Messages in this thread | | | From | Kees Cook <> | Date | Thu, 23 Jun 2016 12:59:07 -0700 | Subject | Re: [kernel-hardening] [PATCH v7 0/9] x86/mm: memory area address KASLR |
| |
On Thu, Jun 23, 2016 at 12:45 PM, Sandy Harris <sandyinchina@gmail.com> wrote: > Jason Cooper <jason@lakedaemon.net> wrote: > >> Modern systems that receive a seed from the bootloader via the >> random-seed property (typically from the hw-rng) can mix both sources >> for increased resilience. >> >> Unfortunately, I'm not very familiar with the internals of x86 >> bootstrapping. Could GRUB be scripted to do a similar task? How would >> the address and size of the seed be passed to the kernel? command line? > > One suggestion is at: > http://www.av8n.com/computer/htm/secure-random.htm#sec-boot-image
Interesting! This might pose a problem for signed images, though. (Actually, for signed arm kernels is the DT signed too? If so, it would be a similar problem.)
-Kees
-- Kees Cook Chrome OS & Brillo Security
| |