linux-kernel - Re: [PATCH] vfsprintf: only hash addresses in security environment

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200304151226.GE1224808@smile.fi.intel.com>
Date:   Wed, 4 Mar 2020 17:12:26 +0200
From:   Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
To:     Jason Yan <yanaijie@...wei.com>
Cc:     pmladek@...e.com, rostedt@...dmis.org,
        sergey.senozhatsky@...il.com, linux@...musvillemoes.dk,
        linux-kernel@...r.kernel.org, Scott Wood <oss@...error.net>,
        Kees Cook <keescook@...omium.org>,
        "Tobin C . Harding" <tobin@...nel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Daniel Axtens <dja@...ens.net>
Subject: Re: [PATCH] vfsprintf: only hash addresses in security environment

On Wed, Mar 04, 2020 at 08:47:07PM +0800, Jason Yan wrote:
> When I am implementing KASLR for powerpc, Scott Wood argued that format
> specifier "%p" always hashes the addresses that people do not have a
> choice to shut it down: https://patchwork.kernel.org/cover/11367547/
> 
> It's true that if in a debug environment or security is not concerned,
> such as KASLR is absent or kptr_restrict = 0,  there is no way to shut
> the hashing down except changing the code and build the kernel again
> to use a different format specifier like "%px". And when we want to
> turn to security environment, the format specifier has to be changed
> back and rebuild the kernel.
> 
> As KASLR is available on most popular platforms and enabled by default,
> print the raw value of address while KASLR is absent and kptr_restrict
> is zero. Those who concerns about security must have KASLR enabled or
> kptr_restrict set properly.

Even w/o KASLR the kernel address is sensitive material.
However, as a developer, I would like to have means to shut the hashing down.

Btw, when pass 'nokaslr' to the kernel it should turned off as well.

> +	/*
> +	 * In security environment, while kaslr is enabled or kptr_restrict is

kaslr -> KASLR

> +	 * not zero, hash before printing so that addresses will not be
> +	 * leaked. And if not in a security environment, print the raw value

Missed period at the end of sentence.

> +	 */
> +	if (IS_ENABLED(CONFIG_RANDOMIZE_BASE) || kptr_restrict)
> +		return ptr_to_id(buf, end, ptr, spec);
> +	else
> +		return pointer_string(buf, end, ptr, spec);
>  }

-- 
With Best Regards,
Andy Shevchenko