Messages in this thread | | | Date | Wed, 11 Apr 2012 01:42:06 +0200 | From | Oleg Nesterov <> | Subject | Re: + syscalls-x86-add-__nr_kcmp-syscall-v8.patch added to -mm tree |
| |
On 04/10, H. Peter Anvin wrote: > > On 04/10/2012 04:08 PM, Oleg Nesterov wrote: > > > > OK, since this is discussed again... > > > > Can this comment can also explain why do we obfuscate the pointers > > by type? I mean, I don't really understand why the one-dimensional > > cookies[2] is "not enough" from security pov. > > Because it's cheap. "Just enough" is not what you want to shoot for, > ever, you want to get past the "just enough" point and then consider > "what can I get for cheap at this point"?
OK, I am not arguing. Just I thought that the small note like "we are doing this per-type to obfuscate even more" can help. I wouldn't have asked, but Cyrill rewrites this comment anyway.
Perhaps this is just me, but my first (and wrong) impression was that somehow this is needed for correctness.
Oleg.
| |