From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-ot0-f179.google.com (mail-ot0-f179.google.com [74.125.82.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 3vDr5913PBzDqBV for ; Fri, 3 Feb 2017 06:43:09 +1100 (AEDT) Received: by mail-ot0-f179.google.com with SMTP id f9so20072340otd.1 for ; Thu, 02 Feb 2017 11:43:09 -0800 (PST) MIME-Version: 1.0 In-Reply-To: References: <1486014168-1279-1-git-send-email-bhsharma@redhat.com> From: Bhupesh Sharma Date: Fri, 3 Feb 2017 01:13:06 +0530 Message-ID: Subject: Re: [PATCH 0/2] RFC: Adjust powerpc ASLR elf randomness To: Kees Cook Cc: Matt Porter , Paul Mackerras , Daniel Cashman , Bhupesh SHARMA , Alexander Graf , "linuxppc-dev@lists.ozlabs.org" , Scott Wood , Michael Ellerman , Anatolij Gustschin , Benjamin Herrenschmidt , Vitaly Bordug , Kumar Gala , Alistair Popple , Daniel Cashman , "kernel-hardening@lists.openwall.com" Content-Type: multipart/alternative; boundary=001a1137be10d7afe40547915f09 List-Id: Linux on PowerPC Developers Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , --001a1137be10d7afe40547915f09 Content-Type: text/plain; charset=UTF-8 On 3 Feb 2017 00:49, "Kees Cook" wrote: On Thu, Feb 2, 2017 at 10:08 AM, Bhupesh Sharma wrote: > On Thu, Feb 2, 2017 at 7:51 PM, Kees Cook wrote: >> On Wed, Feb 1, 2017 at 9:42 PM, Bhupesh Sharma wrote: >>> The 2nd patch increases the ELF_ET_DYN_BASE value from the current >>> hardcoded value of 0x2000_0000 to something more practical, >>> i.e. TASK_SIZE - PAGE_SHIFT (which makes sense especially for >>> 64-bit platforms which would like to utilize more randomization >>> in the load address of a PIE elf). >> >> I don't think you want this second patch. Moving ELF_ET_DYN_BASE to >> the top of TASK_SIZE means you'll be constantly colliding with stack >> and mmap randomization. 0x20000000 is way better since it randomizes >> up from there towards the mmap area. >> >> Is there a reason to avoid the 32-bit memory range for the ELF addresses? > > I think you are right. Hmm, I think I was going by my particular use > case which might not be required for generic PPC platforms. > > I have one doubt though - I have primarily worked on arm64 and x86 > architectures and there I see there 64-bit user space applications > using the 64-bit load addresses/ranges. I am not sure why PPC64 is > different historically. x86's ELF_ET_DYN_BASE is (TASK_SIZE / 3 * 2), so it puts it ET_DYN base at the top third of the address space. (In theory, this is to avoid interpreter collisions, but I'm working on removing that restriction, as it seems pointless.) Other architectures have small ELF_ET_DYN_BASEs, which is good: it allows them to have larger entropy for ET_DYN. Fair enough. I will drop the 2nd patch then and spin a v2. Regards, Bhupesh --001a1137be10d7afe40547915f09 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On 3 Feb 2017 00:49, "Kees Cook" <keescook@chromium.org> wrote:
On Thu, Feb 2,= 2017 at 10:08 AM, Bhupesh Sharma <bhsharma@redhat.com> wrote:
> On Thu, Feb 2, 2017 at 7:51 PM, Kees Cook <keescook@chromium.org> wrote:
>> On Wed, Feb 1, 2017 at 9:42 PM, Bhupesh Sharma <bhsharma@redhat.com> wrote:
>>> The 2nd patch increases the E= LF_ET_DYN_BASE value from the current
>>> hardcoded value of 0x2000_0000 to something more practical, >>> i.e. TASK_SIZE - PAGE_SHIFT (which makes sense especially for<= br> >>> 64-bit platforms which would like to utilize more randomizatio= n
>>> in the load address of a PIE elf).
>>
>> I don't think you want this second patch. Moving ELF_ET_DYN_BA= SE to
>> the top of TASK_SIZE means you'll be constantly colliding with= stack
>> and mmap randomization. 0x20000000 is way better since it randomiz= es
>> up from there towards the mmap area.
>>
>> Is there a reason to avoid the 32-bit memory range for the ELF add= resses?
>
> I think you are right. Hmm, I think I= was going by my particular use
> case which might not be required for generic PPC platforms.
>
> I have one doubt though - I have primarily worked on arm64 and x86
> architectures and there I see there 64-bit user space applications
> using the 64-bit load addresses/ranges. I am not sure why PPC64 is
> different historically.

x86's ELF_ET_DYN_BASE is (TASK_SIZE / 3 * 2), so it puts it ET_DY= N
base at the top third of the address space. (In theory, this is to
avoid interpreter collisions, but I'm working on removing that
restriction, as it seems pointless.)

Other architectures have small ELF_ET_DYN_BASEs, which is good: it
allows them to have larger entropy for ET_DYN.

Fair enough. I will drop th= e 2nd patch then and spin a v2.

Regards,=C2=A0
Bhupesh=C2=A0

--001a1137be10d7afe40547915f09-- From mboxrd@z Thu Jan 1 00:00:00 1970 MIME-Version: 1.0 In-Reply-To: References: <1486014168-1279-1-git-send-email-bhsharma@redhat.com> From: Bhupesh Sharma Date: Fri, 3 Feb 2017 01:13:06 +0530 Message-ID: Content-Type: multipart/alternative; boundary=001a1137be10d7afe40547915f09 Subject: [kernel-hardening] Re: [PATCH 0/2] RFC: Adjust powerpc ASLR elf randomness To: Kees Cook Cc: Matt Porter , Paul Mackerras , Daniel Cashman , Bhupesh SHARMA , Alexander Graf , "linuxppc-dev@lists.ozlabs.org" , Scott Wood , Michael Ellerman , Anatolij Gustschin , Benjamin Herrenschmidt , Vitaly Bordug , Kumar Gala , Alistair Popple , Daniel Cashman , "kernel-hardening@lists.openwall.com" List-ID: --001a1137be10d7afe40547915f09 Content-Type: text/plain; charset=UTF-8 On 3 Feb 2017 00:49, "Kees Cook" wrote: On Thu, Feb 2, 2017 at 10:08 AM, Bhupesh Sharma wrote: > On Thu, Feb 2, 2017 at 7:51 PM, Kees Cook wrote: >> On Wed, Feb 1, 2017 at 9:42 PM, Bhupesh Sharma wrote: >>> The 2nd patch increases the ELF_ET_DYN_BASE value from the current >>> hardcoded value of 0x2000_0000 to something more practical, >>> i.e. TASK_SIZE - PAGE_SHIFT (which makes sense especially for >>> 64-bit platforms which would like to utilize more randomization >>> in the load address of a PIE elf). >> >> I don't think you want this second patch. Moving ELF_ET_DYN_BASE to >> the top of TASK_SIZE means you'll be constantly colliding with stack >> and mmap randomization. 0x20000000 is way better since it randomizes >> up from there towards the mmap area. >> >> Is there a reason to avoid the 32-bit memory range for the ELF addresses? > > I think you are right. Hmm, I think I was going by my particular use > case which might not be required for generic PPC platforms. > > I have one doubt though - I have primarily worked on arm64 and x86 > architectures and there I see there 64-bit user space applications > using the 64-bit load addresses/ranges. I am not sure why PPC64 is > different historically. x86's ELF_ET_DYN_BASE is (TASK_SIZE / 3 * 2), so it puts it ET_DYN base at the top third of the address space. (In theory, this is to avoid interpreter collisions, but I'm working on removing that restriction, as it seems pointless.) Other architectures have small ELF_ET_DYN_BASEs, which is good: it allows them to have larger entropy for ET_DYN. Fair enough. I will drop the 2nd patch then and spin a v2. Regards, Bhupesh --001a1137be10d7afe40547915f09 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On 3 Feb 2017 00:49, "Kees Cook" <keescook@chromium.org> wrote:
On Thu, Feb 2,= 2017 at 10:08 AM, Bhupesh Sharma <bhsharma@redhat.com> wrote:
> On Thu, Feb 2, 2017 at 7:51 PM, Kees Cook <keescook@chromium.org> wrote:
>> On Wed, Feb 1, 2017 at 9:42 PM, Bhupesh Sharma <bhsharma@redhat.com> wrote:
>>> The 2nd patch increases the E= LF_ET_DYN_BASE value from the current
>>> hardcoded value of 0x2000_0000 to something more practical, >>> i.e. TASK_SIZE - PAGE_SHIFT (which makes sense especially for<= br> >>> 64-bit platforms which would like to utilize more randomizatio= n
>>> in the load address of a PIE elf).
>>
>> I don't think you want this second patch. Moving ELF_ET_DYN_BA= SE to
>> the top of TASK_SIZE means you'll be constantly colliding with= stack
>> and mmap randomization. 0x20000000 is way better since it randomiz= es
>> up from there towards the mmap area.
>>
>> Is there a reason to avoid the 32-bit memory range for the ELF add= resses?
>
> I think you are right. Hmm, I think I= was going by my particular use
> case which might not be required for generic PPC platforms.
>
> I have one doubt though - I have primarily worked on arm64 and x86
> architectures and there I see there 64-bit user space applications
> using the 64-bit load addresses/ranges. I am not sure why PPC64 is
> different historically.

x86's ELF_ET_DYN_BASE is (TASK_SIZE / 3 * 2), so it puts it ET_DY= N
base at the top third of the address space. (In theory, this is to
avoid interpreter collisions, but I'm working on removing that
restriction, as it seems pointless.)

Other architectures have small ELF_ET_DYN_BASEs, which is good: it
allows them to have larger entropy for ET_DYN.

Fair enough. I will drop th= e 2nd patch then and spin a v2.

Regards,=C2=A0
Bhupesh=C2=A0

--001a1137be10d7afe40547915f09--