From: Kees Cook <keescook@chromium.org> To: Rasmus Villemoes <linux@rasmusvillemoes.dk> Cc: kernel-hardening@lists.openwall.com, LKML <linux-kernel@vger.kernel.org>, Andrew Morton <akpm@linux-foundation.org> Subject: Re: [RFC 0/6] some compile- and run-time format checking Date: Wed, 8 Nov 2017 17:11:23 -0800 [thread overview] Message-ID: <CAGXu5jKnv_mP1hGEe5FbLV_mYknCknZJjo=-Po0mjnWJSV7+_Q@mail.gmail.com> (raw) In-Reply-To: <20171108223020.24487-1-linux@rasmusvillemoes.dk> On Wed, Nov 8, 2017 at 2:30 PM, Rasmus Villemoes <linux@rasmusvillemoes.dk> wrote: > Consider these strictly RFC/POC. > > I tried resurrecting my format_template plugin from two years ago, and > it rebased pretty cleanly. It also compiles with gcc 6.3, and has the > expected effect when one tries to trigger it, so it seems to work ok > (I think there was some build bot issue back then, maybe there still > is). > > The last four patches are something I threw together rather quickly. > They compile and the few test cases pass, but I obviously need to find > some places to actually use fmtcheck() to see if it's worth adding. > > Rasmus Villemoes (6): > plugins: implement format_template attribute > compiler.h: add __format_template Could you split these two off and send separately? This seems like a fine thing to get in now. Probably the second patch should be split up between adding __format_template, and additions of its usage. Do you have any good ways to find and extract all the dynamic format strings we need to mark? > compiler.h: add __attribute__((format_arg)) shorthand > lib/vsprintf.c: add fmtcheck utility > kernel.h: implement fmtmatch() wrapper around fmtcheck() > lib/test_printf.c: add a few fmtcheck() test cases I like this approach a lot. Combined with checking if a format string is in read-only memory, this could really close the door on format string exposures. Thanks! -Kees > > arch/Kconfig | 18 ++ > drivers/hwmon/applesmc.c | 2 +- > drivers/staging/speakup/spk_types.h | 2 +- > include/linux/compiler-gcc.h | 1 + > include/linux/compiler.h | 10 + > include/linux/kernel.h | 13 ++ > include/linux/smpboot.h | 2 +- > include/linux/usb.h | 2 +- > lib/test_printf.c | 41 ++++ > lib/vsprintf.c | 63 +++++ > scripts/Makefile.gcc-plugins | 2 + > scripts/gcc-plugins/format_template_plugin.c | 331 +++++++++++++++++++++++++++ > 12 files changed, 483 insertions(+), 4 deletions(-) > create mode 100644 scripts/gcc-plugins/format_template_plugin.c > > -- > 2.11.0 > -- Kees Cook Pixel Security
WARNING: multiple messages have this Message-ID (diff)
From: Kees Cook <keescook@chromium.org> To: Rasmus Villemoes <linux@rasmusvillemoes.dk> Cc: kernel-hardening@lists.openwall.com, LKML <linux-kernel@vger.kernel.org>, Andrew Morton <akpm@linux-foundation.org> Subject: [kernel-hardening] Re: [RFC 0/6] some compile- and run-time format checking Date: Wed, 8 Nov 2017 17:11:23 -0800 [thread overview] Message-ID: <CAGXu5jKnv_mP1hGEe5FbLV_mYknCknZJjo=-Po0mjnWJSV7+_Q@mail.gmail.com> (raw) In-Reply-To: <20171108223020.24487-1-linux@rasmusvillemoes.dk> On Wed, Nov 8, 2017 at 2:30 PM, Rasmus Villemoes <linux@rasmusvillemoes.dk> wrote: > Consider these strictly RFC/POC. > > I tried resurrecting my format_template plugin from two years ago, and > it rebased pretty cleanly. It also compiles with gcc 6.3, and has the > expected effect when one tries to trigger it, so it seems to work ok > (I think there was some build bot issue back then, maybe there still > is). > > The last four patches are something I threw together rather quickly. > They compile and the few test cases pass, but I obviously need to find > some places to actually use fmtcheck() to see if it's worth adding. > > Rasmus Villemoes (6): > plugins: implement format_template attribute > compiler.h: add __format_template Could you split these two off and send separately? This seems like a fine thing to get in now. Probably the second patch should be split up between adding __format_template, and additions of its usage. Do you have any good ways to find and extract all the dynamic format strings we need to mark? > compiler.h: add __attribute__((format_arg)) shorthand > lib/vsprintf.c: add fmtcheck utility > kernel.h: implement fmtmatch() wrapper around fmtcheck() > lib/test_printf.c: add a few fmtcheck() test cases I like this approach a lot. Combined with checking if a format string is in read-only memory, this could really close the door on format string exposures. Thanks! -Kees > > arch/Kconfig | 18 ++ > drivers/hwmon/applesmc.c | 2 +- > drivers/staging/speakup/spk_types.h | 2 +- > include/linux/compiler-gcc.h | 1 + > include/linux/compiler.h | 10 + > include/linux/kernel.h | 13 ++ > include/linux/smpboot.h | 2 +- > include/linux/usb.h | 2 +- > lib/test_printf.c | 41 ++++ > lib/vsprintf.c | 63 +++++ > scripts/Makefile.gcc-plugins | 2 + > scripts/gcc-plugins/format_template_plugin.c | 331 +++++++++++++++++++++++++++ > 12 files changed, 483 insertions(+), 4 deletions(-) > create mode 100644 scripts/gcc-plugins/format_template_plugin.c > > -- > 2.11.0 > -- Kees Cook Pixel Security
next prev parent reply other threads:[~2017-11-09 1:11 UTC|newest] Thread overview: 41+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-11-08 22:30 [RFC 0/6] some compile- and run-time format checking Rasmus Villemoes 2017-11-08 22:30 ` [kernel-hardening] " Rasmus Villemoes 2017-11-08 22:30 ` [RFC 1/6] plugins: implement format_template attribute Rasmus Villemoes 2017-11-08 22:30 ` [kernel-hardening] " Rasmus Villemoes 2017-11-08 22:30 ` [RFC 2/6] compiler.h: add __format_template Rasmus Villemoes 2017-11-08 22:30 ` [kernel-hardening] " Rasmus Villemoes 2017-11-08 22:30 ` [RFC 3/6] compiler.h: add __attribute__((format_arg)) shorthand Rasmus Villemoes 2017-11-08 22:30 ` [kernel-hardening] " Rasmus Villemoes 2017-11-08 22:30 ` [RFC 4/6] lib/vsprintf.c: add fmtcheck utility Rasmus Villemoes 2017-11-08 22:30 ` [kernel-hardening] " Rasmus Villemoes 2017-11-09 1:08 ` Kees Cook 2017-11-09 1:08 ` [kernel-hardening] " Kees Cook 2017-11-08 22:30 ` [RFC 5/6] kernel.h: implement fmtmatch() wrapper around fmtcheck() Rasmus Villemoes 2017-11-08 22:30 ` [kernel-hardening] " Rasmus Villemoes 2017-11-08 22:30 ` [RFC 6/6] lib/test_printf.c: add a few fmtcheck() test cases Rasmus Villemoes 2017-11-08 22:30 ` [kernel-hardening] " Rasmus Villemoes 2017-11-09 1:11 ` Kees Cook [this message] 2017-11-09 1:11 ` [kernel-hardening] Re: [RFC 0/6] some compile- and run-time format checking Kees Cook 2017-11-09 14:08 ` Rasmus Villemoes 2017-11-09 14:08 ` [kernel-hardening] " Rasmus Villemoes 2018-10-26 23:24 ` [RFC PATCH 0/7] runtime format string checking Rasmus Villemoes 2018-10-26 23:24 ` [RFC PATCH 1/7] compiler_attributes.h: add __attribute__((format_arg)) shorthand Rasmus Villemoes 2018-10-27 12:06 ` Miguel Ojeda 2018-10-29 10:20 ` Rasmus Villemoes 2018-10-29 19:17 ` Miguel Ojeda 2018-11-02 10:36 ` Miguel Ojeda 2018-11-02 10:43 ` Rasmus Villemoes 2019-01-09 10:57 ` Miguel Ojeda 2018-10-26 23:24 ` [RFC PATCH 2/7] lib/vsprintf.c: add fmtcheck utility Rasmus Villemoes 2018-10-26 23:24 ` [RFC PATCH 3/7] kernel.h: implement fmtmatch() wrapper around fmtcheck() Rasmus Villemoes 2018-10-26 23:24 ` [RFC PATCH 4/7] lib/test_printf.c: add a few fmtcheck() test cases Rasmus Villemoes 2018-10-26 23:24 ` [RFC PATCH 5/7] kernel/kthread.c: do runtime check of format string in kthread_create_on_cpu() Rasmus Villemoes 2018-10-26 23:24 ` [RFC PATCH 6/7] nfs: use fmtcheck() in root_nfs_data Rasmus Villemoes 2018-10-26 23:24 ` [RFC PATCH 7/7] drivers: hwmon: add runtime format string checking Rasmus Villemoes 2018-10-27 17:44 ` Guenter Roeck 2018-10-30 20:58 ` [RFC PATCH 0/7] " Kees Cook 2018-11-01 22:06 ` Rasmus Villemoes 2018-11-01 22:57 ` Kees Cook 2018-11-02 20:09 ` Rasmus Villemoes 2018-11-02 20:46 ` Kees Cook 2018-11-05 9:33 ` Rasmus Villemoes
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to='CAGXu5jKnv_mP1hGEe5FbLV_mYknCknZJjo=-Po0mjnWJSV7+_Q@mail.gmail.com' \ --to=keescook@chromium.org \ --cc=akpm@linux-foundation.org \ --cc=kernel-hardening@lists.openwall.com \ --cc=linux-kernel@vger.kernel.org \ --cc=linux@rasmusvillemoes.dk \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.