Date: Mon, 8 Nov 2010 06:07:38 +0300 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: Re: Linux kernel proactive security hardening Dan, Vasiliy - On Sun, Nov 07, 2010 at 08:29:07PM -0500, Dan Rosenberg wrote: > I've just posted an RFC for the equivalent of grsecurity's MODHARDEN, > which places restrictions on the automatic loading of modules by > unprivileged users: > > http://lkml.org/lkml/2010/11/7/212 We simply don't include module autoloading support in Owl, and we'll continue to do so (it's not something we want on servers anyway, not only because of the security risk), but I am all for the issue getting (partially) addressed in/for other distros. ;-) On a more relevant issue (to us), any ideas on dealing with kernel stack infoleaks in a general manner (not just plugging the bugs one by one)? I guess it could be addressed in gcc (an option to wipe stack frames) or in the kernel (wipe even more of the stack, beyond the stack pointer, on syscall entry). Unfortunately, either has likely measurable performance impact. (BTW, has some of this been implemented somewhere already?) Any other ideas? In the absence of cheap-enough general solution/workaround in the kernel, I'm afraid we'll need to resort to improving and using automated tools to detect bugs of this nature - which is apparently what you and Vasiliy were doing lately? What tools did you use? Thanks, Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.