linux-kernel - Re: [PATCH] kbuild: Provide way to actually disable stack protector

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <202006261314.B6856AA96@keescook>
Date:   Fri, 26 Jun 2020 13:18:46 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Masahiro Yamada <masahiroy@...nel.org>
Cc:     Peter Zijlstra <peterz@...radead.org>,
        Thomas Gleixner <tglx@...utronix.de>, X86 ML <x86@...nel.org>,
        Linux Kbuild mailing list <linux-kbuild@...r.kernel.org>,
        linux-arm-kernel <linux-arm-kernel@...ts.infradead.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] kbuild: Provide way to actually disable stack protector

On Sat, Jun 27, 2020 at 04:04:33AM +0900, Masahiro Yamada wrote:
> On Tue, Jun 23, 2020 at 2:37 PM Kees Cook <keescook@...omium.org> wrote:
> >
> > On Tue, Jun 23, 2020 at 11:33:53AM +0900, Masahiro Yamada wrote:
> > > Is it OK to not patch syscall_x32.c ?
> >
> > Good question. Peter? (It seems all the syscall_*.c files are just a
> > table, not code -- why do they need any instrumentation changes?)

I'd still like to know the answer to this one...

> Is it useful when we know
> DISABLE_STACKPROTECTOR = -fno-stack-protector  ?

I'm fine with that. My point was the using _REMOVE isn't going to work
for some compiler builds.

> I'd rather want to apply this patch
> https://patchwork.kernel.org/patch/11628493/
> and hard-code -fno-stack-protector where necessary.

That's fine. I will send a separate fix for arch/x86/entry/Makefile.

> cc-flags-y comes after KBUILD_CFLAGS
> so that -fno-stack-protector can negate -fstack-protector(-strong)

Okay, good.

-- 
Kees Cook