kernel-hardening - Re: [PATCH] Prefer kASLR over Hibernation

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 6 Apr 2016 23:56:38 +0200
From: Ingo Molnar <mingo@...nel.org>
To: "Rafael J. Wysocki" <rafael@...nel.org>
Cc: Kees Cook <keescook@...omium.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Ard Biesheuvel <ard.biesheuvel@...aro.org>,
	Matt Redfearn <matt.redfearn@...tec.com>,
	Yves-Alexis Perez <corsac@...ian.org>, Emrah Demir <ed@...sec.com>,
	Jonathan Corbet <corbet@....net>, x86@...nel.org,
	"Rafael J. Wysocki" <rjw@...ysocki.net>,
	Len Brown <len.brown@...el.com>, Pavel Machek <pavel@....cz>,
	Borislav Petkov <bp@...e.de>, Andy Lutomirski <luto@...nel.org>,
	"open list:DOCUMENTATION" <linux-doc@...r.kernel.org>,
	"linux-pm@...r.kernel.org" <linux-pm@...r.kernel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	kernel-hardening@...ts.openwall.com
Subject: Re: [PATCH] Prefer kASLR over Hibernation


* Rafael J. Wysocki <rafael@...nel.org> wrote:

> On Wed, Apr 6, 2016 at 9:44 PM, Kees Cook <keescook@...omium.org> wrote:
> > When building with both CONFIG_HIBERNATION and CONFIG_RANDOMIZE_BASE,
> > one or the other must be chosen at boot-time. Until now, hibernation
> > was selected when no choice was made on the command line.
> >
> > To make the security benefits of kASLR more widely available to end
> > users (since the use of hibernation is becoming more rare and kASLR,
> > already available on x86, will be available on arm64 and MIPS soon),
> > this changes the default to preferring kASLR over hibernation. Users
> > wanting hibernation can turn off kASLR by adding "nokaslr" to the kernel
> > command line.
> >
> > Suggested-by: Linus Torvalds <torvalds@...ux-foundation.org>
> > Signed-off-by: Kees Cook <keescook@...omium.org>
> 
> Acked-by: Rafael J. Wysocki <rafael.j.wysocki@...el.com>
> 
> Or do you want me to apply it?

I don't think this is a good idea, as it turns off emergency hibernation of 
laptops - many desktop distros support it by default.

Thanks,

	Ingo

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.