Date: Tue, 10 Nov 2015 11:47:47 +0100 From: Marcus Meissner <meissner@...e.de> To: kernel-hardening@...ts.openwall.com Cc: Matthew Garrett <mjg59@...f.ucam.org>, Theodore Tso <tytso@...gle.com>, Emese Revfy <re.emese@...il.com>, Kees Cook <keescook@...omium.org>, PaX Team <pageexec@...email.hu>, Brad Spengler <spender@...ecurity.net>, Greg KH <gregkh@...uxfoundation.org>, Josh Triplett <josh@...htriplett.org> Subject: Re: Re: Proposal for kernel self protection features On Tue, Nov 10, 2015 at 11:42:31AM +0100, Yves-Alexis Perez wrote: > On lun., 2015-11-09 at 21:13 +0000, Matthew Garrett wrote: > > On Mon, Nov 09, 2015 at 09:09:22PM +0000, Jason Cooper wrote: > > > > > Well, That's why I referred to reading from /boot or from a flash > > > partition. Existing bootloaders in the field already have that > > > capability. That's how they load the kernel. > > > > This doesn't really handle cases like network booting. Most SoCs have > > some kind of RNG, recent x86 has hardware RNG, older x86 frequently has > > an RNG in a TPM. Pulling an entropy seed from the filesystem is a > > reasonable fallback, but we should definitely be thinking of it as a > > fallback - someone with physical access to your system while it's turned > > off may be able to infer the ASLR state for your next boot, for > > instance. > > About the TPM RNG: I was definitely interested in the “get entropy from > TPM” kind of thing for my laptop (even though I think my laptop would > not be the worst place to find entropy). Right now I'm using rng-tools > to read from /dev/hwrng (handled by tpm_rng module), which then feeds > entropy to /dev/random (or maybe directly using the RND ioctls). > > Do you think bypassing userland completely in order to be able to feed > that entropy even before userland is completely initialized would be > helpful? The kernel has infrastructure for this (feeding hardware random generators into the random pool) these days. e.g. drivers/char/hw_random/tpm-rng.c How "good" the generator is is determined by the "quality" member of the hwrng struct. (It seems only virtio-rng.c sets one, but more of them could be reviewed and used.) Ciao, Marcus
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.