![]() |
|
Message-Id: <1486014168-1279-1-git-send-email-bhsharma@redhat.com> Date: Thu, 2 Feb 2017 11:12:46 +0530 From: Bhupesh Sharma <bhsharma@...hat.com> To: linuxppc-dev@...ts.ozlabs.org, kernel-hardening@...ts.openwall.com Cc: dcashman@...gle.com, mpe@...erman.id.au, bhupesh.linux@...il.com, keescook@...omium.org, Bhupesh Sharma <bhsharma@...hat.com>, Alexander Graf <agraf@...e.com>, Benjamin Herrenschmidt <benh@...nel.crashing.org>, Paul Mackerras <paulus@...ba.org>, Anatolij Gustschin <agust@...x.de>, Alistair Popple <alistair@...ple.id.au>, Matt Porter <mporter@...nel.crashing.org>, Vitaly Bordug <vitb@...nel.crashing.org>, Scott Wood <oss@...error.net>, Kumar Gala <galak@...nel.crashing.org>, Daniel Cashman <dcashman@...roid.com> Subject: [PATCH 0/2] RFC: Adjust powerpc ASLR elf randomness This RFC patchset tries to make the powerpc ASLR elf randomness implementation similar to other ARCHs (like x86). The 1st patch introduces the support of ARCH_MMAP_RND_BITS in powerpc mmap implementation to allow a sane balance between increased randomness in the mmap address of ASLR elfs and increased address space fragmentation. The 2nd patch increases the ELF_ET_DYN_BASE value from the current hardcoded value of 0x2000_0000 to something more practical, i.e. TASK_SIZE - PAGE_SHIFT (which makes sense especially for 64-bit platforms which would like to utilize more randomization in the load address of a PIE elf). I have tested this patchset on 64-bit Fedora and RHEL7 machines/VMs. Here are the test results and details of the test environment: 1. Create a test PIE program which shows its own memory map: $ cat show_mmap_pie.c #include <stdlib.h> #include <stdio.h> int main(void){ char command[1024]; sprintf(command,"cat /proc/%d/maps",getpid()); system(command); return 0; } 2. Compile it as a PIE: $ gcc -o show_mmap_pie -fpie -pie show_mmap_pie.c 3. Before this patchset (on a Fedora-25 PPC64 POWER7 machine): # ./show_mmap_pie 33dd0000-33de0000 r-xp 00000000 fd:00 1724816 /root/git/linux/show_mmap_pie 33de0000-33df0000 r--p 00000000 fd:00 1724816 /root/git/linux/show_mmap_pie 33df0000-33e00000 rw-p 00010000 fd:00 1724816 /root/git/linux/show_mmap_pie 3fff9d750000-3fff9d940000 r-xp 00000000 fd:00 2753176 /usr/lib64/power7/libc-2.23.so 3fff9d940000-3fff9d950000 ---p 001f0000 fd:00 2753176 /usr/lib64/power7/libc-2.23.so 3fff9d950000-3fff9d960000 r--p 001f0000 fd:00 2753176 /usr/lib64/power7/libc-2.23.so 3fff9d960000-3fff9d970000 rw-p 00200000 fd:00 2753176 /usr/lib64/power7/libc-2.23.so 3fff9d980000-3fff9d9a0000 r-xp 00000000 00:00 0 [vdso] 3fff9d9a0000-3fff9d9e0000 r-xp 00000000 fd:00 2625136 /usr/lib64/ld-2.23.so 3fff9d9e0000-3fff9d9f0000 r--p 00030000 fd:00 2625136 /usr/lib64/ld-2.23.so 3fff9d9f0000-3fff9da00000 rw-p 00040000 fd:00 2625136 /usr/lib64/ld-2.23.so 3ffff5280000-3ffff52b0000 rw-p 00000000 00:00 0 [stack] As one can notice, the load address even for a 64-bit binary (show_mmap_pie), is within the 32-bit range. 4. After this patchset (on a Fedora-25 PPC64 POWER7 machine): # ./show_mmap_pie 3fffad250000-3fffad440000 r-xp 00000000 fd:00 2753176 /usr/lib64/power7/libc-2.23.so 3fffad440000-3fffad450000 ---p 001f0000 fd:00 2753176 /usr/lib64/power7/libc-2.23.so 3fffad450000-3fffad460000 r--p 001f0000 fd:00 2753176 /usr/lib64/power7/libc-2.23.so 3fffad460000-3fffad470000 rw-p 00200000 fd:00 2753176 /usr/lib64/power7/libc-2.23.so 3fffad480000-3fffad4a0000 r-xp 00000000 00:00 0 [vdso] 3fffad4a0000-3fffad4e0000 r-xp 00000000 fd:00 2625136 /usr/lib64/ld-2.23.so 3fffad4e0000-3fffad4f0000 r--p 00030000 fd:00 2625136 /usr/lib64/ld-2.23.so 3fffad4f0000-3fffad500000 rw-p 00040000 fd:00 2625136 /usr/lib64/ld-2.23.so 3fffad500000-3fffad510000 r-xp 00000000 fd:00 1724816 /root/git/linux/show_mmap_pie 3fffad510000-3fffad520000 r--p 00000000 fd:00 1724816 /root/git/linux/show_mmap_pie 3fffad520000-3fffad530000 rw-p 00010000 fd:00 1724816 /root/git/linux/show_mmap_pie 3fffe3110000-3fffe3140000 rw-p 00000000 00:00 0 [stack] The load address of the elf is now pushed to be in a 64-bit range. As I have access to limited number of powerpc machines, request folks having powerpc platforms to try this patchset and share their test results/issues as well. Cc: Alexander Graf <agraf@...e.com> Cc: Benjamin Herrenschmidt <benh@...nel.crashing.org> Cc: Paul Mackerras <paulus@...ba.org> Cc: Michael Ellerman <mpe@...erman.id.au> Cc: Anatolij Gustschin <agust@...x.de> Cc: Alistair Popple <alistair@...ple.id.au> Cc: Matt Porter <mporter@...nel.crashing.org> Cc: Vitaly Bordug <vitb@...nel.crashing.org> Cc: Scott Wood <oss@...error.net> Cc: Kumar Gala <galak@...nel.crashing.org> Cc: Daniel Cashman <dcashman@...roid.com> Cc: Kees Cook <keescook@...omium.org> Bhupesh Sharma (2): powerpc: mm: support ARCH_MMAP_RND_BITS powerpc: Redefine ELF_ET_DYN_BASE arch/powerpc/Kconfig | 34 ++++++++++++++++++++++++++++++++++ arch/powerpc/include/asm/elf.h | 2 +- arch/powerpc/mm/mmap.c | 7 ++++--- 3 files changed, 39 insertions(+), 4 deletions(-) -- 2.7.4
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.