Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 19 Feb 2016 00:36:48 +0000
From: "Schaufler, Casey" <casey.schaufler@...el.com>
To: "kernel-hardening@...ts.openwall.com"
	<kernel-hardening@...ts.openwall.com>
CC: Kees Cook <keescook@...omium.org>
Subject: RE: Still working on PAX_USERCOPY

On 1/19/2016 3:59 PM, Kees Cook wrote:

> On Thu, Jan 14, 2016 at 5:43 PM, Schaufler, Casey

> <casey.schaufler@...el.com<mailto:casey.schaufler@...el.com>> wrote:

>> Just a brief status update on my work on PAX_USERCOPY. I've ditched my first

>> two attempts at doing somewhat simple minded cut'n'patch and am going to

>> have to take a more engineering (e.g. understanding what's really going on)

>> approach. The good news is that I've made enough mistakes to think there

>> aren't that many left for a project this size.

> Thanks for the report! Were you able to use or improve on the

> lib/test_user_copy.c tests during your experiments? (Or maybe we just

> need a separate lkdtm test?)



No, but hopefully before too long ...



> What kinds of dead-ends did you run into?



There are a few things that are "obvious", the GFP_USERCOPY

and CONFIG_PAX_USERCOPY (duh?) bits being the most so. And

yet, they turn out not to be so obvious. Much of what's under

ifdef isn't actually part of the feature, it's special cases

in other PAX features. PAX_USERCOPY appears to have come along

fairly late in the PAX feature set, and counts on a bunch of

previously implemented facilities. There are chunks of stack

management, for example, that (I think) have to be included.



It's not enough to understand PAX_USERCOPY. You really have

to understand all of the PAX and grsecurity memory management

changes to come up with something that works. That's what I'm

working on now, and while there's progress, it's a slog.



I'm embarking on what Intel calls a "mini-sabbatical", which

will take me away from my keyboard for 4 weeks. When I return

I plan to pick up where I left off. Hopefully with fresher and

better rested eyes.



> -Kees

>



Content of type "text/html" skipped

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.