linux-kernel - Re: [PATCH v1 1/1] Kernel Config to make randomize_va

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <YDeMsX6sScUk9D+F@kroah.com>
Date:   Thu, 25 Feb 2021 12:40:33 +0100
From:   Greg KH <greg@...ah.com>
To:     "Lan Zheng (lanzheng)" <lanzheng@...co.com>
Cc:     Kees Cook <keescook@...omium.org>,
        "kernel-hardening@...ts.openwall.com" 
        <kernel-hardening@...ts.openwall.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v1 1/1] Kernel Config to make randomize_va_space
 read-only.

On Thu, Feb 25, 2021 at 04:42:28AM +0000, Lan Zheng (lanzheng) wrote:
> From ba2ec52f170a8e69d6c44238bb578f9518a7e3b7 Mon Sep 17 00:00:00 2001
> From: lanzheng <lanzheng@...co.com>
> Date: Tue, 23 Feb 2021 22:49:34 -0500

Why is this here?

> Subject: [PATCH] This patch adds a kernel build config knob that disallows
>  changes to the sysctl variable randomize_va_space.It makes harder for
>  attacker to disable ASLR and reduces security risks.

I think you need to read the documentation for how to write a good
changelog text.

>  
> Signed-off-by: lanzheng <lanzheng@...co.com>
> Reviewed-by: Yongkui Han <yonhan@...co.com>
> Tested-by: Nirmala Arumugam <niarumug@...co.com>
> ---
>  kernel/sysctl.c  | 4 ++++
>  security/Kconfig | 8 ++++++++
>  2 files changed, 12 insertions(+)
>  
> diff --git a/kernel/sysctl.c b/kernel/sysctl.c
> index c9fbdd848138..2aa9bc8044c7 100644
> --- a/kernel/sysctl.c
> +++ b/kernel/sysctl.c
> @@ -2426,7 +2426,11 @@ static struct ctl_table kern_table[] = {
>                 .procname       = "randomize_va_space",
>                 .data           = &randomize_va_space,
>                 .maxlen         = sizeof(int),
> +#if defined(CONFIG_RANDOMIZE_VA_SPACE_READONLY)
> +               .mode           = 0444,
> +#else
>                 .mode           = 0644,
> +#endif
>                 .proc_handler   = proc_dointvec,
>         },
>  #endif
> diff --git a/security/Kconfig b/security/Kconfig
> index 7561f6f99f1d..18b9dff4648c 100644
> --- a/security/Kconfig
> +++ b/security/Kconfig
> @@ -7,6 +7,14 @@ menu "Security options"
>  
>  source "security/keys/Kconfig"
>  
> +config RANDOMIZE_VA_SPACE_READONLY
> +       bool "Disallow change of randomize_va_space"
> +       default y

This should only be "default y" if you can not boot here without this
option.

But why is this even needed to be an option at all?  What is causing
this to be turned off?  Can't you keep this from being changed by root
through other means today?

thanks,

greg k-h