Re: [RFC PATCH] Randomization of address chosen by mmap.

From: Ilya Smith <blackzert@gmail.com>
To: Matthew Wilcox <willy@infradead.org>
Cc: Kees Cook <keescook@chromium.org>,
	Andrew Morton <akpm@linux-foundation.org>,
	Dan Williams <dan.j.williams@intel.com>,
	Michal Hocko <mhocko@suse.com>,
	"Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
	Jan Kara <jack@suse.cz>, Jerome Glisse <jglisse@redhat.com>,
	Hugh Dickins <hughd@google.com>, Helge Deller <deller@gmx.de>,
	Andrea Arcangeli <aarcange@redhat.com>,
	Oleg Nesterov <oleg@redhat.com>, Linux-MM <linux-mm@kvack.org>,
	LKML <linux-kernel@vger.kernel.org>,
	Kernel Hardening <kernel-hardening@lists.openwall.com>
Subject: Re: [RFC PATCH] Randomization of address chosen by mmap.
Date: Fri, 2 Mar 2018 23:30:28 +0300	[thread overview]
Message-ID: <C9D0E3BA-3AB9-4F0E-BDA5-32378E440986@gmail.com> (raw)
In-Reply-To: <20180228183349.GA16336@bombadil.infradead.org>

> On 28 Feb 2018, at 21:33, Matthew Wilcox <willy@infradead.org> wrote:
> 
> On Wed, Feb 28, 2018 at 08:13:00PM +0300, Ilya Smith wrote:
>>> It would be worth spelling out the "not recommended" bit some more
>>> too: this fragments the mmap space, which has some serious issues on
>>> smaller address spaces if you get into a situation where you cannot
>>> allocate a hole large enough between the other allocations.
>>> 
>> 
>> I’m agree, that's the point.
> 
> Would it be worth randomising the address returned just ever so slightly?
> ie instead of allocating exactly the next address, put in a guard hole
> of (configurable, by default maybe) 1-15 pages?  Is that enough extra
> entropy to foil an interesting number of attacks, or do we need the full
> randomise-the-address-space approach in order to be useful?
> 

This is a really good question. Lets think we choose address with random-length 
guard hole. This length is limited by some configuration as you described. For 
instance let it be 1MB. Now according to current implementation, we still may 
fill this gap with small allocations with size less than 1MB. Attacker will 
going to build attack base on this predictable behaviour - he jus need to spray 
with 1 MB chunks (or less, with some expectation). This attack harder but not 
impossible.

Now lets say we will increase this 1MB to 128MB. Attack is the same, successful 
rate less and more regions needed. Now we increase this value to 48 bit entropy 
and will get my patch (in some form ;))

I hope full randomise-the-address-space approach will work for a long time.

Thanks,
Ilya