* [PATCH v1 1/1] Kernel Config to make randomize_va_space read-only.
@ 2021-02-24 3:53 Lan Zheng (lanzheng)
2021-02-24 14:11 ` Greg KH
0 siblings, 1 reply; 4+ messages in thread
From: Lan Zheng (lanzheng) @ 2021-02-24 3:53 UTC (permalink / raw)
To: security, Kees Cook, kernel-hardening, linux-kernel; +Cc: Lan Zheng (lanzheng)
[-- Attachment #1: Type: text/plain, Size: 1927 bytes --]
From ba2ec52f170a8e69d6c44238bb578f9518a7e3b7 Mon Sep 17 00:00:00 2001
From: lanzheng <lanzheng@cisco.com>
Date: Tue, 23 Feb 2021 22:49:34 -0500
Subject: [PATCH] This patch adds a kernel build config knob that disallows
changes to the sysctl variable randomize_va_space.It makes harder for
attacker to disable ASLR and reduces security risks.
Signed-off-by: lanzheng <lanzheng@cisco.com>
Reviewed-by: Yongkui Han <yonhan@cisco.com>
Tested-by: Nirmala Arumugam <niarumug@cisco.com>
---
kernel/sysctl.c | 4 ++++
security/Kconfig | 8 ++++++++
2 files changed, 12 insertions(+)
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index c9fbdd848138..2aa9bc8044c7 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2426,7 +2426,11 @@ static struct ctl_table kern_table[] = {
.procname = "randomize_va_space",
.data = &randomize_va_space,
.maxlen = sizeof(int),
+#if defined(CONFIG_RANDOMIZE_VA_SPACE_READONLY)
+ .mode = 0444,
+#else
.mode = 0644,
+#endif
.proc_handler = proc_dointvec,
},
#endif
diff --git a/security/Kconfig b/security/Kconfig
index 7561f6f99f1d..18b9dff4648c 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -7,6 +7,14 @@ menu "Security options"
source "security/keys/Kconfig"
+config RANDOMIZE_VA_SPACE_READONLY
+ bool "Disallow change of randomize_va_space"
+ default y
+ help
+ If you say Y here, /proc/sys/kernel/randomize_va_space can not
+ be changed by any user, including root, this will help prevent
+ disablement of ASLR.
+
config SECURITY_DMESG_RESTRICT
bool "Restrict unprivileged access to the kernel syslog"
default n
--
[-- Attachment #2: Type: text/html, Size: 8524 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH v1 1/1] Kernel Config to make randomize_va_space read-only.
2021-02-24 3:53 [PATCH v1 1/1] Kernel Config to make randomize_va_space read-only Lan Zheng (lanzheng)
@ 2021-02-24 14:11 ` Greg KH
0 siblings, 0 replies; 4+ messages in thread
From: Greg KH @ 2021-02-24 14:11 UTC (permalink / raw)
To: Lan Zheng (lanzheng); +Cc: security, Kees Cook, kernel-hardening, linux-kernel
On Wed, Feb 24, 2021 at 03:53:37AM +0000, Lan Zheng (lanzheng) wrote:
> From ba2ec52f170a8e69d6c44238bb578f9518a7e3b7 Mon Sep 17 00:00:00 2001
>
> From: lanzheng <lanzheng@cisco.com>
<snip>
You are still sending html email, which is rejected by the kernel
mailing lists.
And no need to cc: security@kernel.org, that is only for reporting
security issues, not new kernel changes like this.
good luck!
greg k-h
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH v1 1/1] Kernel Config to make randomize_va_space read-only.
@ 2021-02-25 4:42 Lan Zheng (lanzheng)
2021-02-25 11:40 ` Greg KH
0 siblings, 1 reply; 4+ messages in thread
From: Lan Zheng (lanzheng) @ 2021-02-25 4:42 UTC (permalink / raw)
To: Kees Cook, kernel-hardening, linux-kernel; +Cc: Lan Zheng (lanzheng)
From ba2ec52f170a8e69d6c44238bb578f9518a7e3b7 Mon Sep 17 00:00:00 2001
From: lanzheng <lanzheng@cisco.com>
Date: Tue, 23 Feb 2021 22:49:34 -0500
Subject: [PATCH] This patch adds a kernel build config knob that disallows
changes to the sysctl variable randomize_va_space.It makes harder for
attacker to disable ASLR and reduces security risks.
Signed-off-by: lanzheng <lanzheng@cisco.com>
Reviewed-by: Yongkui Han <yonhan@cisco.com>
Tested-by: Nirmala Arumugam <niarumug@cisco.com>
---
kernel/sysctl.c | 4 ++++
security/Kconfig | 8 ++++++++
2 files changed, 12 insertions(+)
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index c9fbdd848138..2aa9bc8044c7 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2426,7 +2426,11 @@ static struct ctl_table kern_table[] = {
.procname = "randomize_va_space",
.data = &randomize_va_space,
.maxlen = sizeof(int),
+#if defined(CONFIG_RANDOMIZE_VA_SPACE_READONLY)
+ .mode = 0444,
+#else
.mode = 0644,
+#endif
.proc_handler = proc_dointvec,
},
#endif
diff --git a/security/Kconfig b/security/Kconfig
index 7561f6f99f1d..18b9dff4648c 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -7,6 +7,14 @@ menu "Security options"
source "security/keys/Kconfig"
+config RANDOMIZE_VA_SPACE_READONLY
+ bool "Disallow change of randomize_va_space"
+ default y
+ help
+ If you say Y here, /proc/sys/kernel/randomize_va_space can not
+ be changed by any user, including root, this will help prevent
+ disablement of ASLR.
+
config SECURITY_DMESG_RESTRICT
bool "Restrict unprivileged access to the kernel syslog"
default n
--
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH v1 1/1] Kernel Config to make randomize_va_space read-only.
2021-02-25 4:42 Lan Zheng (lanzheng)
@ 2021-02-25 11:40 ` Greg KH
0 siblings, 0 replies; 4+ messages in thread
From: Greg KH @ 2021-02-25 11:40 UTC (permalink / raw)
To: Lan Zheng (lanzheng); +Cc: Kees Cook, kernel-hardening, linux-kernel
On Thu, Feb 25, 2021 at 04:42:28AM +0000, Lan Zheng (lanzheng) wrote:
> From ba2ec52f170a8e69d6c44238bb578f9518a7e3b7 Mon Sep 17 00:00:00 2001
> From: lanzheng <lanzheng@cisco.com>
> Date: Tue, 23 Feb 2021 22:49:34 -0500
Why is this here?
> Subject: [PATCH] This patch adds a kernel build config knob that disallows
> changes to the sysctl variable randomize_va_space.It makes harder for
> attacker to disable ASLR and reduces security risks.
I think you need to read the documentation for how to write a good
changelog text.
>
> Signed-off-by: lanzheng <lanzheng@cisco.com>
> Reviewed-by: Yongkui Han <yonhan@cisco.com>
> Tested-by: Nirmala Arumugam <niarumug@cisco.com>
> ---
> kernel/sysctl.c | 4 ++++
> security/Kconfig | 8 ++++++++
> 2 files changed, 12 insertions(+)
>
> diff --git a/kernel/sysctl.c b/kernel/sysctl.c
> index c9fbdd848138..2aa9bc8044c7 100644
> --- a/kernel/sysctl.c
> +++ b/kernel/sysctl.c
> @@ -2426,7 +2426,11 @@ static struct ctl_table kern_table[] = {
> .procname = "randomize_va_space",
> .data = &randomize_va_space,
> .maxlen = sizeof(int),
> +#if defined(CONFIG_RANDOMIZE_VA_SPACE_READONLY)
> + .mode = 0444,
> +#else
> .mode = 0644,
> +#endif
> .proc_handler = proc_dointvec,
> },
> #endif
> diff --git a/security/Kconfig b/security/Kconfig
> index 7561f6f99f1d..18b9dff4648c 100644
> --- a/security/Kconfig
> +++ b/security/Kconfig
> @@ -7,6 +7,14 @@ menu "Security options"
>
> source "security/keys/Kconfig"
>
> +config RANDOMIZE_VA_SPACE_READONLY
> + bool "Disallow change of randomize_va_space"
> + default y
This should only be "default y" if you can not boot here without this
option.
But why is this even needed to be an option at all? What is causing
this to be turned off? Can't you keep this from being changed by root
through other means today?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-02-25 11:41 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-02-24 3:53 [PATCH v1 1/1] Kernel Config to make randomize_va_space read-only Lan Zheng (lanzheng)
2021-02-24 14:11 ` Greg KH
2021-02-25 4:42 Lan Zheng (lanzheng)
2021-02-25 11:40 ` Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).