From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750798AbdE1AnI (ORCPT ); Sat, 27 May 2017 20:43:08 -0400 Received: from mail-io0-f175.google.com ([209.85.223.175]:36336 "EHLO mail-io0-f175.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750769AbdE1AnE (ORCPT ); Sat, 27 May 2017 20:43:04 -0400 MIME-Version: 1.0 In-Reply-To: <201705280704.DHF73450.SJtVOFOOQHFLMF@I-love.SAKURA.ne.jp> References: <1495829844-69341-1-git-send-email-keescook@chromium.org> <1495829844-69341-6-git-send-email-keescook@chromium.org> <20170527084135.GA26844@infradead.org> <201705280704.DHF73450.SJtVOFOOQHFLMF@I-love.SAKURA.ne.jp> From: Kees Cook Date: Sat, 27 May 2017 17:43:02 -0700 X-Google-Sender-Auth: ATtcPyliC-huRyg3Dho8fNRgHy0 Message-ID: Subject: Re: [kernel-hardening] Re: [PATCH v2 05/20] randstruct: Whitelist struct security_hook_heads cast To: Tetsuo Handa Cc: Christoph Hellwig , "kernel-hardening@lists.openwall.com" , James Morris , Laura Abbott , "x86@kernel.org" , LKML , linux-security-module Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sat, May 27, 2017 at 3:04 PM, Tetsuo Handa wrote: > Kees Cook wrote: >> On Sat, May 27, 2017 at 1:41 AM, Christoph Hellwig wrote: >> > On Fri, May 26, 2017 at 01:17:09PM -0700, Kees Cook wrote: >> >> The LSM initialization routines walk security_hook_heads as an array >> >> of struct list_head instead of via names to avoid a ton of needless >> >> source. Whitelist this to avoid the false positive warning from the >> >> plugin: >> > >> > I think this crap just needs to be fixed properly. If not it almost >> > defeats the protections as the "security" ops are just about everywhere. >> >> There's nothing unsafe about 3dfc9b02864b19f4dab376f14479ee4ad1de6c9e, >> it just avoids tons of needless code. Tetsuo has some other ideas for >> cleaning it up further, but I don't like it because it removes >> compile-time verification of function types. > > Excuse me, but why you think that compile-time verification of function > types is removed? > > - { .head = &security_hook_heads.HEAD, .hook = { .HEAD = HOOK } } > + { .idx = LSM_##HEAD, .hook = { .HEAD = HOOK } } > > This change removes dependency on absolute address of security_hook_heads > being known at compile-time. If function types of .hook.HEAD and HOOK > mismatches, the compiler can still warn it. Sorry, misremembered, that was the other patch. I'll go review this current one... -Kees -- Kees Cook Pixel Security