linux-kernel - Re: [RFC PATCH] x86/Kconfig: Disable KASLR on debug builds

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 1 Dec 2023 09:58:16 -0700
From:   Nathan Chancellor <nathan@...nel.org>
To:     Borislav Petkov <bp@...en8.de>
Cc:     X86 ML <x86@...nel.org>, LKML <linux-kernel@...r.kernel.org>
Subject: Re: [RFC PATCH] x86/Kconfig: Disable KASLR on debug builds

On Fri, Dec 01, 2023 at 05:24:43PM +0100, Borislav Petkov wrote:
> On Fri, Dec 01, 2023 at 09:16:10AM -0700, Nathan Chancellor wrote:
> > Right, this is the diff of Fedora's configuration before and after this
> > change:
> 
> Sorry, but what's the point of a .config which has EXPERT, DEBUG_KERNEL
> *and* KASLR enabled?

I am not really here to argue whether or not this is a "valid"
combination of configurations, I am just pointing out that your patch
will change the status quo for more people than just the x86
maintainers.

> Debugging the kernel with KASLR enabled is a futile exercise in time
> waste. You should either enable KASLR and disable DEBUG_KERNEL or the
> opposite. Both make very little sense to me.

I agree that debugging the kernel with KASLR enabled is useless but
isn't that the point of having the ability to opt out of it at runtime
so that you could debug the exact same binary that a user is running,
rather than having to manage two different builds?

> Or, if there really is a valid reason for having DEBUG_KERNEL *and*
> KASLR enabled, I can probably suggest another option under DEBUG_KERNEL
> which says "Do stable virtual addresses" and which disables KASLR. At
> least we'll have it explicit.

That does not seem unreasonable to me. Another alternative would be to
add a simple config fragment in arch/x86/configs so that it could
easily be flipped during a build like:

$ cat arch/x86/configs/nokaslr.config
# CONFIG_RANDOMIZE_BASE is not set

$ make -skj"$(nproc)" ARCH=x86_64 defconfig

$ grep CONFIG_RANDOMIZE_BASE .config
CONFIG_RANDOMIZE_BASE=y

$ make -skj"$(nproc)" ARCH=x86_64 nokaslr.config

$ grep CONFIG_RANDOMIZE_BASE .config
# CONFIG_RANDOMIZE_BASE is not set

Cheers,
Nathan