[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <87mvhks0vs.fsf@mid.deneb.enyo.de>
Date: Mon, 31 Oct 2016 21:45:59 +0100
From: Florian Weimer <fw@...eb.enyo.de>
To: Jann Horn <jann@...jh.net>
Cc: Kees Cook <keescook@...omium.org>, kernel-hardening@...ts.openwall.com, Andrew Morton <akpm@...ux-foundation.org>, Michal Hocko <mhocko@...e.com>, Ingo Molnar <mingo@...nel.org>, Andy Lutomirski <luto@...nel.org>, LKML <linux-kernel@...r.kernel.org>, Daniel Micay <danielmicay@...il.com>
Subject: Re: Re: [PATCH] fork: make whole stack_canary random
* Jann Horn:
> On Mon, Oct 31, 2016 at 09:04:02AM -0700, Kees Cook wrote:
>> On Mon, Oct 31, 2016 at 7:04 AM, Jann Horn <jann@...jh.net> wrote:
>> > On machines with sizeof(unsigned long)==8, this ensures that the more
>> > significant 32 bits of stack_canary are random, too.
>> > stack_canary is defined as unsigned long, all the architectures with stack
>> > protector support already pick the stack_canary of init as a random
>> > unsigned long, and get_random_long() should be as fast as get_random_int(),
>> > so there seems to be no good reason against this.
>> >
>> > This should help if someone tries to guess a stack canary with brute force.
>> >
>> > (This change has been made in PaX already, with a different RNG.)
>> >
>> > Signed-off-by: Jann Horn <jann@...jh.net>
>>
>> Acked-by: Kees Cook <keescook@...omium.org>
>>
>> (A separate change might be to make sure that the leading byte is
>> zeroed. Entropy of the value, I think, is less important than blocking
>> canary exposures from unbounded str* functions. Brute forcing kernel
>> stack canaries isn't like it bruting them in userspace...)
>
> Yeah, makes sense. Especially on 64bit, 56 bits of entropy ought to be
> enough anyway.
So you two approve of the way glibc does this currently? (See the
other thread.)
I was under the impression that the kernel performs far less
null-terminated string processing the average user space application,
especially on the stack. (A lot of userspace code assumes large
stacks and puts essentially arbitrarily long strings into VLAs.)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
