[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20110816090540.GA7857@albatros>
Date: Tue, 16 Aug 2011 13:05:40 +0400
From: Vasiliy Kulikov <segoon@...nwall.com>
To: "H. Peter Anvin" <hpa@...or.com>
Cc: Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>,
kernel-hardening@...ts.openwall.com,
Peter Zijlstra <peterz@...radead.org>,
Andrew Morton <akpm@...ux-foundation.org>, x86@...nel.org,
linux-kernel@...r.kernel.org, linux-mm@...ck.org
Subject: Re: [RFC] x86, mm: start mmap allocation for libs from low
addresses
On Fri, Aug 12, 2011 at 18:19 -0500, H. Peter Anvin wrote:
> Vasiliy Kulikov <segoon@...nwall.com> wrote:
>
> >This patch changes mmap base address allocator logic to incline to
> >allocate addresses from the first 16 Mbs of address space. These
> >addresses start from zero byte (0x00AABBCC).
...
To make it clear:
The VM space is not significantly reduced - an additional gap, which
is used for ASCII-protected region, is calculated the same way as the
common mmap gap is calculated. The maximum size of the gap is 1MB for
the upstream kernel default ASLR entropy - a trifle IMO.
If the new allocator fails to find appropriate vma in the protected
zone, the old one tries to do the job. So, no visible changes for
userspace.
As to the benefit:
1) For small PIE programs, which don't use much libraries, all
executable regions are moved to the protected zone.
2) For non-PIE programs if image starts from 0x00AABBCC address and fits
into the zone the same rule of small libs applies.
3) For non-PIE programs with images above 0x01000000 and/or programs
with much libraries some code sections are outsize of the protected region.
The protection works for (1) and (2) programs. It doesn't work for (3).
(1) is not too seldom. Programs, which need such protection (network
daemons, programs parsing untrusted input, etc.), are usually small
enough. In our distro, Openwall GNU/*/Linux, almost all daemon programs
fit into the region.
As the changes are not intrusive, we'd want to see this feature in the
upstream kernel. If you know why the patch cannot be a part of the
upstream kernel - please tell me, I'll try to address the issues.
Thanks,
--
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
