From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752775AbbCJCv0 (ORCPT ); Mon, 9 Mar 2015 22:51:26 -0400 Received: from mga11.intel.com ([192.55.52.93]:12211 "EHLO mga11.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751024AbbCJCvX (ORCPT ); Mon, 9 Mar 2015 22:51:23 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.11,371,1422950400"; d="scan'208";a="464929456" Message-ID: <54FE5C28.10305@intel.com> Date: Mon, 09 Mar 2015 19:51:20 -0700 From: Dave Hansen User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.4.0 MIME-Version: 1.0 To: Kees Cook , "Eric W. Biederman" CC: Andrew Morton , "Theodore Ts'o" , Oleg Nesterov , LKML , Dave Hansen Subject: Re: [RFC][PATCH 1/2] fs proc: make pagemap a privileged interface References: <20150309204321.AAF412E0@viggo.jf.intel.com> <878uf5vmxo.fsf@x220.int.ebiederm.org> <87h9ttrcpr.fsf@x220.int.ebiederm.org> <878uf5rb3v.fsf@x220.int.ebiederm.org> In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 03/09/2015 05:03 PM, Kees Cook wrote: > On Mon, Mar 9, 2015 at 4:43 PM, Eric W. Biederman wrote: >> A 1 to 1 blinding function like integer multiplication mudulo 2^32 by an >> appropriate random number ought to keep from revealing page numbers or >> page ajacencies while not requiring any changes in userspace. >> >> That way the revealed pfn and the physcial pfn would be different but >> you could still use pagemap for it's intended purpose. > > If this could be done in a way where it was sufficiently hard to > expose the random number, we should absolutely do this. We would need something which is both reversible (so that the given offsets can still be used in /proc/kpagemap) and also hard to do a known-plaintext-type attack on it. Transparent huge pages are a place where userspace knows the relationship between 512 adjacent physical addresses. That represents a good chunk of known data. Surely there are more of these kinds of things. Right now, for instance, the ways in which a series of sequential allocations come out of the page allocator are fairly deterministic. We would also need to do some kind of allocator randomization to ensure that userspace couldn't make good guesses about the physical addresses of things coming out of the allocator. Or, we just be sure and turn the darn thing off. :)