Pavel Machek recommended per-architecture randomization defaults when I
poked a (very hackish) patch up here.  As follow-up, I have taken out
the command line parameter code and used the infrastructure I wrote to
implement per-architecture randomization settings.

Three #defines are needed per architecture, preferably in
include/asm-ARCH/processor.h or equivalent.  These defines are as follows:

 STACK_ALIGN -- Alignment of the stack, typically 16 (bytes).
    If not defined, stack randomization is carried out to page
    granularity
 ARCH_RANDOM_STACK_BITS -- Bits of entropy to apply to the stack.
    If not defined, stack randomization is disabled by defining this
    as 0.
 ARCH_RANDOM_MMAP_BITS -- Bits of entropy to apply to the mmap() base.
    If not defined, mmap() randomization is disabled by defining this
    as 0.

I have added these for each of i386 and x86-64.  In the case of x86-64,
the last two are complex ones similar to how TASK_SIZE is done.  Other
architectures need these defines, and I am certain I disabled
randomization everywhere else doing this; but as far as I can tell, the
code only was randomizing the stack at page-granularity anyway
everywhere else, since there were no randomized mmap_base() or
arch_align_stack() functions.

My arch_align_stack(), now in fs/exec.c, should be portable to all
platforms now.  Assuming my code works as intended, it's safe to enable
this on non-randomized archs; STACK_ALIGN will be PAGE_SIZE and so
arch_align_stack() effectively becomes an expensive NOP.  This also
happens if ARCH_RANDOM_STACK_BITS is 0.

This code probably makes it possible to collapse mmap_base() in
arch/x86_64/ia32/mmap32.c into arch_pick_mmap_layout() in
arch/x86_64/mm/mmap.c; as far as I can tell, there are 2 functions
because one applies 28 bits of entropy and one applies 8.  This patch
defines ARCH_RANDOM_MMAP_BITS as being based on the task type (32 or 64
bit), so the same function can complete the same randomization (I think...).

As before, this code makes it possible to insert hooks at a few key
points to control mmap() and stack entropy per-execution.  This could
later be added as SELinux policy controls if anyone is interested in
doing so.

This patch was coded very at-face and defines too many variables that
are used once in a couple functions.  I can probably rewrite those
sections to do the calculation steps in the same variable, and just note
what it's doing in comments.

This has yet to be compile-tested.

Questions?  Comments?  Flames?

-- 
All content of all messages exchanged herein are left in the
Public Domain, unless otherwise explicitly stated.

    Creative brains are a valuable, limited resource. They shouldn't be
    wasted on re-inventing the wheel when there are so many fascinating
    new problems waiting out there.
                                                 -- Eric Steven Raymond

    We will enslave their women, eat their children and rape their
    cattle!
                  -- Bosc, Evil alien overlord from the fifth dimension