From mboxrd@z Thu Jan 1 00:00:00 1970 Sender: Ingo Molnar Date: Sat, 23 Sep 2017 12:00:29 +0200 From: Ingo Molnar Message-ID: <20170923100029.6nzpui6c3ke76bbs@gmail.com> References: <20170810172615.51965-1-thgarnie@google.com> <20170811124127.kkb5pnkljz4umxuj@gmail.com> <20170815075609.mmzbfwritjzvrpsn@gmail.com> <20170816151235.oamkdva6cwpc4cex@gmail.com> <20170821133222.2ek6bhqgdeoymxsg@hirez.programming.kicks-ass.net> <20170821142854.dmuusnbc2tsrai3v@hirez.programming.kicks-ass.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Subject: [kernel-hardening] Re: x86: PIE support and option to extend KASLR randomization To: "H. Peter Anvin" Cc: Peter Zijlstra , Thomas Garnier , Herbert Xu , "David S . Miller" , Thomas Gleixner , Ingo Molnar , Josh Poimboeuf , Arnd Bergmann , Matthias Kaehlcke , Boris Ostrovsky , Juergen Gross , Paolo Bonzini , Radim =?utf-8?B?S3LEjW3DocWZ?= , Joerg Roedel , Tom Lendacky , Andy Lutomirski , Borislav Petkov , Brian Gerst , "Kirill A . Shutemov" , "Rafael J . Wysocki" , Len Brown , Pavel Machek , Tejun Heo , Christoph Lameter , Paul Gortmaker , Chris Metcalf , Andrew Morton , "Paul E . McKenney" , Nicolas Pitre , Christopher Li , "Rafael J . Wysocki" , Lukas Wunner , Mika Westerberg , Dou Liyang , Daniel Borkmann , Alexei Starovoitov , Masahiro Yamada , Markus Trippelsdorf , Steven Rostedt , Kees Cook , Rik van Riel , David Howells , Waiman Long , Kyle Huey , Peter Foley , Tim Chen , Catalin Marinas , Ard Biesheuvel , Michal Hocko , Matthew Wilcox , "H . J . Lu" , Paul Bolle , Rob Landley , Baoquan He , Daniel Micay , the arch/x86 maintainers , linux-crypto@vger.kernel.org, LKML , xen-devel@lists.xenproject.org, kvm list , Linux PM list , linux-arch , linux-sparse@vger.kernel.org, Kernel Hardening , Linus Torvalds , Borislav Petkov List-ID: * H. Peter Anvin wrote: > We do need to consider how we want modules to fit into whatever model we > choose, though. They can be adjacent, or we could go with a more > traditional dynamic link model where the modules can be separate, and > chained together with the main kernel via the GOT. So I believe we should start with 'adjacent'. The thing is, having modules separately randomized mostly helps if any of the secret locations fails and we want to prevent hopping from one to the other. But if one the kernel-privileged secret location fails then KASLR has already failed to a significant degree... So I think the large-PIC model for modules does not buy us any real advantages in practice, and the disadvantages of large-PIC are real and most Linux users have to pay that cost unconditionally, as distro kernels have half of their kernel functionality living in modules. But I do see fundamental value in being able to hide the kernel somewhere in a ~48 bits address space, especially if we also implement Linus's suggestion to utilize the lower bits as well. 0..281474976710656 is a nicely large range and will get larger with time. But it should all be done smartly and carefully: For example, there would be collision with regular user-space mappings, right? Can local unprivileged users use mmap(MAP_FIXED) probing to figure out where the kernel lives? Thanks, Ingo