[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 6 Apr 2018 21:01:02 +0300
From: Alexander Popov <alex.popov@...ux.com>
To: Kees Cook <keescook@...omium.org>
Cc: Kurt Seifried <kseifried@...hat.com>, oss-security@...ts.openwall.com,
James Morris <jmorris@...ei.org>, "Serge E. Hallyn" <serge@...lyn.com>,
Brad Spengler <spender@...ecurity.net>, PaX Team <pageexec@...email.hu>,
"Reshetova, Elena" <elena.reshetova@...el.com>
Subject: Re: Linux Kernel Defence Map
On 06.04.2018 02:55, Kees Cook wrote:
> On Thu, Apr 5, 2018 at 4:38 PM, Alexander Popov <alex.popov@...ux.com> wrote:
>> On 05.04.2018 22:20, Kees Cook wrote:
>>> Very cool! Maybe also add an out-of-tree bubble for "Clang CFI", which
>>> gives forward-edge protection for code-reuse...
>>
>> Ok. Created a CFI cluster with RAP and Clang CFI inside.
>
> Well, naming can get confusing here. RAP got renamed along the way to
> include both "Return Address Protection" (backward edge) and "Indirect
> Control Transfer Protection" (forward edge). Clang CFI is forward edge
> only, though things like shadow stacks or pointer authentication can
> provide backward edge protection.
Thanks for the details.
> So... I'm not sure how much detail
> you want to capture in the bubbles. :)
I'd like to avoid showing comparisons between security features on that map.
That would make it much more complicated (and trigger holy wars).
This map is just for the navigation in the documentation.
>> However, I didn't manage to find any materials about applying Clang CFI to the
>> Linux kernel.
>
> Here's Sami Tolvanen's work on doing Clang CFI (on top of Clang LTO):
> https://android-review.googlesource.com/q/topic:android-4.9-cfi
Cool, thanks!
--
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
