[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20160623201911.GO9922@io.lakedaemon.net>
Date: Thu, 23 Jun 2016 20:19:11 +0000
From: Jason Cooper <jason@...edaemon.net>
To: kernel-hardening@...ts.openwall.com
Cc: Sandy Harris <sandyinchina@...il.com>,
Thomas Garnier <thgarnie@...gle.com>,
Ingo Molnar <mingo@...nel.org>, Andy Lutomirski <luto@...nel.org>,
"x86@...nel.org" <x86@...nel.org>, Borislav Petkov <bp@...e.de>,
Baoquan He <bhe@...hat.com>, Yinghai Lu <yinghai@...nel.org>,
Juergen Gross <jgross@...e.com>,
Matt Fleming <matt@...eblueprint.co.uk>,
Toshi Kani <toshi.kani@....com>,
Andrew Morton <akpm@...ux-foundation.org>,
Dan Williams <dan.j.williams@...el.com>,
"Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
Dave Hansen <dave.hansen@...ux.intel.com>,
Xiao Guangrong <guangrong.xiao@...ux.intel.com>,
Martin Schwidefsky <schwidefsky@...ibm.com>,
"Aneesh Kumar K.V" <aneesh.kumar@...ux.vnet.ibm.com>,
Alexander Kuleshov <kuleshovmail@...il.com>,
Alexander Popov <alpopov@...ecurity.com>,
Dave Young <dyoung@...hat.com>, Joerg Roedel <jroedel@...e.de>,
Lv Zheng <lv.zheng@...el.com>, Mark Salter <msalter@...hat.com>,
Dmitry Vyukov <dvyukov@...gle.com>,
Stephen Smalley <sds@...ho.nsa.gov>,
Boris Ostrovsky <boris.ostrovsky@...cle.com>,
Christian Borntraeger <borntraeger@...ibm.com>,
Jan Beulich <JBeulich@...e.com>,
LKML <linux-kernel@...r.kernel.org>,
Jonathan Corbet <corbet@....net>,
"linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>
Subject: Re: [PATCH v7 0/9] x86/mm: memory area address
KASLR
On Thu, Jun 23, 2016 at 12:59:07PM -0700, Kees Cook wrote:
> On Thu, Jun 23, 2016 at 12:45 PM, Sandy Harris <sandyinchina@...il.com> wrote:
> > Jason Cooper <jason@...edaemon.net> wrote:
> >
> >> Modern systems that receive a seed from the bootloader via the
> >> random-seed property (typically from the hw-rng) can mix both sources
> >> for increased resilience.
> >>
> >> Unfortunately, I'm not very familiar with the internals of x86
> >> bootstrapping. Could GRUB be scripted to do a similar task? How would
> >> the address and size of the seed be passed to the kernel? command line?
> >
> > One suggestion is at:
> > http://www.av8n.com/computer/htm/secure-random.htm#sec-boot-image
>
> Interesting! This might pose a problem for signed images, though.
> (Actually, for signed arm kernels is the DT signed too? If so, it
> would be a similar problem.)
That's the reason for userspace,random-seed = <address, size>. Once
set, the dtb never has to change. The bootloader loads the file to the
same address at each boot. Userspace is responsible, as it is already,
for updating the random-seed file while up.
thx,
Jason.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
