lkml.org 
[lkml]   [2017]   [Jan]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [RFC] x86/mm/KASLR: Remap GDTs at fixed location

    * Arjan van de Ven <arjan@linux.intel.com> wrote:

    > On 1/5/2017 9:54 AM, Thomas Garnier wrote:
    >
    > > That's my goal too. I started by doing a RO remap and got couple problems with
    > > hibernation. I can try again for the next iteration or delay it for another
    > > patch. I also need to look at KVM GDT usage, I am not familiar with it yet.
    >
    > don't we write to the GDT as part of the TLS segment stuff for glibc ?

    Yes - but the idea would be to have two virtual memory aliases:

    1) A world-readable RO mapping of the GDT put into the fixmap area (randomization
    is not really required as the SGDT instruction exposes it anyway).

    This read-only GDT mapping has two advantages:

    - Because the GDT address is read-only it cannot be used by exploits as an
    easy trampoline for 100% safe, deterministic rooting of the system from a
    local process.

    - Even on older CPUs the SGDT instruction won't expose the absolute address
    of critical kernel data structures.

    2) A kernel-only RW mapping in the linear kernel memory map where the original
    page is - randomized (as a natural part of kernel physical and virtual memory
    randomization) and only known and accessible to the kernel, SGDT doesn't
    expose it even on older CPUs.

    This way we IMHO have the best of both worlds.

    Assuming there are no strange CPU errata surfacing if we use a RO GDT - OTOH that
    should be fairly easy to test for, and worst-case we could quirk-off the feature
    on CPUs where this cannot be done safely.

    Thanks,

    Ingo

    \
     
     \ /
      Last update: 2017-01-06 07:46    [W:4.664 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site