Re: [kernel-hardening] Patch for random mac address

[Daniel Micay <danielmicay@gmail.com>]

On Thu, 2017-05-25 at 23:28 +0200, Anisse Astier wrote:
> Hi,
> 
> On Thu, May 25, 2017 at 10:28:19AM -0700, Kees Cook wrote:
> > On Thu, May 25, 2017 at 8:59 AM, Rik van Riel <riel@redhat.com>
> > wrote:
> > > On Thu, 2017-05-25 at 17:47 +0200, intrigeri wrote:
> > > > Rik van Riel:
> > > > > That suggests maybe this kind of functionality should
> > > > > be implemented in userspace, instead?
> > > > > Maybe in NetworkManager, […]
> > > > 
> > > > It's already implemented in NetworkManager :)
> > > 
> > > So this kernel patch does not solve any problem,
> > > because the solution has already been implemented
> > > in userspace?
> > 
> > It makes sure you can never not randomize the MAC, no matter what
> > userspace is doing. I'm not opposed to the idea, but it feels like
> > overkill to me.
> > 
> > BTW, the proposed patch is slightly wrong: it still allows userspace
> > to change the MAC address. The ifdef with the return 0 should be
> > moved
> > up (and "return 0" seems like a bit of a lie: maybe -EINVAL or
> > -ENOTSUPPORTED?). How about sending a v2 with that fixed, inline,
> > etc.
> > And see if other people chime in?
> 
> Yes, the original grsec patch is slightly different.

It was never included in grsecurity, so it's not really a grsecurity
patch.