From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-vk0-f71.google.com (mail-vk0-f71.google.com [209.85.213.71]) by kanga.kvack.org (Postfix) with ESMTP id A41946B0008 for ; Tue, 27 Mar 2018 18:53:57 -0400 (EDT) Received: by mail-vk0-f71.google.com with SMTP id d67so371176vka.12 for ; Tue, 27 Mar 2018 15:53:57 -0700 (PDT) Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65]) by mx.google.com with SMTPS id 12sor974852uag.190.2018.03.27.15.53.54 for (Google Transport Security); Tue, 27 Mar 2018 15:53:55 -0700 (PDT) MIME-Version: 1.0 In-Reply-To: <0549F29C-12FC-4401-9E85-A430BC11DA78@gmail.com> References: <1521736598-12812-1-git-send-email-blackzert@gmail.com> <20180323124806.GA5624@bombadil.infradead.org> <651E0DB6-4507-4DA1-AD46-9C26ED9792A8@gmail.com> <20180326084650.GC5652@dhcp22.suse.cz> <01A133F4-27DF-4AE2-80D6-B0368BF758CD@gmail.com> <20180327072432.GY5652@dhcp22.suse.cz> <0549F29C-12FC-4401-9E85-A430BC11DA78@gmail.com> From: Kees Cook Date: Tue, 27 Mar 2018 15:53:53 -0700 Message-ID: Subject: Re: [RFC PATCH v2 0/2] Randomization of address chosen by mmap. Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Sender: owner-linux-mm@kvack.org List-ID: To: Ilya Smith Cc: Michal Hocko , Matthew Wilcox , Richard Henderson , ink@jurassic.park.msu.ru, mattst88@gmail.com, Vineet Gupta , Russell King , Tony Luck , Fenghua Yu , Ralf Baechle , "James E.J. Bottomley" , Helge Deller , Benjamin Herrenschmidt , Paul Mackerras , Michael Ellerman , Martin Schwidefsky , Heiko Carstens , Yoshinori Sato , Rich Felker , "David S. Miller" , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , X86 ML , nyc@holomorphy.com, Al Viro , Arnd Bergmann , Greg KH , Deepa Dinamani , Hugh Dickins , Kate Stewart , Philippe Ombredanne , Andrew Morton , Steve Capper , Punit Agrawal , "Aneesh Kumar K.V" , Nick Piggin , Bhupesh Sharma , Rik van Riel , nitin.m.gupta@oracle.com, "Kirill A. Shutemov" , Dan Williams , Jan Kara , Ross Zwisler , Jerome Glisse , Andrea Arcangeli , Oleg Nesterov , linux-alpha@vger.kernel.org, LKML , linux-snps-arc@lists.infradead.org, linux-ia64@vger.kernel.org, linux-metag@vger.kernel.org, Linux MIPS Mailing List , linux-parisc , PowerPC , linux-s390 , linux-sh , sparclinux , Linux-MM On Tue, Mar 27, 2018 at 6:51 AM, Ilya Smith wrote: > >> On 27 Mar 2018, at 10:24, Michal Hocko wrote: >> >> On Mon 26-03-18 22:45:31, Ilya Smith wrote: >>> >>>> On 26 Mar 2018, at 11:46, Michal Hocko wrote: >>>> >>>> On Fri 23-03-18 20:55:49, Ilya Smith wrote: >>>>> >>>>>> On 23 Mar 2018, at 15:48, Matthew Wilcox wrote= : >>>>>> >>>>>> On Thu, Mar 22, 2018 at 07:36:36PM +0300, Ilya Smith wrote: >>>>>>> Current implementation doesn't randomize address returned by mmap. >>>>>>> All the entropy ends with choosing mmap_base_addr at the process >>>>>>> creation. After that mmap build very predictable layout of address >>>>>>> space. It allows to bypass ASLR in many cases. This patch make >>>>>>> randomization of address on any mmap call. >>>>>> >>>>>> Why should this be done in the kernel rather than libc? libc is per= fectly >>>>>> capable of specifying random numbers in the first argument of mmap. >>>>> Well, there is following reasons: >>>>> 1. It should be done in any libc implementation, what is not possible= IMO; >>>> >>>> Is this really so helpful? >>> >>> Yes, ASLR is one of very important mitigation techniques which are real= ly used >>> to protect applications. If there is no ASLR, it is very easy to exploi= t >>> vulnerable application and compromise the system. We can=E2=80=99t just= fix all the >>> vulnerabilities right now, thats why we have mitigations - techniques w= hich are >>> makes exploitation more hard or impossible in some cases. >>> >>> Thats why it is helpful. >> >> I am not questioning ASLR in general. I am asking whether we really need >> per mmap ASLR in general. I can imagine that some environments want to >> pay the additional price and other side effects, but considering this >> can be achieved by libc, why to add more code to the kernel? > > I believe this is the only one right place for it. Adding these 200+ line= s of > code we give this feature for any user - on desktop, on server, on IoT de= vice, > on SCADA, etc. But if only glibc will implement =E2=80=98user-mode-aslr= =E2=80=99 IoT and SCADA > devices will never get it. I agree: pushing this off to libc leaves a lot of things unprotected. I think this should live in the kernel. The question I have is about making it maintainable/readable/etc. The state-of-the-art for ASLR is moving to finer granularity (over just base-address offset), so I'd really like to see this supported in the kernel. We'll be getting there for other things in the future, and I'd like to have a working production example for researchers to study, etc. -Kees --=20 Kees Cook Pixel Security