[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 6 Apr 2016 15:16:16 -0700
From: Kees Cook <keescook@...omium.org>
To: "Rafael J. Wysocki" <rafael@...nel.org>
Cc: Ingo Molnar <mingo@...nel.org>, Linus Torvalds <torvalds@...ux-foundation.org>,
Ard Biesheuvel <ard.biesheuvel@...aro.org>, Matt Redfearn <matt.redfearn@...tec.com>,
Yves-Alexis Perez <corsac@...ian.org>, Emrah Demir <ed@...sec.com>, Jonathan Corbet <corbet@....net>,
"x86@...nel.org" <x86@...nel.org>, "Rafael J. Wysocki" <rjw@...ysocki.net>, Len Brown <len.brown@...el.com>,
Pavel Machek <pavel@....cz>, Borislav Petkov <bp@...e.de>, Andy Lutomirski <luto@...nel.org>,
"open list:DOCUMENTATION" <linux-doc@...r.kernel.org>,
"linux-pm@...r.kernel.org" <linux-pm@...r.kernel.org>,
Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
"kernel-hardening@...ts.openwall.com" <kernel-hardening@...ts.openwall.com>
Subject: Re: [PATCH] Prefer kASLR over Hibernation
On Wed, Apr 6, 2016 at 3:04 PM, Rafael J. Wysocki <rafael@...nel.org> wrote:
> On Wed, Apr 6, 2016 at 11:56 PM, Ingo Molnar <mingo@...nel.org> wrote:
>>
>> * Rafael J. Wysocki <rafael@...nel.org> wrote:
>>
>>> On Wed, Apr 6, 2016 at 9:44 PM, Kees Cook <keescook@...omium.org> wrote:
>>> > When building with both CONFIG_HIBERNATION and CONFIG_RANDOMIZE_BASE,
>>> > one or the other must be chosen at boot-time. Until now, hibernation
>>> > was selected when no choice was made on the command line.
>>> >
>>> > To make the security benefits of kASLR more widely available to end
>>> > users (since the use of hibernation is becoming more rare and kASLR,
>>> > already available on x86, will be available on arm64 and MIPS soon),
>>> > this changes the default to preferring kASLR over hibernation. Users
>>> > wanting hibernation can turn off kASLR by adding "nokaslr" to the kernel
>>> > command line.
>>> >
>>> > Suggested-by: Linus Torvalds <torvalds@...ux-foundation.org>
>>> > Signed-off-by: Kees Cook <keescook@...omium.org>
>>>
>>> Acked-by: Rafael J. Wysocki <rafael.j.wysocki@...el.com>
>>>
>>> Or do you want me to apply it?
>>
>> I don't think this is a good idea, as it turns off emergency hibernation of
>> laptops - many desktop distros support it by default.
>
> Right, I forgot about this one.
When I last checked Ubuntu doesn't enable hibernation by default any more:
https://help.ubuntu.com/16.04/ubuntu-help/power-hibernate.html
And it seems like Fedora either doesn't either, or has a lot of people
for whom it doesn't work:
https://bugzilla.redhat.com/show_bug.cgi?id=1206936
https://bugzilla.redhat.com/show_bug.cgi?id=1224151
http://blog.kriptonium.com/2015/12/fedora-23-hibernate.html
-Kees
--
Kees Cook
Chrome OS & Brillo Security
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
