Messages in this thread | | | Date | Mon, 6 Oct 2008 18:44:29 -0700 | From | Kees Cook <> | Subject | Re: [PATCH] ELF: implement AT_RANDOM for future glibc use |
| |
On Mon, Oct 06, 2008 at 05:57:48PM -0700, Ulrich Drepper wrote: > Kees Cook wrote: > > It sounds like it's not very safe, > > Then investigate it.
As was suspected, each int is the same.
> > but on the other hand, glibc doesn't really care? > > Of course we care. Especially for SUID and uid==0 binaries.
I meant based on what was said about "if it's as strong as the ASLR randomness, it's good enough for this". While the ultimate solution would be to bolt a better PRNG into the kernel, is the following good enough for now for glibc:
$ ./rands 0x2b 0x06 0xb7 0x53 0x2b 0x06 0xb7 0x53 0x2b 0x06 0xb7 0x53 0x2b 0x06 0xb7 0x53 $ ./rands 0xc2 0xb5 0x42 0xdc 0xc2 0xb5 0x42 0xdc 0xc2 0xb5 0x42 0xdc 0xc2 0xb5 0x42 0xdc $ ./rands 0x5f 0x39 0xc6 0xc0 0x5f 0x39 0xc6 0xc0 0x5f 0x39 0xc6 0xc0 0x5f 0x39 0xc6 0xc0 $ ./rands 0xfb 0x4a 0x82 0xbd 0xfb 0x4a 0x82 0xbd 0xfb 0x4a 0x82 0xbd 0xfb 0x4a 0x82 0xbd
-Kees
-- Kees Cook Ubuntu Security Team
| |