Re: [PATCH v2 0/4] Checkpoint/Restore: Show in proc IDs of objects that can be shared between tasks

Pekka Enberg
2011-11-18T21:09:06Z

On Fri, Nov 18, 2011 at 11:03 PM, Cyrill Gorcunov <gorcunov@gmail.com> wrote:
>> Of course.  But
>>
>> a) I'm not sure that this scheme actually protects the kernel
>>    addresses - there may be way in which cunning userspace can work out
>>    the random mask.
>
> Well, in case of hw-rng it should not be that easy, still of course
> there is no 100% guarantee that there is absolutely no way to predict
> this mask (espec since it's generated once at lives here forever). But
> whatever makes attacker life harder -- is a good thing. After all we might
> simply take some hash on kernel address here (such as sha256) since it's
> not a time-critical operation and as far as I know collision is not found
> for it yet (??).

XOR cipher is very easy to crack with frequency analysis. I'd also
consider using SHA256 or similar hash for this.