Re: [RFC][PATCH 1/2] fs proc: make pagemap a privileged interface

[Dave Hansen <dave.hansen@intel.com>]

On 03/09/2015 05:03 PM, Kees Cook wrote:
> On Mon, Mar 9, 2015 at 4:43 PM, Eric W. Biederman <ebiederm@xmission.com> wrote:
>> A 1 to 1 blinding function like integer multiplication mudulo 2^32 by an
>> appropriate random number ought to keep from revealing page numbers or
>> page ajacencies while not requiring any changes in userspace.
>>
>> That way the revealed pfn and the physcial pfn would be different but
>> you could still use pagemap for it's intended purpose.
> 
> If this could be done in a way where it was sufficiently hard to
> expose the random number, we should absolutely do this.

We would need something which is both reversible (so that the given
offsets can still be used in /proc/kpagemap) and also hard to do a
known-plaintext-type attack on it.

Transparent huge pages are a place where userspace knows the
relationship between 512 adjacent physical addresses.  That represents a
good chunk of known data.  Surely there are more of these kinds of things.

Right now, for instance, the ways in which a series of sequential
allocations come out of the page allocator are fairly deterministic.  We
would also need to do some kind of allocator randomization to ensure
that userspace couldn't make good guesses about the physical addresses
of things coming out of the allocator.

Or, we just be sure and turn the darn thing off. :)