lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 7 Mar 2020 17:28:22 +0100 From: Jiri Slaby <jslaby@...e.com> To: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>, Andrew Morton <akpm@...ux-foundation.org> Cc: Matthew Garrett <mjg59@...gle.com>, Andi Kleen <ak@...ux.intel.com>, "Theodore Y . Ts'o" <tytso@....edu>, Greg Kroah-Hartman <gregkh@...uxfoundation.org>, Alexander Viro <viro@...iv.linux.org.uk>, Petr Mladek <pmladek@...e.com>, Sergey Senozhatsky <sergey.senozhatsky@...il.com>, Arnd Bergmann <arnd@...db.de>, Steven Rostedt <rostedt@...dmis.org>, Linus Torvalds <torvalds@...ux-foundation.org>, LKML <linux-kernel@...r.kernel.org>, Dmitry Vyukov <dvyukov@...gle.com> Subject: Re: [PATCH v2] Add kernel config option for fuzz testing. On 07. 03. 20, 14:58, Tetsuo Handa wrote: > While syzkaller is finding many bugs, sometimes syzkaller examines > stupid operations. Currently we prevent syzkaller from examining > stupid operations by blacklisting syscall arguments and/or disabling > whole functionality using existing kernel config options, but it is > a whack-a-mole approach. We need cooperation from kernel side [1]. > > This patch introduces a kernel config option which allows disabling > only specific operations. This kernel config option should be enabled > only when building kernels for fuzz testing. > > We discussed possibility of disabling specific operations at run-time > using some lockdown mechanism [2], but conclusion seems that build-time > control (i.e. kernel config option) fits better for this purpose. > Since patches for users of this kernel config option will want a lot of > explanation [3], this patch provides only kernel config option for them. > > [1] https://github.com/google/syzkaller/issues/1622 > [2] https://lkml.kernel.org/r/CACdnJutc7OQeoor6WLTh8as10da_CN=crs79v3Fp0mJTaO=+yw@mail.gmail.com > [3] https://lkml.kernel.org/r/20191216163155.GB2258618@kroah.com > > Signed-off-by: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp> > Cc: Dmitry Vyukov <dvyukov@...gle.com> > --- > lib/Kconfig.debug | 10 ++++++++++ > 1 file changed, 10 insertions(+) > > Changes since v1: > Drop users of this kernel config option. > Update patch description. > > diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug > index 53e786e0a604..e360090e24c5 100644 > --- a/lib/Kconfig.debug > +++ b/lib/Kconfig.debug > @@ -2208,4 +2208,14 @@ config HYPERV_TESTING > > endmenu # "Kernel Testing and Coverage" > > +config KERNEL_BUILT_FOR_FUZZ_TESTING > + bool "Build kernel for fuzz testing" If we really want to go this way, I wouldn't limit it for fuzz testing only. Static analyzers, symbolic executors, formal verifiers, etc. -- all of them should avoid the paths. So what about KERNEL_BUILT_FOR_ANALYZERS? > + default n > + help > + Say N unless you are building kernels for fuzz testing. > + Saying Y here disables several things that legitimately cause > + damage under a fuzzer workload (e.g. copying to arbitrary > + user-specified kernel address, changing console loglevel, > + freezing filesystems). > + > endmenu # Kernel hacking > -- js suse labs
Powered by blists - more mailing lists