[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 10 Nov 2015 11:47:47 +0100
From: Marcus Meissner <meissner@...e.de>
To: kernel-hardening@...ts.openwall.com
Cc: Matthew Garrett <mjg59@...f.ucam.org>, Theodore Tso <tytso@...gle.com>,
Emese Revfy <re.emese@...il.com>, Kees Cook <keescook@...omium.org>,
PaX Team <pageexec@...email.hu>,
Brad Spengler <spender@...ecurity.net>,
Greg KH <gregkh@...uxfoundation.org>,
Josh Triplett <josh@...htriplett.org>
Subject: Re: Re: Proposal for kernel self protection
features
On Tue, Nov 10, 2015 at 11:42:31AM +0100, Yves-Alexis Perez wrote:
> On lun., 2015-11-09 at 21:13 +0000, Matthew Garrett wrote:
> > On Mon, Nov 09, 2015 at 09:09:22PM +0000, Jason Cooper wrote:
> >
> > > Well, That's why I referred to reading from /boot or from a flash
> > > partition. Existing bootloaders in the field already have that
> > > capability. That's how they load the kernel.
> >
> > This doesn't really handle cases like network booting. Most SoCs have
> > some kind of RNG, recent x86 has hardware RNG, older x86 frequently has
> > an RNG in a TPM. Pulling an entropy seed from the filesystem is a
> > reasonable fallback, but we should definitely be thinking of it as a
> > fallback - someone with physical access to your system while it's turned
> > off may be able to infer the ASLR state for your next boot, for
> > instance.
>
> About the TPM RNG: I was definitely interested in the “get entropy from
> TPM” kind of thing for my laptop (even though I think my laptop would
> not be the worst place to find entropy). Right now I'm using rng-tools
> to read from /dev/hwrng (handled by tpm_rng module), which then feeds
> entropy to /dev/random (or maybe directly using the RND ioctls).
>
> Do you think bypassing userland completely in order to be able to feed
> that entropy even before userland is completely initialized would be
> helpful?
The kernel has infrastructure for this (feeding hardware random generators
into the random pool) these days.
e.g.
drivers/char/hw_random/tpm-rng.c
How "good" the generator is is determined by the "quality" member of
the hwrng struct.
(It seems only virtio-rng.c sets one, but more of them could be reviewed
and used.)
Ciao, Marcus
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
