From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: ARC-Seal: i=1; a=rsa-sha256; t=1522271258; cv=none; d=google.com; s=arc-20160816; b=KXau9r1eME0KCuRUbxh4tWDgfC6a4C5fD4N0PO2HQLZPsLOM9UoPaNyCAVjg88KAuW NOwM9n6wnlnmL0QHn+jYD3JFxU/gY7lfFuxcY/p5rMFrB4o5JU6BzR56jfK6cSmKCzzR CM8BXfX2Z3ddT2EuaKokPuferWsK4Q7EszAEWZkYmUA7pU8Zop8h2LRmRcwRxSsL+xCI R+B45+lDTeKTQ8bDythGNdSkGPI1UrgAHusdF2v7z90G7q49VWpKOjJWpv7N3g06HCPJ dCsgJ+TljVjxmU8gP0QKAFPvAxqF+PE4kFFSxhcc1dzDkstwpjT+UQABemuIHXIQayLC zZTw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=to:references:message-id:content-transfer-encoding:cc:date :in-reply-to:from:subject:mime-version:dkim-signature :arc-authentication-results; bh=gSdQ8bDJLYxkIO2LyMkuzz2AhJ5BbuKQbcUo1PkL9uY=; b=q5N+SWxMF4FYb8JudxFdQd675dRcpEkQx2Zch8WPEynUq1C1SQsgg5rWhcKAqHNGaR jKBLU83vtRZmr5z6s91LLibQEtroXvewSzyYxX4GPGvgioTOBRZLN2zyHLGRM/s/tina LJc8WyxiTsmHOJX4cySvtEY4dkrRNhyZDo2GaPLxS4fL+iOn49c0iFGJDzfE1uTw0qFB BFd06qUWV1xVftxSPpKLP+sSFT5hUJdGKZYqXrTuw/VDPPqzUUybALyRkY56/x7g1ipA HqUzbQT7o+p+hh4+Ynb0JGN1KmQeP2mcFC6sX5hcVHhBe3/E6r8woUT31NVk038WClOS im8Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=u/S518fj; spf=pass (google.com: domain of blackzert@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=blackzert@gmail.com; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=u/S518fj; spf=pass (google.com: domain of blackzert@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=blackzert@gmail.com; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com X-Google-Smtp-Source: AIpwx4/0JxPIzdyUgfGRtAIsGVbq+iLSCXKyhprvdig4GawcLZ87AtQu2mueObpWLwig0ZMmDsnS5w== Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.2 \(3445.5.20\)) Subject: Re: [RFC PATCH v2 0/2] Randomization of address chosen by mmap. From: Ilya Smith In-Reply-To: <20180327234904.GA27734@bombadil.infradead.org> Date: Thu, 29 Mar 2018 00:07:35 +0300 Cc: Kees Cook , Michal Hocko , Richard Henderson , ink@jurassic.park.msu.ru, mattst88@gmail.com, Vineet Gupta , Russell King , Tony Luck , Fenghua Yu , Ralf Baechle , "James E.J. Bottomley" , Helge Deller , Benjamin Herrenschmidt , Paul Mackerras , Michael Ellerman , Martin Schwidefsky , Heiko Carstens , Yoshinori Sato , Rich Felker , "David S. Miller" , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , X86 ML , nyc@holomorphy.com, Al Viro , Arnd Bergmann , Greg KH , Deepa Dinamani , Hugh Dickins , Kate Stewart , Philippe Ombredanne , Andrew Morton , Steve Capper , Punit Agrawal , "Aneesh Kumar K.V" , Nick Piggin , Bhupesh Sharma , Rik van Riel , nitin.m.gupta@oracle.com, "Kirill A. Shutemov" , Dan Williams , Jan Kara , Ross Zwisler , Jerome Glisse , Andrea Arcangeli , Oleg Nesterov , linux-alpha@vger.kernel.org, LKML , linux-snps-arc@lists.infradead.org, linux-ia64@vger.kernel.org, linux-metag@vger.kernel.org, Linux MIPS Mailing List , linux-parisc , PowerPC , linux-s390 , linux-sh , sparclinux , Linux-MM Content-Transfer-Encoding: quoted-printable Message-Id: References: <1521736598-12812-1-git-send-email-blackzert@gmail.com> <20180323124806.GA5624@bombadil.infradead.org> <651E0DB6-4507-4DA1-AD46-9C26ED9792A8@gmail.com> <20180326084650.GC5652@dhcp22.suse.cz> <01A133F4-27DF-4AE2-80D6-B0368BF758CD@gmail.com> <20180327072432.GY5652@dhcp22.suse.cz> <0549F29C-12FC-4401-9E85-A430BC11DA78@gmail.com> <20180327234904.GA27734@bombadil.infradead.org> To: Matthew Wilcox X-Mailer: Apple Mail (2.3445.5.20) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1595656488556903336?= X-GMAIL-MSGID: =?utf-8?q?1596217106267938297?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: > On 28 Mar 2018, at 02:49, Matthew Wilcox wrote: >=20 > On Tue, Mar 27, 2018 at 03:53:53PM -0700, Kees Cook wrote: >> I agree: pushing this off to libc leaves a lot of things unprotected. >> I think this should live in the kernel. The question I have is about >> making it maintainable/readable/etc. >>=20 >> The state-of-the-art for ASLR is moving to finer granularity (over >> just base-address offset), so I'd really like to see this supported = in >> the kernel. We'll be getting there for other things in the future, = and >> I'd like to have a working production example for researchers to >> study, etc. >=20 > One thing we need is to limit the fragmentation of this approach. > Even on 64-bit systems, we can easily get into a situation where there = isn't > space to map a contiguous terabyte. As I wrote before, shift_random is introduced to be fragmentation limit. = Even=20 without it, the main question here is =E2=80=98if we can=E2=80=99t = allocate memory with N size=20 bytes, how many bytes we already allocated?=E2=80=99. =46rom these point = of view I=20 already showed in previous version of patch that if application uses not = so big=20 memory allocations, it will have enough memory to use. If it uses XX = Gigabytes=20 or Terabytes memory, this application has all chances to be exploited = with=20 fully randomization or without. Since it is much easier to find(or = guess) any=20 usable pointer, etc. For the instance you have only 128 terabytes of = memory for=20 user space, so probability to exploit this application is 1/128 what is = not=20 secure at all. This is very rough estimate but I try to make things = easier to=20 understand. Best regards, Ilya