yamada.masahiro@...ionext.com> wrote:
> 
>> 2018-03-30 21:40 GMT+09:00 Mark Wielaard <mjw@...oraproject.org>:
>>> On Thu, 2018-03-29 at 11:01 -0700, Laura Abbott wrote:
>>>> I'm still mostly looking for feedback whether
>>>> this would be acceptable for merging or if we should just persue a
>>>> --build-id-salt in binutils.
>>>
>>> Personally I would go with this approach. It seems simple and it might
>>> take years before a new linker option is available everywhere.
> 
> 
>> Indeed.  This series is easier than --build-id-salt.
> 
>> If you do not see any better solution, I can accept this.
> 
> 
>> BTW, when I read
>> https://fedoraproject.org/wiki/Changes/ParallelInstallableDebuginfo
>> I thought "we could reverse the symlink direction from debug file to
>> build-id file)"
>> sensible (but I understand it is not easy to change this way).
> 
> 
>> If two packages share an identical image,
>> one package can borrow the image from the other,
>> then the storage space will be saved.
> 
>> So, having identical ID should be advantage,
>> but we actually see only disadvantage...
> 
> 
> 
> 
>>> To simplify things I think you could just always add the extra vdso
>>> .comment initialized to something like KERNELRELEASE. Which distros
>>> seem to update anyway to include their build number, so they wouldn't
>>> need to do anything special to "update the build salt".
>>>
> 
> That's what I was thinking, too.  Would that solve Fedora's problem?
> 

Yes, that seems reasonable.