From mboxrd@z Thu Jan 1 00:00:00 1970 Reply-To: kernel-hardening@lists.openwall.com Date: Fri, 5 Apr 2013 22:43:06 +0200 From: Borislav Petkov Message-ID: <20130405204306.GA14092@pd.tnic> References: <1365106055-22939-1-git-send-email-keescook@chromium.org> <1365106055-22939-4-git-send-email-keescook@chromium.org> <20130405144954.GC29290@pd.tnic> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: Subject: [kernel-hardening] Re: [PATCH 3/3] x86: kernel base offset ASLR To: Julien Tinnes Cc: Kees Cook , LKML , "kernel-hardening@lists.openwall.com" , "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , "x86@kernel.org" , Jarkko Sakkinen , Matthew Garrett , Matt Fleming , Eric Northup , Dan Rosenberg , Will Drewry List-ID: On Fri, Apr 05, 2013 at 01:19:39PM -0700, Julien Tinnes wrote: > I think it'd be perfectly ok for OOPS to print out the kernel base. Yeah, ok, this still would need some massaging of the oops output per script, but it shouldn't be a big problem. Also, you probably need to make clear in the oops itself that the addresses have been randomized. Or, is the mere presence of kernel base going to imply that? > Restricting access to these oopses becomes a different problem > (privilege separation). Some existing sandboxes (Chromium, vsftpd, > openssh..) are already defending against it. Ok. Thanks. -- Regards/Gruss, Boris. Sent from a fat crate under my desk. Formatting is fine. -- From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1162919Ab3DEUnS (ORCPT ); Fri, 5 Apr 2013 16:43:18 -0400 Received: from mail.skyhub.de ([78.46.96.112]:59884 "EHLO mail.skyhub.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1162808Ab3DEUnN (ORCPT ); Fri, 5 Apr 2013 16:43:13 -0400 Date: Fri, 5 Apr 2013 22:43:06 +0200 From: Borislav Petkov To: Julien Tinnes Cc: Kees Cook , LKML , "kernel-hardening@lists.openwall.com" , "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , "x86@kernel.org" , Jarkko Sakkinen , Matthew Garrett , Matt Fleming , Eric Northup , Dan Rosenberg , Will Drewry Subject: Re: [PATCH 3/3] x86: kernel base offset ASLR Message-ID: <20130405204306.GA14092@pd.tnic> Mail-Followup-To: Borislav Petkov , Julien Tinnes , Kees Cook , LKML , "kernel-hardening@lists.openwall.com" , "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , "x86@kernel.org" , Jarkko Sakkinen , Matthew Garrett , Matt Fleming , Eric Northup , Dan Rosenberg , Will Drewry References: <1365106055-22939-1-git-send-email-keescook@chromium.org> <1365106055-22939-4-git-send-email-keescook@chromium.org> <20130405144954.GC29290@pd.tnic> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Apr 05, 2013 at 01:19:39PM -0700, Julien Tinnes wrote: > I think it'd be perfectly ok for OOPS to print out the kernel base. Yeah, ok, this still would need some massaging of the oops output per script, but it shouldn't be a big problem. Also, you probably need to make clear in the oops itself that the addresses have been randomized. Or, is the mere presence of kernel base going to imply that? > Restricting access to these oopses becomes a different problem > (privilege separation). Some existing sandboxes (Chromium, vsftpd, > openssh..) are already defending against it. Ok. Thanks. -- Regards/Gruss, Boris. Sent from a fat crate under my desk. Formatting is fine. --