[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAGXu5jKqptmWwAgsDNtTRzN-r_JYBtVoNaPbpwN+_stfY4yrQA@mail.gmail.com>
Date: Tue, 2 May 2017 11:55:11 -0700
From: Kees Cook <keescook@...omium.org>
To: Shawn <citypw@...il.com>
Cc: Rik van Riel <riel@...hat.com>, Mathias Krause <minipli@...glemail.com>,
Daniel Cegiełka <daniel.cegielka@...il.com>,
"kernel-hardening@...ts.openwall.com" <kernel-hardening@...ts.openwall.com>
Subject: Re: It looks like there will be no more public
versions of PaX and Grsec.
On Tue, May 2, 2017 at 7:46 AM, Shawn <citypw@...il.com> wrote:
> On Tue, May 2, 2017 at 8:09 AM, Rik van Riel <riel@...hat.com> wrote:
>> On Tue, 2017-05-02 at 00:01 +0200, Mathias Krause wrote:
>>
>>> I think the intention of the KSPP is good -- making vanilla Linux
>>> more
>>> secure. But the way it does its work harms overall Linux security. It
>>> does hurt mine, that's for sure!
>>
>> Yeah, no. The grsecurity people produced patches
>> that were used on maybe a few tens of thousands
>> of systems, while the KSPP code will end up
>> enhancing the security of over a billion Android
>> devices.
>>
> Are you serious think KSPP can solve Android security issue without
> changing the current Android eco-system? It's about one billion
> Android device( most are old armv7 based) can be exploited and being
> used by criminal and BIGBROs( NSA/CIA/PLA/whatever-A*/etc) with low
> cost. I made hardened PoC( based on PaX + PXN + some code hardening)
> for Nexus 7 2013 back in 2015. It proved that it can defeat "massive"
> exp without much perf impact. But I don't see any sign those cellphone
> vendors would port any KSPP features into the old devices. How about
> new phone? I ported a couple of KSPP features( all originally done or
> inspired by PaX/Grsecurity) to Pixel XL:
>
> https://github.com/hardenedlinux/armv7-nexus7-grsec
I would love it if things would get rolled out to older phones. This
isn't something upstream has much influence over, though. But we have
to look to the future. Eventually all the old phones will get
replaced, and the new ones will be running newer kernels, etc.
The problem with the phone (and IoT) ecosystem is an entirely separate
problem. There are some folks chipping away at it, but it's tangential
to upstream gaining more defenses. I'd also note that this problem
isn't solved by grsecurity either --- how many phones are running the
grsecurity patch?
> Google's Pixel/Pixel2 may be the one of few cellphones can getting
> benefit from KSPP. Otherwise, my own phone is running with much more
> hardening features than Android O( released in Oct?) but it's still
> not secure enough to defeat customized exploit.
>
>> Those Android devices are more likely to require
>> hardening, too, since they do not receive security
>> updates as quickly as the systems maintained by
>> grsecurity users.
>>
> Don't worry about it. PaX/Grsecurity can defeat multiple public
> exploits without any fix. Maybe some ppl will go to maintain 4.9 LTS.
This is kind of true. RAP was x86_64 only, so it didn't help armv7 nor
arm64. Hardened usercopy wasn't ported by grsecurity to arm64
(upstream did that, though it was trivial). UDEREF wasn't ported by
grsecurity to arm64, ARM filled that gap by inventing the mechanisms
to provide PAN emulation. There are all kinds of other protections
aren't arch-specific (e.g. heap hardening). Those would make good
things to focus on upstreaming if you were interested. CopperheadOS is
using a bunch of those things already:
https://github.com/CopperheadOS/kernel_google_marlin/commits/nougat-mr2-release
So really, upstreaming defenses has really helped the future phone
ecosystem, even if the "don't update old devices" attitude continues
to not change with vendors.
-Kees
--
Kees Cook
Pixel Security
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
