From: Kees Cook <keescook@chromium.org> To: Jann Horn <jann@thejh.net> Cc: Andrew Morton <akpm@linux-foundation.org>, Michal Hocko <mhocko@suse.com>, Ingo Molnar <mingo@kernel.org>, Andy Lutomirski <luto@kernel.org>, LKML <linux-kernel@vger.kernel.org>, "kernel-hardening@lists.openwall.com" <kernel-hardening@lists.openwall.com>, Daniel Micay <danielmicay@gmail.com> Subject: Re: [PATCH] fork: make whole stack_canary random Date: Mon, 31 Oct 2016 09:04:02 -0700 [thread overview] Message-ID: <CAGXu5j+Hz=AmmTAh3+QOv1wTG3HA60LPK0Dq6F8uybNQ5e+sHw@mail.gmail.com> (raw) In-Reply-To: <1477922641-2221-1-git-send-email-jann@thejh.net> On Mon, Oct 31, 2016 at 7:04 AM, Jann Horn <jann@thejh.net> wrote: > On machines with sizeof(unsigned long)==8, this ensures that the more > significant 32 bits of stack_canary are random, too. > stack_canary is defined as unsigned long, all the architectures with stack > protector support already pick the stack_canary of init as a random > unsigned long, and get_random_long() should be as fast as get_random_int(), > so there seems to be no good reason against this. > > This should help if someone tries to guess a stack canary with brute force. > > (This change has been made in PaX already, with a different RNG.) > > Signed-off-by: Jann Horn <jann@thejh.net> Acked-by: Kees Cook <keescook@chromium.org> (A separate change might be to make sure that the leading byte is zeroed. Entropy of the value, I think, is less important than blocking canary exposures from unbounded str* functions. Brute forcing kernel stack canaries isn't like it bruting them in userspace...) -Kees > --- > kernel/fork.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/kernel/fork.c b/kernel/fork.c > index 623259fc794d..d577e2c5d14f 100644 > --- a/kernel/fork.c > +++ b/kernel/fork.c > @@ -518,7 +518,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig, int node) > set_task_stack_end_magic(tsk); > > #ifdef CONFIG_CC_STACKPROTECTOR > - tsk->stack_canary = get_random_int(); > + tsk->stack_canary = get_random_long(); > #endif > > /* > -- > 2.1.4 > -- Kees Cook Nexus Security
WARNING: multiple messages have this Message-ID (diff)
From: Kees Cook <keescook@chromium.org> To: Jann Horn <jann@thejh.net> Cc: Andrew Morton <akpm@linux-foundation.org>, Michal Hocko <mhocko@suse.com>, Ingo Molnar <mingo@kernel.org>, Andy Lutomirski <luto@kernel.org>, LKML <linux-kernel@vger.kernel.org>, "kernel-hardening@lists.openwall.com" <kernel-hardening@lists.openwall.com>, Daniel Micay <danielmicay@gmail.com> Subject: [kernel-hardening] Re: [PATCH] fork: make whole stack_canary random Date: Mon, 31 Oct 2016 09:04:02 -0700 [thread overview] Message-ID: <CAGXu5j+Hz=AmmTAh3+QOv1wTG3HA60LPK0Dq6F8uybNQ5e+sHw@mail.gmail.com> (raw) In-Reply-To: <1477922641-2221-1-git-send-email-jann@thejh.net> On Mon, Oct 31, 2016 at 7:04 AM, Jann Horn <jann@thejh.net> wrote: > On machines with sizeof(unsigned long)==8, this ensures that the more > significant 32 bits of stack_canary are random, too. > stack_canary is defined as unsigned long, all the architectures with stack > protector support already pick the stack_canary of init as a random > unsigned long, and get_random_long() should be as fast as get_random_int(), > so there seems to be no good reason against this. > > This should help if someone tries to guess a stack canary with brute force. > > (This change has been made in PaX already, with a different RNG.) > > Signed-off-by: Jann Horn <jann@thejh.net> Acked-by: Kees Cook <keescook@chromium.org> (A separate change might be to make sure that the leading byte is zeroed. Entropy of the value, I think, is less important than blocking canary exposures from unbounded str* functions. Brute forcing kernel stack canaries isn't like it bruting them in userspace...) -Kees > --- > kernel/fork.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/kernel/fork.c b/kernel/fork.c > index 623259fc794d..d577e2c5d14f 100644 > --- a/kernel/fork.c > +++ b/kernel/fork.c > @@ -518,7 +518,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig, int node) > set_task_stack_end_magic(tsk); > > #ifdef CONFIG_CC_STACKPROTECTOR > - tsk->stack_canary = get_random_int(); > + tsk->stack_canary = get_random_long(); > #endif > > /* > -- > 2.1.4 > -- Kees Cook Nexus Security
next prev parent reply other threads:[~2016-10-31 16:04 UTC|newest] Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top 2016-10-31 14:04 [PATCH] fork: make whole stack_canary random Jann Horn 2016-10-31 14:04 ` [kernel-hardening] " Jann Horn 2016-10-31 16:04 ` Kees Cook [this message] 2016-10-31 16:04 ` [kernel-hardening] " Kees Cook 2016-10-31 16:29 ` Jann Horn 2016-10-31 16:29 ` Jann Horn 2016-10-31 20:45 ` Florian Weimer 2016-10-31 20:55 ` Jann Horn 2016-10-31 20:56 ` Daniel Micay 2016-10-31 21:01 ` Daniel Micay 2016-10-31 21:10 ` Florian Weimer 2016-10-31 21:21 ` Daniel Micay 2016-10-31 21:38 ` Florian Weimer 2016-10-31 22:02 ` Daniel Micay 2016-10-31 22:11 ` Florian Weimer 2016-10-31 21:22 ` Jann Horn 2016-10-31 21:26 ` Daniel Micay 2016-10-31 21:26 ` Florian Weimer
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to='CAGXu5j+Hz=AmmTAh3+QOv1wTG3HA60LPK0Dq6F8uybNQ5e+sHw@mail.gmail.com' \ --to=keescook@chromium.org \ --cc=akpm@linux-foundation.org \ --cc=danielmicay@gmail.com \ --cc=jann@thejh.net \ --cc=kernel-hardening@lists.openwall.com \ --cc=linux-kernel@vger.kernel.org \ --cc=luto@kernel.org \ --cc=mhocko@suse.com \ --cc=mingo@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.