[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 7 Dec 2014 11:44:55 -0800
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Subject: Re: How GNU/Linux distros deal with offset2lib attack?
On Sun, Dec 07, 2014 at 10:43:17PM +0800, Shawn wrote:
> Hi Lionel,
>
> Thanks for your extraordinary explanation about Grsec/PaX. I'm a big
> fan of Grsec/PaX. But I think compare the ASLR implementation of
> vallina kernel with Grsecurity/PaX is not fair. Linux upstream doesn't
> hold the security-oriented philosophy, while Grsecurity/PaX community
> are expertise of system-lvl security.
Ok, do you seriously think this? If so, please provide details as to
why you feel this way. The Linux kernel developers take security very
seriously, otherwise no one would be using Linux for "secure" systems,
right?
> Developer/users could take bear of 5%-10% performance penalty caused
> by new features, but I don't think most developers/users would accept
> even 1% performance penalty caused by security defensive mitigation.
> Personally, I hope we could see Grsecurity/PaX being part of mainline
> linux kernel in the future.
Great, please do the work to split it up and submit it to be merged,
that would be a wonderful thing for you to do if you think the features
there are needed.
> IMOHO, offset2lib is a very critical impact to the GNU/Linux
> mitigation. What if the bad buys already have some 0day vulns? This
> will make their work so much easier to write massive exploit. Hope
> upstream could patch this issue as quickly as possible. Plz don't let
> this work to the burden of GNU/Linux distro community.
What exactly do you mean here? The fact that this option isn't enabled
by lots of distros already means that there isn't much of an issue,
right?
thanks,
greg k-h
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
