Re: [kernel-hardening] Re: Proposal for kernel self protection features

[Marcus Meissner <meissner@suse.de>]

On Tue, Nov 10, 2015 at 11:42:31AM +0100, Yves-Alexis Perez wrote:
> On lun., 2015-11-09 at 21:13 +0000, Matthew Garrett wrote:
> > On Mon, Nov 09, 2015 at 09:09:22PM +0000, Jason Cooper wrote:
> > 
> > > Well, That's why I referred to reading from /boot or from a flash
> > > partition.  Existing bootloaders in the field already have that
> > > capability.  That's how they load the kernel.
> > 
> > This doesn't really handle cases like network booting. Most SoCs have 
> > some kind of RNG, recent x86 has hardware RNG, older x86 frequently has 
> > an RNG in a TPM. Pulling an entropy seed from the filesystem is a 
> > reasonable fallback, but we should definitely be thinking of it as a 
> > fallback - someone with physical access to your system while it's turned 
> > off may be able to infer the ASLR state for your next boot, for 
> > instance.
> 
> About the TPM RNG: I was definitely interested in the “get entropy from
> TPM” kind of thing for my laptop (even though I think my laptop would
> not be the worst place to find entropy). Right now I'm using rng-tools
> to read from /dev/hwrng (handled by tpm_rng module), which then feeds
> entropy to /dev/random (or maybe directly using the RND ioctls).
> 
> Do you think bypassing userland completely in order to be able to feed
> that entropy even before userland is completely initialized would be
> helpful?

The kernel has infrastructure for this (feeding hardware random generators
into the random pool) these days.

e.g.
drivers/char/hw_random/tpm-rng.c

How "good" the generator is is determined by  the "quality" member of
the hwrng struct.

(It seems only virtio-rng.c sets one, but more of them could be reviewed
and used.)

Ciao, Marcus