All of lore.kernel.org
 help / color / mirror / Atom feed
From: Ingo Molnar <mingo@kernel.org>
To: "Rafael J. Wysocki" <rafael@kernel.org>
Cc: Kees Cook <keescook@chromium.org>,
	Linus Torvalds <torvalds@linux-foundation.org>,
	"Rafael J. Wysocki" <rafael.j.wysocki@intel.com>,
	Pavel Machek <pavel@denx.de>,
	Ard Biesheuvel <ard.biesheuvel@linaro.org>,
	Matt Redfearn <matt.redfearn@imgtec.com>,
	Yves-Alexis Perez <corsac@debian.org>,
	Emrah Demir <ed@abdsec.com>, Jonathan Corbet <corbet@lwn.net>,
	the arch/x86 maintainers <x86@kernel.org>,
	"Rafael J. Wysocki" <rjw@rjwysocki.net>,
	Len Brown <len.brown@intel.com>, Borislav Petkov <bp@suse.de>,
	Andy Lutomirski <luto@kernel.org>,
	"open list:DOCUMENTATION" <linux-doc@vger.kernel.org>,
	"linux-pm@vger.kernel.org" <linux-pm@vger.kernel.org>,
	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
	"kernel-hardening@lists.openwall.com"
	<kernel-hardening@lists.openwall.com>
Subject: [kernel-hardening] Re: [PATCH] Prefer kASLR over Hibernation
Date: Thu, 7 Apr 2016 02:49:58 +0200	[thread overview]
Message-ID: <20160407004958.GA27130@gmail.com> (raw)
In-Reply-To: <CAJZ5v0h4uShH_r6=osGYZ_ZH_qjL7KufnEiZ8auHQhKRzRyC1Q@mail.gmail.com>


* Rafael J. Wysocki <rafael@kernel.org> wrote:

> [...]
> 
> One of the weak points is the final jump, because it has to be done to the 
> physical location of the image kernel's entry point even though the virtual 
> addresses of it may differ between the boot and the image kernels.  The seed is 
> not needed for that, only the physical address of the entry point.  The boot 
> kernel doesn't have it today, though, because the virtual address of that is 
> passed in the image header. That should not be too difficult to change, however.

I didn't realize we jumped to the image kernel as well - I (wrongly) assumed we 
kept the bootup kernel. That should indeed make hibernation mostly 
kASLR-invariant.

Thanks,

	Ingo

WARNING: multiple messages have this Message-ID (diff)
From: Ingo Molnar <mingo@kernel.org>
To: "Rafael J. Wysocki" <rafael@kernel.org>
Cc: Kees Cook <keescook@chromium.org>,
	Linus Torvalds <torvalds@linux-foundation.org>,
	"Rafael J. Wysocki" <rafael.j.wysocki@intel.com>,
	Pavel Machek <pavel@denx.de>,
	Ard Biesheuvel <ard.biesheuvel@linaro.org>,
	Matt Redfearn <matt.redfearn@imgtec.com>,
	Yves-Alexis Perez <corsac@debian.org>,
	Emrah Demir <ed@abdsec.com>, Jonathan Corbet <corbet@lwn.net>,
	the arch/x86 maintainers <x86@kernel.org>,
	"Rafael J. Wysocki" <rjw@rjwysocki.net>,
	Len Brown <len.brown@intel.com>, Borislav Petkov <bp@suse.de>,
	Andy Lutomirski <luto@kernel.org>,
	"open list:DOCUMENTATION" <linux-doc@vger.kernel.org>,
	"linux-pm@vger.kernel.org" <linux-pm@vger.kernel.org>,
	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
	"kernel-hardening@lists.openwall.com"
	<kernel-hardening@lists.openwall.com>
Subject: Re: [PATCH] Prefer kASLR over Hibernation
Date: Thu, 7 Apr 2016 02:49:58 +0200	[thread overview]
Message-ID: <20160407004958.GA27130@gmail.com> (raw)
In-Reply-To: <CAJZ5v0h4uShH_r6=osGYZ_ZH_qjL7KufnEiZ8auHQhKRzRyC1Q@mail.gmail.com>


* Rafael J. Wysocki <rafael@kernel.org> wrote:

> [...]
> 
> One of the weak points is the final jump, because it has to be done to the 
> physical location of the image kernel's entry point even though the virtual 
> addresses of it may differ between the boot and the image kernels.  The seed is 
> not needed for that, only the physical address of the entry point.  The boot 
> kernel doesn't have it today, though, because the virtual address of that is 
> passed in the image header. That should not be too difficult to change, however.

I didn't realize we jumped to the image kernel as well - I (wrongly) assumed we 
kept the bootup kernel. That should indeed make hibernation mostly 
kASLR-invariant.

Thanks,

	Ingo

  reply	other threads:[~2016-04-07  0:49 UTC|newest]

Thread overview: 38+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-04-06 19:44 [kernel-hardening] [PATCH] Prefer kASLR over Hibernation Kees Cook
2016-04-06 19:44 ` Kees Cook
2016-04-06 20:17 ` [kernel-hardening] " Pavel Machek
2016-04-06 20:17   ` Pavel Machek
2016-04-06 20:56   ` [kernel-hardening] " Linus Torvalds
2016-04-06 20:56     ` Linus Torvalds
2016-04-06 21:25     ` [kernel-hardening] " Kees Cook
2016-04-06 21:25       ` Kees Cook
2016-04-06 21:48       ` [kernel-hardening] " Ingo Molnar
2016-04-06 21:48         ` Ingo Molnar
2016-04-06 21:52         ` [kernel-hardening] " Ingo Molnar
2016-04-06 21:52           ` Ingo Molnar
2016-04-06 22:32           ` [kernel-hardening] " Rafael J. Wysocki
2016-04-06 22:32             ` Rafael J. Wysocki
2016-04-07  0:49             ` Ingo Molnar [this message]
2016-04-07  0:49               ` Ingo Molnar
2016-04-06 21:49 ` [kernel-hardening] " Rafael J. Wysocki
2016-04-06 21:49   ` Rafael J. Wysocki
2016-04-06 21:56   ` [kernel-hardening] " Ingo Molnar
2016-04-06 21:56     ` Ingo Molnar
2016-04-06 22:04     ` [kernel-hardening] " Rafael J. Wysocki
2016-04-06 22:04       ` Rafael J. Wysocki
2016-04-06 22:16       ` [kernel-hardening] " Kees Cook
2016-04-06 22:16         ` Kees Cook
2016-04-06 22:41         ` [kernel-hardening] " Paul Bolle
2016-04-06 22:41           ` Paul Bolle
2016-04-07  0:05         ` [kernel-hardening] " Ingo Molnar
2016-04-07  0:05           ` Ingo Molnar
2016-04-11  8:00 ` [kernel-hardening] " James Morse
2016-04-11  8:00   ` James Morse
2016-04-11 18:03   ` [kernel-hardening] " Kees Cook
2016-04-11 18:03     ` Kees Cook
2016-04-11 18:21     ` [kernel-hardening] " Geert Uytterhoeven
2016-04-11 18:21       ` Geert Uytterhoeven
2016-04-11 18:47       ` [kernel-hardening] " Kees Cook
2016-04-11 18:47         ` Kees Cook
2016-04-12 17:51     ` [kernel-hardening] " James Morse
2016-04-12 17:51       ` James Morse

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20160407004958.GA27130@gmail.com \
    --to=mingo@kernel.org \
    --cc=ard.biesheuvel@linaro.org \
    --cc=bp@suse.de \
    --cc=corbet@lwn.net \
    --cc=corsac@debian.org \
    --cc=ed@abdsec.com \
    --cc=keescook@chromium.org \
    --cc=kernel-hardening@lists.openwall.com \
    --cc=len.brown@intel.com \
    --cc=linux-doc@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-pm@vger.kernel.org \
    --cc=luto@kernel.org \
    --cc=matt.redfearn@imgtec.com \
    --cc=pavel@denx.de \
    --cc=rafael.j.wysocki@intel.com \
    --cc=rafael@kernel.org \
    --cc=rjw@rjwysocki.net \
    --cc=torvalds@linux-foundation.org \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.