From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail172.messagelabs.com (mail172.messagelabs.com [216.82.254.3]) by kanga.kvack.org (Postfix) with ESMTP id 938E76B0012 for ; Sun, 3 Jul 2011 15:53:14 -0400 (EDT) Received: by bwd14 with SMTP id 14so5414444bwd.14 for ; Sun, 03 Jul 2011 12:53:11 -0700 (PDT) Date: Sun, 3 Jul 2011 23:53:06 +0400 From: Vasiliy Kulikov Subject: Re: [kernel-hardening] Re: [RFC v1] implement SL*B and stack usercopy runtime checks Message-ID: <20110703195306.GA9714@albatros> References: <20110703111028.GA2862@albatros> <20110703185709.GA7414@albatros> <20110703192442.GA9504@albatros> <1309721875.18925.30.camel@Joe-Laptop> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1309721875.18925.30.camel@Joe-Laptop> Sender: owner-linux-mm@kvack.org List-ID: To: Joe Perches Cc: kernel-hardening@lists.openwall.com, Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , x86@kernel.org, Arnd Bergmann , Christoph Lameter , Pekka Enberg , Matt Mackall , Andrew Morton , linux-kernel@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org On Sun, Jul 03, 2011 at 12:37 -0700, Joe Perches wrote: > On Sun, 2011-07-03 at 23:24 +0400, Vasiliy Kulikov wrote: > > Btw, if the perfomance will be acceptable, what do you think about > > logging/reacting on the spotted overflows? > > If you do, it might be useful to track the found location(s) Sure. > and only emit the overflow log entry once as found. Hmm, if consider it as a purely debugging feature, then yes. But if consider it as a try to block some exploitation attempt, then no. I'd appresiate the latter. > Maybe use __builtin_return_address(depth) for tracking. PaX/Grsecurity uses dump_stack() and do_group_exit(SIGKILL); If setup, it kills all user's processes and locks the user for some time. I don't really propose the latter, but some reaction (to at least slowdown a blind bruteforce) might be useful. Thanks, -- Vasiliy Kulikov http://www.openwall.com - bringing security into open computing environments -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/ Don't email: email@kvack.org