kernel-hardening - Re: [PATCH v7 0/9] x86/mm: memory area address KASLR

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 22 Jun 2016 08:59:48 -0700
From: Thomas Garnier <thgarnie@...gle.com>
To: Jason Cooper <jason@...edaemon.net>
Cc: kernel-hardening@...ts.openwall.com, Ingo Molnar <mingo@...nel.org>, 
	Kees Cook <keescook@...omium.org>, Andy Lutomirski <luto@...nel.org>, x86@...nel.org, 
	Borislav Petkov <bp@...e.de>, Baoquan He <bhe@...hat.com>, Yinghai Lu <yinghai@...nel.org>, 
	Juergen Gross <jgross@...e.com>, Matt Fleming <matt@...eblueprint.co.uk>, 
	Toshi Kani <toshi.kani@....com>, Andrew Morton <akpm@...ux-foundation.org>, 
	Dan Williams <dan.j.williams@...el.com>, 
	"Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>, Dave Hansen <dave.hansen@...ux.intel.com>, 
	Xiao Guangrong <guangrong.xiao@...ux.intel.com>, 
	Martin Schwidefsky <schwidefsky@...ibm.com>, 
	"Aneesh Kumar K.V" <aneesh.kumar@...ux.vnet.ibm.com>, 
	Alexander Kuleshov <kuleshovmail@...il.com>, Alexander Popov <alpopov@...ecurity.com>, 
	Dave Young <dyoung@...hat.com>, Joerg Roedel <jroedel@...e.de>, Lv Zheng <lv.zheng@...el.com>, 
	Mark Salter <msalter@...hat.com>, Dmitry Vyukov <dvyukov@...gle.com>, 
	Stephen Smalley <sds@...ho.nsa.gov>, Boris Ostrovsky <boris.ostrovsky@...cle.com>, 
	Christian Borntraeger <borntraeger@...ibm.com>, Jan Beulich <JBeulich@...e.com>, 
	LKML <linux-kernel@...r.kernel.org>, Jonathan Corbet <corbet@....net>, linux-doc@...r.kernel.org
Subject: Re: [PATCH v7 0/9] x86/mm: memory area address KASLR

On Wed, Jun 22, 2016 at 5:47 AM, Jason Cooper <jason@...edaemon.net> wrote:
> Hey Kees,
>
> On Tue, Jun 21, 2016 at 05:46:57PM -0700, Kees Cook wrote:
>> Notable problems that needed solving:
> ...
>>  - Reasonable entropy is needed early at boot before get_random_bytes()
>>    is available.
>
> This series is targetting x86, which typically has RDRAND/RDSEED
> instructions.  Are you referring to other arches?  Older x86?  Also,
> isn't this the same requirement for base address KASLR?
>
> Don't get me wrong, I want more diverse entropy sources available
> earlier in the boot process as well. :-)  I'm just wondering what's
> different about this series vs base address KASLR wrt early entropy
> sources.
>

I think Kees was referring to the refactor I did to get the similar
entropy generation than KASLR module randomization. Our approach was
to provide best entropy possible even if you have an older processor
or under virtualization without support for these instructions.
Unfortunately common on companies with a large number of older
machines.

> thx,
>
> Jason.

Thanks,
Thomas

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.