Re: [kernel-hardening] Re: Proposal for kernel self protection features

From: Josh Triplett <josh@joshtriplett.org>
To: Theodore Tso <tytso@google.com>
Cc: Jason Cooper <kernel-hardening@lakedaemon.net>,
	kernel-hardening@lists.openwall.com,
	Emese Revfy <re.emese@gmail.com>,
	Kees Cook <keescook@chromium.org>,
	PaX Team <pageexec@freemail.hu>,
	Brad Spengler <spender@grsecurity.net>,
	Greg KH <gregkh@linuxfoundation.org>
Subject: Re: [kernel-hardening] Re: Proposal for kernel self protection features
Date: Mon, 9 Nov 2015 12:06:23 -0800	[thread overview]
Message-ID: <20151109200623.GA24788@cloud> (raw)
In-Reply-To: <CAGagf4d4A8ZN2hVDDUFge78D_AZKFwkh6ZCV9faEZe=DO_fwKQ@mail.gmail.com>

On Mon, Nov 09, 2015 at 02:11:35PM -0500, Theodore Tso wrote:
> On Mon, Nov 9, 2015 at 2:02 PM, Jason Cooper <
> kernel-hardening@lakedaemon.net> wrote:
> 
> > /var/lib/misc/random-seed has served that role for years, I'm only
> > advocating loading it earlier in the boot process.  It's *much* harder
> > to guess the state of random-seed than the dtb or mac address(es)...
> >
> 
> If the bootloader is willing to reach into the file system, which means (a)
> having a minimal file system layer, like Grub does, and (b) can find the
> block device where the file is found, that's a perfectly *fine*
> implementation.    I'm not sure mobile handset vendors will be all that
> psyched into either using or replicating all of Grub's functionality so it
> could do that, though....

How crazy would it be to append it to the end of the initramfs, as we've
started making possible for critical firmware/microcode/tables?

- Josh Triplett