Does anyone use RANDSTRUCT?

Does anyone use RANDSTRUCT?

[Stephen Smalley]

See $(subject). If yes, there are some obvious candidates among the 
SELinux data structures for randomized layouts to avoid fixed locations 
for enforcing, initialized, etc.  If not, then no point in pursuing it. 
Doesn't look like Fedora enables it, probably because they'd have to 
publish the random seeds anyway for third party kernel modules.  But 
maybe it would be useful for some distros/users?  ChromeOS?  Android?

Re: Does anyone use RANDSTRUCT?

[Stephen Smalley]

On 12/13/19 10:45 AM, Wenhui Zhang wrote:
> It seems like most of Selinux functions are static inline , no symbols 
> are exposed to symbol table.
> IMHO, randomization is not necessary if not reflected in symbol table ?

RANDSTRUCT isn't about randomization of code; it is about randomization 
of data structure layout. See https://lwn.net/Articles/722293/ for some 
background.

Also, your assumption is wrong but that's not germane to this thread so 
I won't discuss it further here.

> 
> On Fri, Dec 13, 2019, 10:41 AM Stephen Smalley <sds@tycho.nsa.gov 
> <mailto:sds@tycho.nsa.gov>> wrote:
> 
>     See $(subject). If yes, there are some obvious candidates among the
>     SELinux data structures for randomized layouts to avoid fixed locations
>     for enforcing, initialized, etc.  If not, then no point in pursuing it.
>     Doesn't look like Fedora enables it, probably because they'd have to
>     publish the random seeds anyway for third party kernel modules.  But
>     maybe it would be useful for some distros/users?  ChromeOS?  Android?
> 

Re: Does anyone use RANDSTRUCT?

[Kees Cook]

On Fri, Dec 13, 2019 at 10:40:54AM -0500, Stephen Smalley wrote:
> See $(subject). If yes, there are some obvious candidates among the SELinux
> data structures for randomized layouts to avoid fixed locations for
> enforcing, initialized, etc.  If not, then no point in pursuing it. Doesn't
> look like Fedora enables it, probably because they'd have to publish the
> random seeds anyway for third party kernel modules.  But maybe it would be
> useful for some distros/users?  ChromeOS?  Android?

It is used by "in-house" kernel builders who optimize for high security
above all other things (I've talked to a few of them over the years
when finding out what defenses they've wanted). I've also seen Huawai
Android patches that seem to indicate they're using it as well, but I
haven't been able to determine if any released devices are shipping with
it enabled. I've also had several people ask after the Clang randstruct
port, which is ongoing[1] by a couple people (added to CC).

I think it would be very handy to add some more markings to sensitive
data structures. Please send patches!

-Kees

[1]	https://reviews.llvm.org/D59254
	https://github.com/da-x/llvm-project/commits/clang-r365631c-randstruct
	https://github.com/da-x/linux/commits/android-4.19-randstruct
	https://github.com/connorkuehl/llvm-project/commits/randstruct
	https://github.com/connorkuehl/llvm-project/pull/21

-- 
Kees Cook

Re: Does anyone use RANDSTRUCT?

[Stephen Smalley]

On 12/13/19 1:05 PM, Kees Cook wrote:
> On Fri, Dec 13, 2019 at 10:40:54AM -0500, Stephen Smalley wrote:
>> See $(subject). If yes, there are some obvious candidates among the SELinux
>> data structures for randomized layouts to avoid fixed locations for
>> enforcing, initialized, etc.  If not, then no point in pursuing it. Doesn't
>> look like Fedora enables it, probably because they'd have to publish the
>> random seeds anyway for third party kernel modules.  But maybe it would be
>> useful for some distros/users?  ChromeOS?  Android?
> 
> It is used by "in-house" kernel builders who optimize for high security
> above all other things (I've talked to a few of them over the years
> when finding out what defenses they've wanted). I've also seen Huawai
> Android patches that seem to indicate they're using it as well, but I
> haven't been able to determine if any released devices are shipping with
> it enabled. I've also had several people ask after the Clang randstruct
> port, which is ongoing[1] by a couple people (added to CC).
> 
> I think it would be very handy to add some more markings to sensitive
> data structures. Please send patches!

Do you know if there is something inhibiting usage in e.g. Pixel 
devices?  Performance impact?

> 
> -Kees
> 
> [1]	https://reviews.llvm.org/D59254
> 	https://github.com/da-x/llvm-project/commits/clang-r365631c-randstruct
> 	https://github.com/da-x/linux/commits/android-4.19-randstruct
> 	https://github.com/connorkuehl/llvm-project/commits/randstruct
> 	https://github.com/connorkuehl/llvm-project/pull/21
> 

Re: Does anyone use RANDSTRUCT?

[Dan Aloni]

On Fri, Dec 13, 2019 at 01:36:38PM -0500, Stephen Smalley wrote:
> On 12/13/19 1:05 PM, Kees Cook wrote:
> > On Fri, Dec 13, 2019 at 10:40:54AM -0500, Stephen Smalley wrote:
> > > See $(subject). If yes, there are some obvious candidates among the SELinux
> > > data structures for randomized layouts to avoid fixed locations for
> > > enforcing, initialized, etc.  If not, then no point in pursuing it. Doesn't
> > > look like Fedora enables it, probably because they'd have to publish the
> > > random seeds anyway for third party kernel modules.  But maybe it would be
> > > useful for some distros/users?  ChromeOS?  Android?
> > 
> > It is used by "in-house" kernel builders who optimize for high security
> > above all other things (I've talked to a few of them over the years
> > when finding out what defenses they've wanted). I've also seen Huawai
> > Android patches that seem to indicate they're using it as well, but I
> > haven't been able to determine if any released devices are shipping with
> > it enabled. I've also had several people ask after the Clang randstruct
> > port, which is ongoing[1] by a couple people (added to CC).
> > 
> > I think it would be very handy to add some more markings to sensitive
> > data structures. Please send patches!
> 
> Do you know if there is something inhibiting usage in e.g. Pixel devices?
> Performance impact?

In Android, the use of Clang for building the kernel inhibits it, as
RANDSTRUCT support for Clang is still in development. The move to Clang
for AOSP kernels is motivated for enabling CFI [1] and other features
such as SCS [2]. AFAIK the move to Clang is already in effect for quite
awhile in the kernels running on Pixel devices.

About performance, the gcc RANDSTRUCT implementation also includes a
performance-preserving feature where randomization takes cacheline
boundary into consideration. The Clang implementation is expected to
have this as well. It's a valid concern and definitely garners testing
for anyone enabling the feature.

[1] https://source.android.com/devices/tech/debug/cfi
[2] https://source.android.com/devices/tech/debug/shadow-call-stack

-- 
Dan Aloni

Re: Does anyone use RANDSTRUCT?

[Connor Kuehl]

On 12/13/19 2:39 PM, Dan Aloni wrote:
>> Do you know if there is something inhibiting usage in e.g. Pixel devices?
>> Performance impact?
> About performance, the gcc RANDSTRUCT implementation also includes a
> performance-preserving feature where randomization takes cacheline
> boundary into consideration. The Clang implementation is expected to
> have this as well. It's a valid concern and definitely garners testing
> for anyone enabling the feature.

Just confirming this: the development branch (well I suppose that's 
technically the only branch :-) ) for Clang randstruct does already have 
this feature -- it will try its hardest to squeeze the fields into cache 
lines. It's worth noting however that this algorithm is in its first 
iteration with potentially many more to come as people that are much 
smarter than me start digging into it and contributing optimizations 
while Clang randstruct gets closer and closer to getting merged upstream.

Unfortunately I have not measured or collected any data on the 
performance implications of Clang randstruct yet... but that is 
something I am interested in doing once we've gotten all of the wrinkles 
figured out.

- Connor