From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-io0-x231.google.com (mail-io0-x231.google.com [IPv6:2607:f8b0:4001:c06::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 3vDqYx4mc1zDqBV for ; Fri, 3 Feb 2017 06:19:33 +1100 (AEDT) Received: by mail-io0-x231.google.com with SMTP id j13so779238iod.3 for ; Thu, 02 Feb 2017 11:19:33 -0800 (PST) MIME-Version: 1.0 Sender: keescook@google.com In-Reply-To: References: <1486014168-1279-1-git-send-email-bhsharma@redhat.com> From: Kees Cook Date: Thu, 2 Feb 2017 11:19:28 -0800 Message-ID: Subject: Re: [PATCH 0/2] RFC: Adjust powerpc ASLR elf randomness To: Bhupesh Sharma Cc: "linuxppc-dev@lists.ozlabs.org" , "kernel-hardening@lists.openwall.com" , Daniel Cashman , Michael Ellerman , Bhupesh SHARMA , Alexander Graf , Benjamin Herrenschmidt , Paul Mackerras , Anatolij Gustschin , Alistair Popple , Matt Porter , Vitaly Bordug , Scott Wood , Kumar Gala , Daniel Cashman Content-Type: text/plain; charset=UTF-8 List-Id: Linux on PowerPC Developers Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , On Thu, Feb 2, 2017 at 10:08 AM, Bhupesh Sharma wrote: > On Thu, Feb 2, 2017 at 7:51 PM, Kees Cook wrote: >> On Wed, Feb 1, 2017 at 9:42 PM, Bhupesh Sharma wrote: >>> The 2nd patch increases the ELF_ET_DYN_BASE value from the current >>> hardcoded value of 0x2000_0000 to something more practical, >>> i.e. TASK_SIZE - PAGE_SHIFT (which makes sense especially for >>> 64-bit platforms which would like to utilize more randomization >>> in the load address of a PIE elf). >> >> I don't think you want this second patch. Moving ELF_ET_DYN_BASE to >> the top of TASK_SIZE means you'll be constantly colliding with stack >> and mmap randomization. 0x20000000 is way better since it randomizes >> up from there towards the mmap area. >> >> Is there a reason to avoid the 32-bit memory range for the ELF addresses? > > I think you are right. Hmm, I think I was going by my particular use > case which might not be required for generic PPC platforms. > > I have one doubt though - I have primarily worked on arm64 and x86 > architectures and there I see there 64-bit user space applications > using the 64-bit load addresses/ranges. I am not sure why PPC64 is > different historically. x86's ELF_ET_DYN_BASE is (TASK_SIZE / 3 * 2), so it puts it ET_DYN base at the top third of the address space. (In theory, this is to avoid interpreter collisions, but I'm working on removing that restriction, as it seems pointless.) Other architectures have small ELF_ET_DYN_BASEs, which is good: it allows them to have larger entropy for ET_DYN. -Kees -- Kees Cook Pixel Security From mboxrd@z Thu Jan 1 00:00:00 1970 MIME-Version: 1.0 Sender: keescook@google.com In-Reply-To: References: <1486014168-1279-1-git-send-email-bhsharma@redhat.com> From: Kees Cook Date: Thu, 2 Feb 2017 11:19:28 -0800 Message-ID: Content-Type: text/plain; charset=UTF-8 Subject: [kernel-hardening] Re: [PATCH 0/2] RFC: Adjust powerpc ASLR elf randomness To: Bhupesh Sharma Cc: "linuxppc-dev@lists.ozlabs.org" , "kernel-hardening@lists.openwall.com" , Daniel Cashman , Michael Ellerman , Bhupesh SHARMA , Alexander Graf , Benjamin Herrenschmidt , Paul Mackerras , Anatolij Gustschin , Alistair Popple , Matt Porter , Vitaly Bordug , Scott Wood , Kumar Gala , Daniel Cashman List-ID: On Thu, Feb 2, 2017 at 10:08 AM, Bhupesh Sharma wrote: > On Thu, Feb 2, 2017 at 7:51 PM, Kees Cook wrote: >> On Wed, Feb 1, 2017 at 9:42 PM, Bhupesh Sharma wrote: >>> The 2nd patch increases the ELF_ET_DYN_BASE value from the current >>> hardcoded value of 0x2000_0000 to something more practical, >>> i.e. TASK_SIZE - PAGE_SHIFT (which makes sense especially for >>> 64-bit platforms which would like to utilize more randomization >>> in the load address of a PIE elf). >> >> I don't think you want this second patch. Moving ELF_ET_DYN_BASE to >> the top of TASK_SIZE means you'll be constantly colliding with stack >> and mmap randomization. 0x20000000 is way better since it randomizes >> up from there towards the mmap area. >> >> Is there a reason to avoid the 32-bit memory range for the ELF addresses? > > I think you are right. Hmm, I think I was going by my particular use > case which might not be required for generic PPC platforms. > > I have one doubt though - I have primarily worked on arm64 and x86 > architectures and there I see there 64-bit user space applications > using the 64-bit load addresses/ranges. I am not sure why PPC64 is > different historically. x86's ELF_ET_DYN_BASE is (TASK_SIZE / 3 * 2), so it puts it ET_DYN base at the top third of the address space. (In theory, this is to avoid interpreter collisions, but I'm working on removing that restriction, as it seems pointless.) Other architectures have small ELF_ET_DYN_BASEs, which is good: it allows them to have larger entropy for ET_DYN. -Kees -- Kees Cook Pixel Security