public inbox for bpf@vger.kernel.org
 help / color / mirror / Atom feed
* CONFIG_DEBUG_INFO_BTF and CONFIG_GCC_PLUGIN_RANDSTRUCT
@ 2020-03-30 15:12 Jann Horn
  2020-03-30 15:59 ` Alexei Starovoitov
  0 siblings, 1 reply; 11+ messages in thread
From: Jann Horn @ 2020-03-30 15:12 UTC (permalink / raw)
  To: bpf, Kernel Hardening

I noticed that CONFIG_DEBUG_INFO_BTF seems to partly defeat the point
of CONFIG_GCC_PLUGIN_RANDSTRUCT.

CONFIG_GCC_PLUGIN_RANDSTRUCT randomizes the layout of (some)
kernel-internal structs, which AFAIK is intended to make exploitation
harder in two ways:
1) by ensuring that an attacker can't use a single exploit relying on
specific structure offsets against every target
2) by keeping structure offsets secret from the attacker, so that the
attacker can't rely on knowledge of structure offsets even when trying
to exploit a specific target - only relevant for the few people who
build their kernel themselves (since nobody was crazy enough to
implement generating relocations for structure offsets so far).

When CONFIG_DEBUG_INFO_BTF is on, the kernel exposes the layouts of
kernel structures via the mode-0444 file /sys/kernel/btf/vmlinux, so a
local attacker can easily see structure offsets, defeating part 2.

I wonder whether these kconfig knobs should be mutually exclusive, or
whether /sys/kernel/btf/vmlinux should have a different mode, or
something like that.

^ permalink raw reply	[flat|nested] 11+ messages in thread

end of thread, other threads:[~2020-04-01  7:32 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-03-30 15:12 CONFIG_DEBUG_INFO_BTF and CONFIG_GCC_PLUGIN_RANDSTRUCT Jann Horn
2020-03-30 15:59 ` Alexei Starovoitov
2020-03-30 16:17   ` Jann Horn
2020-03-30 17:20     ` Kees Cook
2020-03-30 22:41       ` Daniel Borkmann
2020-03-31 18:12         ` Kees Cook
2020-03-31 19:50           ` Andrii Nakryiko
2020-03-31 19:58             ` Kees Cook
2020-03-31 20:23               ` Andrii Nakryiko
2020-03-31 21:24                 ` Slava Bacherikov
2020-04-01  7:32                   ` Kees Cook

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox