Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1296871

Re: [RFC][PATCH 0/7] Sanitization of slabs based on grsecurity/PaX

From Christoph Lameter <cl@linux.com>
Newsgroups linux.kernel
Subject Re: [RFC][PATCH 0/7] Sanitization of slabs based on grsecurity/PaX
Date 2015-12-22 17:10 +0100
Message-ID <qIxFE-694-23@gated-at.bofh.it> (permalink)
References <qIm7v-75a-1@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

On Mon, 21 Dec 2015, Laura Abbott wrote:

> The biggest change from PAX_MEMORY_SANTIIZE is that this feature sanitizes
> the SL[AOU]B allocators only. My plan is to work on the buddy allocator
> santization after this series gets picked up. A side effect of this is
> that allocations which go directly to the buddy allocator (i.e. large
> allocations) aren't sanitized. I'd like feedback about whether it's worth
> it to add sanitization on that path directly or just use the page
> allocator sanitization when that comes in.

I am not sure what the point of this patchset is. We have a similar effect
to sanitization already in the allocators through two mechanisms:

1. Slab poisoning
2. Allocation with GFP_ZERO

I do not think we need a third one. You could accomplish your goals much
easier without this code churn by either

1. Improve the existing poisoning mechanism. Ensure that there are no
   gaps. Security sensitive kernel slab caches can then be created with
   the  POISONING flag set. Maybe add a Kconfig flag that enables
   POISONING for each cache? What was the issue when you tried using
   posining for sanitization?

2. Add a mechanism that ensures that GFP_ZERO is set for each allocation.
   That way every object you retrieve is zeroed and thus you have implied
   sanitization. This also can be done in a rather simple way by changing
   the  GFP_KERNEL etc constants to include __GFP_ZERO depending on a
   Kconfig option. Or add some runtime setting of the gfp flags somewhere.

Generally I would favor option #2 if you must have sanitization because
that is the only option to really give you a deterministic content of
object on each allocation. Any half way measures would not work I think.

Note also that most allocations are already either allocations that zero
the content or they are immediately initializing the content of the
allocated object. After all the object is not really usable if the
content is random. You may be able to avoid this whole endeavor by
auditing the kernel for locations where the object is not initialized
after allocation.

Once one recognizes the above it seems that sanitization is pretty
useless. Its just another pass of writing zeroes before the allocator or
uer of the allocated object sets up deterministic content of the object or
-- in most cases -- zeroes it again.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC][PATCH 0/7] Sanitization of slabs based on grsecurity/PaX Laura Abbott <laura@labbott.name> - 2015-12-22 04:50 +0100
  [RFC][PATCH 6/7] mm: Add Kconfig option for slab sanitization Laura Abbott <laura@labbott.name> - 2015-12-22 04:50 +0100
    Re: [kernel-hardening] [RFC][PATCH 6/7] mm: Add Kconfig option for  slab sanitization Mathias Krause <minipli@googlemail.com> - 2015-12-22 10:40 +0100
      Re: [kernel-hardening] [RFC][PATCH 6/7] mm: Add Kconfig option for  slab sanitization Laura Abbott <laura@labbott.name> - 2015-12-22 19:00 +0100
        Re: [kernel-hardening] [RFC][PATCH 6/7] mm: Add Kconfig option for  slab sanitization Mathias Krause <minipli@googlemail.com> - 2015-12-22 19:40 +0100
          Re: [kernel-hardening] [RFC][PATCH 6/7] mm: Add Kconfig option for  slab sanitization Laura Abbott <laura@labbott.name> - 2015-12-22 20:20 +0100
          Re: [kernel-hardening] [RFC][PATCH 6/7] mm: Add Kconfig option for  slab sanitization Christoph Lameter <cl@linux.com> - 2015-12-22 21:10 +0100
            Re: [kernel-hardening] [RFC][PATCH 6/7] mm: Add Kconfig option for  slab sanitization Mathias Krause <minipli@googlemail.com> - 2015-12-22 21:10 +0100
    Re: [kernel-hardening] [RFC][PATCH 6/7] mm: Add Kconfig option for  slab sanitization Dave Hansen <dave.hansen@intel.com> - 2015-12-22 16:00 +0100
      Re: [kernel-hardening] [RFC][PATCH 6/7] mm: Add Kconfig option for  slab sanitization Christoph Lameter <cl@linux.com> - 2015-12-22 17:30 +0100
        Re: [kernel-hardening] [RFC][PATCH 6/7] mm: Add Kconfig option for  slab sanitization Dave Hansen <dave.hansen@intel.com> - 2015-12-22 18:30 +0100
          Re: [kernel-hardening] [RFC][PATCH 6/7] mm: Add Kconfig option for  slab sanitization Christoph Lameter <cl@linux.com> - 2015-12-22 19:10 +0100
            Re: [kernel-hardening] [RFC][PATCH 6/7] mm: Add Kconfig option for  slab sanitization Dave Hansen <dave.hansen@intel.com> - 2015-12-22 19:20 +0100
              Re: [kernel-hardening] [RFC][PATCH 6/7] mm: Add Kconfig option for  slab sanitization Laura Abbott <laura@labbott.name> - 2015-12-22 20:20 +0100
                Re: [kernel-hardening] [RFC][PATCH 6/7] mm: Add Kconfig option for  slab sanitization Dave Hansen <dave.hansen@intel.com> - 2015-12-22 20:40 +0100
        Re: [kernel-hardening] [RFC][PATCH 6/7] mm: Add Kconfig option for  slab sanitization Christoph Lameter <cl@linux.com> - 2015-12-22 18:30 +0100
        Re: [kernel-hardening] [RFC][PATCH 6/7] mm: Add Kconfig option for  slab sanitization Dave Hansen <dave.hansen@intel.com> - 2015-12-22 18:30 +0100
  [RFC][PATCH 4/7] slob: Add support for sanitization Laura Abbott <laura@labbott.name> - 2015-12-22 04:50 +0100
  [RFC][PATCH 3/7] slab: Add support for sanitization Laura Abbott <laura@labbott.name> - 2015-12-22 04:50 +0100
  [RFC][PATCH 7/7] lkdtm: Add READ_AFTER_FREE test Laura Abbott <laura@labbott.name> - 2015-12-22 04:50 +0100
  [RFC][PATCH 5/7] mm: Mark several cases as SLAB_NO_SANITIZE Laura Abbott <laura@labbott.name> - 2015-12-22 04:50 +0100
  [RFC][PATCH 1/7] mm/slab_common.c: Add common support for slab saniziation Laura Abbott <laura@labbott.name> - 2015-12-22 04:50 +0100
    Re: [RFC][PATCH 1/7] mm/slab_common.c: Add common support for slab  saniziation Vlastimil Babka <vbabka@suse.cz> - 2015-12-22 21:50 +0100
  [RFC][PATCH 2/7] slub: Add support for sanitization Laura Abbott <laura@labbott.name> - 2015-12-22 04:50 +0100
  Re: [RFC][PATCH 0/7] Sanitization of slabs based on grsecurity/PaX Christoph Lameter <cl@linux.com> - 2015-12-22 17:10 +0100
    Re: [kernel-hardening] Re: [RFC][PATCH 0/7] Sanitization of slabs  based on grsecurity/PaX Dave Hansen <dave.hansen@intel.com> - 2015-12-22 17:20 +0100
    Re: [kernel-hardening] Re: [RFC][PATCH 0/7] Sanitization of slabs  based on grsecurity/PaX Daniel Micay <danielmicay@gmail.com> - 2015-12-22 17:40 +0100
    Re: [RFC][PATCH 0/7] Sanitization of slabs based on grsecurity/PaX Laura Abbott <laura@labbott.name> - 2015-12-22 21:10 +0100

csiph-web