From: Rik van Riel <riel@redhat.com>
To: James Morris <jmorris@namei.org>, Kees Cook <keescook@chromium.org>
Cc: kernel-hardening@lists.openwall.com,
Michael Leibowitz <michael.leibowitz@intel.com>
Subject: Re: [kernel-hardening] [PATCH 00/18] Introduce struct layout randomization plugin
Date: Thu, 06 Apr 2017 18:32:27 -0400 [thread overview]
Message-ID: <1491517947.8850.162.camel@redhat.com> (raw)
In-Reply-To: <alpine.LRH.2.20.1704070749440.27111@namei.org>
On Fri, 2017-04-07 at 07:54 +1000, James Morris wrote:
> On Thu, 6 Apr 2017, Kees Cook wrote:
>
> > third party kernel module builds), it still has some value there
> > since
> > now all kernel builds would need to be tracked by an attacker.
>
> I don't see this case as providing any value. Tracking a bunch of
> known
> seed values seems like a pretty low bar for an attacker.
I agree this is not likely to provide much value for users
of distribution kernels.
One possible exception might be if Google started distributing
dozens, or hundreds, of kernel variants randomly to users of
Nexus devices, and nobody knew which variant each device was
running.
next prev parent reply other threads:[~2017-04-06 22:32 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-04-06 21:18 [kernel-hardening] [PATCH 00/18] Introduce struct layout randomization plugin Kees Cook
2017-04-06 21:18 ` [kernel-hardening] [PATCH 01/18] gcc-plugins: Add the randstruct plugin Kees Cook
2017-04-12 22:12 ` [kernel-hardening] " Kees Cook
2017-04-17 5:30 ` Jessica Yu
2017-04-17 15:23 ` Kees Cook
2017-05-12 6:37 ` Loganaden Velvindron
2017-05-12 19:36 ` Kees Cook
2017-04-06 21:18 ` [kernel-hardening] [PATCH 02/18] compiler: Add __designated_init annotation Kees Cook
2017-04-06 21:18 ` [kernel-hardening] [PATCH 03/18] randstruct: Set designated_init attribute Kees Cook
2017-04-06 21:18 ` [kernel-hardening] [PATCH 04/18] randstruct: Differentiate bad cast warnings Kees Cook
2017-04-06 21:18 ` [kernel-hardening] [PATCH 05/18] af_unix: Use designated initializers Kees Cook
2017-04-06 21:18 ` [kernel-hardening] [PATCH 06/18] NFS: Avoid cross-structure casting Kees Cook
2017-04-06 21:18 ` [kernel-hardening] [PATCH 07/18] randstruct: Whitelist struct security_hook_heads cast Kees Cook
2017-04-06 21:18 ` [kernel-hardening] [PATCH 08/18] randstruct: Whitelist UNIXCB cast Kees Cook
2017-04-06 21:18 ` [kernel-hardening] [PATCH 09/18] randstruct: Mark various structs for randomization Kees Cook
2017-04-06 21:18 ` [kernel-hardening] [PATCH 10/18] scsi/bfa: use designated initializers Kees Cook
2017-04-06 21:18 ` [kernel-hardening] [PATCH 11/18] scsi: qedi,qedf: Use " Kees Cook
2017-04-06 21:18 ` [kernel-hardening] [PATCH 12/18] ovl: " Kees Cook
2017-04-06 21:18 ` [kernel-hardening] [PATCH 13/18] randstruct: opt-out externally exposed function pointer structs Kees Cook
2017-04-06 21:18 ` [kernel-hardening] [PATCH 14/18] randstruct: Disable randomization of ACPICA structs Kees Cook
2017-04-06 21:18 ` [kernel-hardening] [PATCH 15/18] randstruct: Enable function pointer struct detection Kees Cook
2017-04-06 21:18 ` [kernel-hardening] [PATCH 16/18] task_struct: Allow randomized layout Kees Cook
2017-04-07 16:25 ` Rik van Riel
2017-04-07 20:43 ` Kees Cook
2017-04-06 21:18 ` [kernel-hardening] [PATCH 17/18] sgi-xp: Use designated initializers Kees Cook
2017-04-06 21:18 ` [kernel-hardening] [PATCH 18/18] ACPICA: " Kees Cook
2017-04-06 21:54 ` [kernel-hardening] [PATCH 00/18] Introduce struct layout randomization plugin James Morris
2017-04-06 22:32 ` Rik van Riel [this message]
2017-04-06 22:51 ` Kees Cook
2017-04-13 23:39 ` Laura Abbott
2017-04-15 18:50 ` Kees Cook
2017-04-18 17:15 ` Laura Abbott
2017-04-18 17:20 ` Kees Cook
2017-04-18 16:54 ` Laura Abbott
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1491517947.8850.162.camel@redhat.com \
--to=riel@redhat.com \
--cc=jmorris@namei.org \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=michael.leibowitz@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.