lkml.org 
[lkml]   [2017]   [Aug]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH] init: Move stack canary initialization after setup_arch
On Wed, Aug 16, 2017 at 12:09 PM, Laura Abbott <labbott@redhat.com> wrote:
> From: Laura Abbott <lauraa@codeaurora.org>
>
> Stack canary intialization involves getting a random number.
> Getting this random number may involve accessing caches or other
> architectural specific features which are not available until
> after the architecture is setup. Move the stack canary initialization
> later to accomodate this.
>
> Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
> Signed-off-by: Laura Abbott <labbott@redhat.com>
> ---
> This was a patch I did a while ago as part of some out of tree work to make the
> stack canary randomized on arm. The overall work didn't really go anywhere
> but there is interest in this part for other approaches to adding randomeness.
>
> I can re-send with more Cc for anyone else who might have opinions.

Combined with adding the kernel cmdline to entropy, this would be
desirable. This should probably go via -mm (as far a CCs go).

> ---
> init/main.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/init/main.c b/init/main.c
> index 052481fbe363..c71c4451094c 100644
> --- a/init/main.c
> +++ b/init/main.c
> @@ -515,11 +515,7 @@ asmlinkage __visible void __init start_kernel(void)
> smp_setup_processor_id();
> debug_objects_early_init();
>
> - /*
> - * Set up the initial canary ASAP:
> - */
> add_latent_entropy();
> - boot_init_stack_canary();

Please move the entropy call too, since that should be just before the
stack canary initialization (in an effort to gather as much as
possible).

>
> cgroup_init_early();
>
> @@ -534,6 +530,10 @@ asmlinkage __visible void __init start_kernel(void)
> page_address_init();
> pr_notice("%s", linux_banner);
> setup_arch(&command_line);
> + /*
> + * Set up the the initial canary ASAP:

Maybe change "ASAP" to "after reasonable entropy has been gathered"

> + */
> + boot_init_stack_canary();
> mm_init_cpumask(&init_mm);
> setup_command_line(command_line);
> setup_nr_cpu_ids();
> --
> 2.13.0
>

Thanks!

-Kees


--
Kees Cook
Pixel Security

\
 
 \ /
  Last update: 2017-08-16 21:31    [W:2.158 / U:0.400 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site