linux-kernel - [PATCHv4 0/3] Salted build ids via linker sections

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20180612003224.3658-1-labbott@redhat.com>
Date:   Mon, 11 Jun 2018 17:32:21 -0700
From:   Laura Abbott <labbott@...hat.com>
To:     Andy Lutomirski <luto@...nel.org>, mjw@...oraproject.org,
        "H . J . Lu" <hjl.tools@...il.com>,
        Masahiro Yamada <yamada.masahiro@...ionext.com>
Cc:     Laura Abbott <labbott@...hat.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        X86 ML <x86@...nel.org>, linux-kernel@...r.kernel.org,
        Nick Clifton <nickc@...hat.com>,
        Cary Coutant <ccoutant@...il.com>, linux-kbuild@...r.kernel.org
Subject: [PATCHv4 0/3] Salted build ids via linker sections

Hi,

This is v4 of the series to allow unique build ids in the kernel. As a
reminder of the context:

""
In Fedora, the debug information is packaged separately (foo-debuginfo) and
can be installed separately. There's been a long standing issue where only one
version of a debuginfo info package can be installed at a time. Mark Wielaard
made an effort for Fedora 27 to allow parallel installation of debuginfo (see
https://fedoraproject.org/wiki/Changes/ParallelInstallableDebuginfo for
more details)

Part of the requirement to allow this to work is that build ids are
unique between builds. The existing upstream rpm implementation ensures
this by re-calculating the build-id using the version and release as a
seed. This doesn't work 100% for the kernel because of the vDSO which is
its own binary and doesn't get updated. After poking holes in a few of my
ideas, there was a discussion with some people from the binutils team about
adding --build-id-salt to let ld do the calculation debugedit is doing. There
was a counter proposal made to add in the salt while building. The
easiest proposal was to add an item in the linker script vs. linking in
an object since we need the salt to go in every module as well as the
kernel and vmlinux.
""

v4 takes Linus' suggestion of using linker fill to insert the build id.
This removes the need to use a generated header which makes things much
easier. One change is that because this section isn't .comment it won't
get stripped automatically. This is pretty small but I also know people
can be picky so I'm open to opinions or suggestions here.

Laura Abbott (3):
  scripts: Preprocess module-common.lds
  kbuild: Introduce build-salt linker section and config option
  x86: Add build salt to the vDSO and kernel linker scripts

 arch/x86/entry/vdso/vdso-layout.lds.S              | 3 ++-
 arch/x86/kernel/vmlinux.lds.S                      | 1 +
 include/asm-generic/vmlinux.lds.h                  | 6 ++++++
 init/Kconfig                                       | 9 +++++++++
 scripts/.gitignore                                 | 1 +
 scripts/Makefile                                   | 2 +-
 scripts/{module-common.lds => module-common.lds.S} | 4 ++++
 7 files changed, 24 insertions(+), 2 deletions(-)
 rename scripts/{module-common.lds => module-common.lds.S} (94%)

-- 
2.18.0.rc1