* Does anyone use RANDSTRUCT?
@ 2019-12-13 15:40 Stephen Smalley
[not found] ` <CAOSEQ1qhxdA+JW4M6rOqjzTuMXu2hr0jxRt9NfkuEcWW7-_BEQ@mail.gmail.com>
2019-12-13 18:05 ` Kees Cook
0 siblings, 2 replies; 6+ messages in thread
From: Stephen Smalley @ 2019-12-13 15:40 UTC (permalink / raw)
To: Paul Moore, SELinux, Kees Cook, Jeffrey Vander Stoep, Ondrej Mosnacek
See $(subject). If yes, there are some obvious candidates among the
SELinux data structures for randomized layouts to avoid fixed locations
for enforcing, initialized, etc. If not, then no point in pursuing it.
Doesn't look like Fedora enables it, probably because they'd have to
publish the random seeds anyway for third party kernel modules. But
maybe it would be useful for some distros/users? ChromeOS? Android?
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Does anyone use RANDSTRUCT?
[not found] ` <CAOSEQ1qhxdA+JW4M6rOqjzTuMXu2hr0jxRt9NfkuEcWW7-_BEQ@mail.gmail.com>
@ 2019-12-13 15:53 ` Stephen Smalley
0 siblings, 0 replies; 6+ messages in thread
From: Stephen Smalley @ 2019-12-13 15:53 UTC (permalink / raw)
To: Wenhui Zhang
Cc: Paul Moore, SELinux, Kees Cook, Jeffrey Vander Stoep, Ondrej Mosnacek
On 12/13/19 10:45 AM, Wenhui Zhang wrote:
> It seems like most of Selinux functions are static inline , no symbols
> are exposed to symbol table.
> IMHO, randomization is not necessary if not reflected in symbol table ?
RANDSTRUCT isn't about randomization of code; it is about randomization
of data structure layout. See https://lwn.net/Articles/722293/ for some
background.
Also, your assumption is wrong but that's not germane to this thread so
I won't discuss it further here.
>
> On Fri, Dec 13, 2019, 10:41 AM Stephen Smalley <sds@tycho.nsa.gov
> <mailto:sds@tycho.nsa.gov>> wrote:
>
> See $(subject). If yes, there are some obvious candidates among the
> SELinux data structures for randomized layouts to avoid fixed locations
> for enforcing, initialized, etc. If not, then no point in pursuing it.
> Doesn't look like Fedora enables it, probably because they'd have to
> publish the random seeds anyway for third party kernel modules. But
> maybe it would be useful for some distros/users? ChromeOS? Android?
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Does anyone use RANDSTRUCT?
2019-12-13 15:40 Does anyone use RANDSTRUCT? Stephen Smalley
[not found] ` <CAOSEQ1qhxdA+JW4M6rOqjzTuMXu2hr0jxRt9NfkuEcWW7-_BEQ@mail.gmail.com>
@ 2019-12-13 18:05 ` Kees Cook
2019-12-13 18:36 ` Stephen Smalley
1 sibling, 1 reply; 6+ messages in thread
From: Kees Cook @ 2019-12-13 18:05 UTC (permalink / raw)
To: Stephen Smalley
Cc: Paul Moore, SELinux, Jeffrey Vander Stoep, Ondrej Mosnacek,
Connor Kuehl, Dan Aloni
On Fri, Dec 13, 2019 at 10:40:54AM -0500, Stephen Smalley wrote:
> See $(subject). If yes, there are some obvious candidates among the SELinux
> data structures for randomized layouts to avoid fixed locations for
> enforcing, initialized, etc. If not, then no point in pursuing it. Doesn't
> look like Fedora enables it, probably because they'd have to publish the
> random seeds anyway for third party kernel modules. But maybe it would be
> useful for some distros/users? ChromeOS? Android?
It is used by "in-house" kernel builders who optimize for high security
above all other things (I've talked to a few of them over the years
when finding out what defenses they've wanted). I've also seen Huawai
Android patches that seem to indicate they're using it as well, but I
haven't been able to determine if any released devices are shipping with
it enabled. I've also had several people ask after the Clang randstruct
port, which is ongoing[1] by a couple people (added to CC).
I think it would be very handy to add some more markings to sensitive
data structures. Please send patches!
-Kees
[1] https://reviews.llvm.org/D59254
https://github.com/da-x/llvm-project/commits/clang-r365631c-randstruct
https://github.com/da-x/linux/commits/android-4.19-randstruct
https://github.com/connorkuehl/llvm-project/commits/randstruct
https://github.com/connorkuehl/llvm-project/pull/21
--
Kees Cook
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Does anyone use RANDSTRUCT?
2019-12-13 18:05 ` Kees Cook
@ 2019-12-13 18:36 ` Stephen Smalley
2019-12-13 22:39 ` Dan Aloni
0 siblings, 1 reply; 6+ messages in thread
From: Stephen Smalley @ 2019-12-13 18:36 UTC (permalink / raw)
To: Kees Cook
Cc: Paul Moore, SELinux, Jeffrey Vander Stoep, Ondrej Mosnacek,
Connor Kuehl, Dan Aloni
On 12/13/19 1:05 PM, Kees Cook wrote:
> On Fri, Dec 13, 2019 at 10:40:54AM -0500, Stephen Smalley wrote:
>> See $(subject). If yes, there are some obvious candidates among the SELinux
>> data structures for randomized layouts to avoid fixed locations for
>> enforcing, initialized, etc. If not, then no point in pursuing it. Doesn't
>> look like Fedora enables it, probably because they'd have to publish the
>> random seeds anyway for third party kernel modules. But maybe it would be
>> useful for some distros/users? ChromeOS? Android?
>
> It is used by "in-house" kernel builders who optimize for high security
> above all other things (I've talked to a few of them over the years
> when finding out what defenses they've wanted). I've also seen Huawai
> Android patches that seem to indicate they're using it as well, but I
> haven't been able to determine if any released devices are shipping with
> it enabled. I've also had several people ask after the Clang randstruct
> port, which is ongoing[1] by a couple people (added to CC).
>
> I think it would be very handy to add some more markings to sensitive
> data structures. Please send patches!
Do you know if there is something inhibiting usage in e.g. Pixel
devices? Performance impact?
>
> -Kees
>
> [1] https://reviews.llvm.org/D59254
> https://github.com/da-x/llvm-project/commits/clang-r365631c-randstruct
> https://github.com/da-x/linux/commits/android-4.19-randstruct
> https://github.com/connorkuehl/llvm-project/commits/randstruct
> https://github.com/connorkuehl/llvm-project/pull/21
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Does anyone use RANDSTRUCT?
2019-12-13 18:36 ` Stephen Smalley
@ 2019-12-13 22:39 ` Dan Aloni
2019-12-15 0:33 ` Connor Kuehl
0 siblings, 1 reply; 6+ messages in thread
From: Dan Aloni @ 2019-12-13 22:39 UTC (permalink / raw)
To: Stephen Smalley
Cc: Kees Cook, Paul Moore, SELinux, Jeffrey Vander Stoep,
Ondrej Mosnacek, Connor Kuehl
On Fri, Dec 13, 2019 at 01:36:38PM -0500, Stephen Smalley wrote:
> On 12/13/19 1:05 PM, Kees Cook wrote:
> > On Fri, Dec 13, 2019 at 10:40:54AM -0500, Stephen Smalley wrote:
> > > See $(subject). If yes, there are some obvious candidates among the SELinux
> > > data structures for randomized layouts to avoid fixed locations for
> > > enforcing, initialized, etc. If not, then no point in pursuing it. Doesn't
> > > look like Fedora enables it, probably because they'd have to publish the
> > > random seeds anyway for third party kernel modules. But maybe it would be
> > > useful for some distros/users? ChromeOS? Android?
> >
> > It is used by "in-house" kernel builders who optimize for high security
> > above all other things (I've talked to a few of them over the years
> > when finding out what defenses they've wanted). I've also seen Huawai
> > Android patches that seem to indicate they're using it as well, but I
> > haven't been able to determine if any released devices are shipping with
> > it enabled. I've also had several people ask after the Clang randstruct
> > port, which is ongoing[1] by a couple people (added to CC).
> >
> > I think it would be very handy to add some more markings to sensitive
> > data structures. Please send patches!
>
> Do you know if there is something inhibiting usage in e.g. Pixel devices?
> Performance impact?
In Android, the use of Clang for building the kernel inhibits it, as
RANDSTRUCT support for Clang is still in development. The move to Clang
for AOSP kernels is motivated for enabling CFI [1] and other features
such as SCS [2]. AFAIK the move to Clang is already in effect for quite
awhile in the kernels running on Pixel devices.
About performance, the gcc RANDSTRUCT implementation also includes a
performance-preserving feature where randomization takes cacheline
boundary into consideration. The Clang implementation is expected to
have this as well. It's a valid concern and definitely garners testing
for anyone enabling the feature.
[1] https://source.android.com/devices/tech/debug/cfi
[2] https://source.android.com/devices/tech/debug/shadow-call-stack
--
Dan Aloni
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Does anyone use RANDSTRUCT?
2019-12-13 22:39 ` Dan Aloni
@ 2019-12-15 0:33 ` Connor Kuehl
0 siblings, 0 replies; 6+ messages in thread
From: Connor Kuehl @ 2019-12-15 0:33 UTC (permalink / raw)
To: Dan Aloni, Stephen Smalley
Cc: Kees Cook, Paul Moore, SELinux, Jeffrey Vander Stoep, Ondrej Mosnacek
On 12/13/19 2:39 PM, Dan Aloni wrote:
>> Do you know if there is something inhibiting usage in e.g. Pixel devices?
>> Performance impact?
> About performance, the gcc RANDSTRUCT implementation also includes a
> performance-preserving feature where randomization takes cacheline
> boundary into consideration. The Clang implementation is expected to
> have this as well. It's a valid concern and definitely garners testing
> for anyone enabling the feature.
Just confirming this: the development branch (well I suppose that's
technically the only branch :-) ) for Clang randstruct does already have
this feature -- it will try its hardest to squeeze the fields into cache
lines. It's worth noting however that this algorithm is in its first
iteration with potentially many more to come as people that are much
smarter than me start digging into it and contributing optimizations
while Clang randstruct gets closer and closer to getting merged upstream.
Unfortunately I have not measured or collected any data on the
performance implications of Clang randstruct yet... but that is
something I am interested in doing once we've gotten all of the wrinkles
figured out.
- Connor
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-12-15 0:33 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-12-13 15:40 Does anyone use RANDSTRUCT? Stephen Smalley
[not found] ` <CAOSEQ1qhxdA+JW4M6rOqjzTuMXu2hr0jxRt9NfkuEcWW7-_BEQ@mail.gmail.com>
2019-12-13 15:53 ` Stephen Smalley
2019-12-13 18:05 ` Kees Cook
2019-12-13 18:36 ` Stephen Smalley
2019-12-13 22:39 ` Dan Aloni
2019-12-15 0:33 ` Connor Kuehl
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.