Date: Tue, 29 Mar 2016 16:05:07 -0700 From: Andy Lutomirski <luto@...capital.net> To: Linus Torvalds <torvalds@...ux-foundation.org> Cc: Scott Bauer <sbauer@....utah.edu>, Linux Kernel Mailing List <linux-kernel@...r.kernel.org>, "kernel-hardening@...ts.openwall.com" <kernel-hardening@...ts.openwall.com>, "the arch/x86 maintainers" <x86@...nel.org>, Andi Kleen <ak@...ux.intel.com>, Ingo Molnar <mingo@...hat.com>, Thomas Gleixner <tglx@...utronix.de>, wmealing@...hat.com Subject: Re: [PATCH v4 0/4] SROP Mitigation: Sigreturn Cookies On Tue, Mar 29, 2016 at 3:54 PM, Linus Torvalds <torvalds@...ux-foundation.org> wrote: > On Tue, Mar 29, 2016 at 2:53 PM, Scott Bauer <sbauer@....utah.edu> wrote: >> >> These patches implement the necessary changes to generate a cookie >> which will be placed above signal frame upon signal delivery to userland. >> The cookie is generated using a per-process random value xor'd with >> the address where the cookie will be stored on the stack. > > I realize that this would likely need to be a separate and non-default > extra hardening mode, because there are *definitely* applications that > take signals and then update the return address (maybe single-stepping > over instructions etc). But for a *lot* of applications, signal return > implies changing no signal state at all, and mixing in the returning > IP and SP would seem to be a fundamentally stronger cookie. Like selftests/x86? :) If we wanted to increase confidence that this wouldn't break existing applications, I've been thinking about adding an extensible bit mask of backwards compatibility breaks that an and/or libc is okay with. One of these would be "I don't use vsyscalls", in which case the vsyscall page would be unmapped entirely. Another could be "sigcontext cookies are okay". These could potentially be programmed by syscall and/or ELF notes. --Andy
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.