From: Jann Horn <jann@thejh.net>
To: Kees Cook <keescook@chromium.org>
Cc: Andrew Morton <akpm@linux-foundation.org>,
Michal Hocko <mhocko@suse.com>, Ingo Molnar <mingo@kernel.org>,
Andy Lutomirski <luto@kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
"kernel-hardening@lists.openwall.com"
<kernel-hardening@lists.openwall.com>,
Daniel Micay <danielmicay@gmail.com>
Subject: Re: [kernel-hardening] Re: [PATCH] fork: make whole stack_canary random
Date: Mon, 31 Oct 2016 17:29:18 +0100 [thread overview]
Message-ID: <20161031162918.GA2994@pc.thejh.net> (raw)
In-Reply-To: <CAGXu5j+Hz=AmmTAh3+QOv1wTG3HA60LPK0Dq6F8uybNQ5e+sHw@mail.gmail.com>
[-- Attachment #1: Type: text/plain, Size: 1188 bytes --]
On Mon, Oct 31, 2016 at 09:04:02AM -0700, Kees Cook wrote:
> On Mon, Oct 31, 2016 at 7:04 AM, Jann Horn <jann@thejh.net> wrote:
> > On machines with sizeof(unsigned long)==8, this ensures that the more
> > significant 32 bits of stack_canary are random, too.
> > stack_canary is defined as unsigned long, all the architectures with stack
> > protector support already pick the stack_canary of init as a random
> > unsigned long, and get_random_long() should be as fast as get_random_int(),
> > so there seems to be no good reason against this.
> >
> > This should help if someone tries to guess a stack canary with brute force.
> >
> > (This change has been made in PaX already, with a different RNG.)
> >
> > Signed-off-by: Jann Horn <jann@thejh.net>
>
> Acked-by: Kees Cook <keescook@chromium.org>
>
> (A separate change might be to make sure that the leading byte is
> zeroed. Entropy of the value, I think, is less important than blocking
> canary exposures from unbounded str* functions. Brute forcing kernel
> stack canaries isn't like it bruting them in userspace...)
Yeah, makes sense. Especially on 64bit, 56 bits of entropy ought to be
enough anyway.
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]
next prev parent reply other threads:[~2016-10-31 16:29 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-10-31 14:04 [PATCH] fork: make whole stack_canary random Jann Horn
2016-10-31 14:04 ` [kernel-hardening] " Jann Horn
2016-10-31 16:04 ` Kees Cook
2016-10-31 16:04 ` [kernel-hardening] " Kees Cook
2016-10-31 16:29 ` Jann Horn [this message]
2016-10-31 16:29 ` Jann Horn
2016-10-31 20:45 ` Florian Weimer
2016-10-31 20:55 ` Jann Horn
2016-10-31 20:56 ` Daniel Micay
2016-10-31 21:01 ` Daniel Micay
2016-10-31 21:10 ` Florian Weimer
2016-10-31 21:21 ` Daniel Micay
2016-10-31 21:38 ` Florian Weimer
2016-10-31 22:02 ` Daniel Micay
2016-10-31 22:11 ` Florian Weimer
2016-10-31 21:22 ` Jann Horn
2016-10-31 21:26 ` Daniel Micay
2016-10-31 21:26 ` Florian Weimer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161031162918.GA2994@pc.thejh.net \
--to=jann@thejh.net \
--cc=akpm@linux-foundation.org \
--cc=danielmicay@gmail.com \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mhocko@suse.com \
--cc=mingo@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.