[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 7 Dec 2016 13:09:09 -0800
From: Kees Cook <keescook@...omium.org>
To: "kernel-hardening@...ts.openwall.com" <kernel-hardening@...ts.openwall.com>
Subject: Re: Regarding PaX
On Tue, Dec 6, 2016 at 11:46 PM, manjunatha srinivasan
<manjunathan.n@...il.com> wrote:
> Hi
Hi!
>
> I am new to PaX.
>
> I have plan to port only PaX (i.e mutual exclusive write/execute
> pages) for latest kernel (kernel.org) for x86_64 architectures. From
> other place I found patch from
> (https://git.m-privacy.de/linux-mprivacy-4.1.git) from branch
> 'paxonly' for 4.1 kernel. From the commit ID
> 9474667100c85c944a0d71ede82ef85e3ab502dc (123248 lines).
> In other place from https://grsecurity.net/download.php, I can see the
> patch 'grsecurity-3.1-4.8.12-201612062306.patch' .
>
> I don't' know where to start from these places. Please let me know
> about information on internals i.e. about code implementation and
> related documents of PaX ( i.e. mutual exclusive write/execute
> pages.).
PaX collects a lot of features. It sounds like you're interested only
in the W^X mmap/mprotect/etc feature?
> Also if want to do of porting PaX (i.e mutual exclusive write/execute
> pages) from scratch where can I find internals of it. Is that
> information from https://pax.grsecurity.net/ is enough idea for kick
> start.
> Please let me know the prerequisite knowledge on Linux subsystem like
> memory management before starting.
I would generally recommend reading the code to understand what's
happening. Other folks on the list may have better pointers for where
to learn about Linux mm, but it's a pretty complex area of the kernel.
For the first step, I'd recommend writing tests that currently fail
against the upstream kernel, then extract the pieces from PaX that
cover the feature you're interested in, and make sure your tests then
pass. From there, cutting up the patches into logically distinct
pieces would be next, which would be followed by upstream review (and
likely a few rounds of adjustments to the patches), and hopefully
finally getting them accept.
> Please let me know any openwall git repository is available.
Openwall just hosts this mailing list.
> If you feel this not the correct place of asking, please advice where
> should I post.
This is the right place to discuss development and porting of security
features for the upstream Linux kernel.
Thanks for the interest!
-Kees
--
Kees Cook
Nexus Security
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
