[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAEXv5_gWyktN2UhAkkUnPJpj4g5bWV0Jnn2GOeBcgh7f6_+BHg@mail.gmail.com>
Date: Thu, 17 Dec 2015 21:59:50 -0500
From: David Windsor <dave@...gbits.org>
To: kernel-hardening@...ts.openwall.com
Cc: greg@...ah.com
Subject: Re: [RFC PATCH v2 01/12] x86: add PAX_REFCOUNT support
On Thu, Dec 17, 2015 at 1:11 PM, Greg KH <greg@...ah.com> wrote:
> On Thu, Dec 17, 2015 at 12:55:44PM -0500, David Windsor wrote:
>> On Thu, Dec 17, 2015 at 12:16 PM, Greg KH <gregkh@...uxfoundation.org> wrote:
>> > On Thu, Dec 17, 2015 at 09:57:39AM -0500, David Windsor wrote:
>> >> --- a/include/linux/sched.h
>> >> +++ b/include/linux/sched.h
>> >> @@ -749,6 +749,17 @@ struct signal_struct {
>> >> #ifdef CONFIG_TASKSTATS
>> >> struct taskstats *stats;
>> >> #endif
>> >> +
>> >> +#ifdef CONFIG_GRKERNSEC
>> >> + u32 curr_ip;
>> >> + u32 saved_ip;
>> >> + u32 gr_saddr;
>> >> + u32 gr_daddr;
>> >> + u16 gr_sport;
>> >> + u16 gr_dport;
>> >> + u8 used_accept:1;
>> >> +#endif
>> >> +
>> >
>> > Why is this here in this patch?
>> >
>>
>> For pax_report_refcount_overflow in fs/exec.c:
>>
>> 1754: if (current->signal->curr_ip)
>>
>> This is guarded by CONFIG_PAX_REFCOUNT, which, as it stands, should
>> depend on CONFIG_GRKERNSEC. The Kconfig options likely need to
>> change, depending on the naming of these features moving forward.
>
> But that has nothing to do with this patch, and as that config option
> isn't present in the kernel at this point in time, this change is not
> needed at all, right?
>
> Or am I missing something?
>
Actually, there is a PaX-only version of pax_report_refcount_overflow
[1] that doesn't include instruction pointer tracking, which is a
grsecurity feature (thanks minipli), and the reason why this piece was
pulled into my patch.
I'll update this to use the PaX-only version. If the relevant portion
of grsecurity ends up getting pulled in as well, we'll return to the
version originally posted here.
Thanks,
David
[1] https://github.com/minipli/linux-grsec/blob/v4.3.3-pax/fs/exec.c#L1936-L1947
> thanks,
>
> greg k-h
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
