[<prev] [next>] [day] [month] [year] [list]
Message-ID: <99FC4B6EFCEFD44486C35F4C281DC6731F2182A2@ORSMSX107.amr.corp.intel.com>
Date: Fri, 19 Feb 2016 00:36:48 +0000
From: "Schaufler, Casey" <casey.schaufler@...el.com>
To: "kernel-hardening@...ts.openwall.com"
<kernel-hardening@...ts.openwall.com>
CC: Kees Cook <keescook@...omium.org>
Subject: RE: Still working on PAX_USERCOPY
On 1/19/2016 3:59 PM, Kees Cook wrote:
> On Thu, Jan 14, 2016 at 5:43 PM, Schaufler, Casey
> <casey.schaufler@...el.com<mailto:casey.schaufler@...el.com>> wrote:
>> Just a brief status update on my work on PAX_USERCOPY. I've ditched my first
>> two attempts at doing somewhat simple minded cut'n'patch and am going to
>> have to take a more engineering (e.g. understanding what's really going on)
>> approach. The good news is that I've made enough mistakes to think there
>> aren't that many left for a project this size.
> Thanks for the report! Were you able to use or improve on the
> lib/test_user_copy.c tests during your experiments? (Or maybe we just
> need a separate lkdtm test?)
No, but hopefully before too long ...
> What kinds of dead-ends did you run into?
There are a few things that are "obvious", the GFP_USERCOPY
and CONFIG_PAX_USERCOPY (duh?) bits being the most so. And
yet, they turn out not to be so obvious. Much of what's under
ifdef isn't actually part of the feature, it's special cases
in other PAX features. PAX_USERCOPY appears to have come along
fairly late in the PAX feature set, and counts on a bunch of
previously implemented facilities. There are chunks of stack
management, for example, that (I think) have to be included.
It's not enough to understand PAX_USERCOPY. You really have
to understand all of the PAX and grsecurity memory management
changes to come up with something that works. That's what I'm
working on now, and while there's progress, it's a slog.
I'm embarking on what Intel calls a "mini-sabbatical", which
will take me away from my keyboard for 4 weeks. When I return
I plan to pick up where I left off. Hopefully with fresher and
better rested eyes.
> -Kees
>
Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
