oss-sec mailing list archives
Re: Linux kernel proactive security hardening
From: Solar Designer <solar () openwall com>
Date: Mon, 8 Nov 2010 06:07:38 +0300
Dan, Vasiliy - On Sun, Nov 07, 2010 at 08:29:07PM -0500, Dan Rosenberg wrote:
I've just posted an RFC for the equivalent of grsecurity's MODHARDEN, which places restrictions on the automatic loading of modules by unprivileged users: http://lkml.org/lkml/2010/11/7/212
We simply don't include module autoloading support in Owl, and we'll continue to do so (it's not something we want on servers anyway, not only because of the security risk), but I am all for the issue getting (partially) addressed in/for other distros. ;-) On a more relevant issue (to us), any ideas on dealing with kernel stack infoleaks in a general manner (not just plugging the bugs one by one)? I guess it could be addressed in gcc (an option to wipe stack frames) or in the kernel (wipe even more of the stack, beyond the stack pointer, on syscall entry). Unfortunately, either has likely measurable performance impact. (BTW, has some of this been implemented somewhere already?) Any other ideas? In the absence of cheap-enough general solution/workaround in the kernel, I'm afraid we'll need to resort to improving and using automated tools to detect bugs of this nature - which is apparently what you and Vasiliy were doing lately? What tools did you use? Thanks, Alexander
Current thread:
- Linux kernel proactive security hardening Kees Cook (Nov 07)
- Re: Linux kernel proactive security hardening Solar Designer (Nov 07)
- Re: Linux kernel proactive security hardening Dan Rosenberg (Nov 07)
- Re: Linux kernel proactive security hardening Solar Designer (Nov 07)
- Re: Linux kernel proactive security hardening Solar Designer (Nov 07)
- Re: Linux kernel proactive security hardening Vasiliy Kulikov (Nov 08)
- Re: Linux kernel proactive security hardening Kees Cook (Nov 10)
- Re: Linux kernel proactive security hardening Dan Rosenberg (Nov 07)
- Re: Linux kernel proactive security hardening Vasiliy Kulikov (Nov 08)
- Re: Linux kernel proactive security hardening Kees Cook (Nov 10)
- Re: Linux kernel proactive security hardening Vasiliy Kulikov (Nov 10)
- Re: Linux kernel proactive security hardening Solar Designer (Nov 07)