Messages in this thread |  | | Date | Mon, 16 Dec 2013 00:17:55 -0500 | From | Sasha Levin <> | Subject | Re: [PATCH 1/9] Known exploit detection |
| |
Hi Vegard,
On 12/12/2013 11:52 AM, vegard.nossum@oracle.com wrote: > +#ifdef CONFIG_EXPLOIT_DETECTION > +extern void _exploit(const char *id);
So right now the on/off switch is a kernel config option. I suggest we should add another dynamic switch (maybe in the form of jump labels) to add an additional level of control:
- It will allow having an opt-in option. Right now users are forced into having this feature if the distro maintainers enable it. - Which means that distro maintainers are less likely to enable it.
- If the SHTF and there's something wrong we would want a way to disable it without having to re-compile the kernel.
<bikeshedding> Also,
Maybe in the future we could enable/disable specific exploits based on severity or certainty (how likely that this specific activity is an exploit attempt).
</bikeshedding>
On 12/12/2013 11:52 AM, vegard.nossum@oracle.com wrote: > +#define exploit_on(cond, id) \ > + do { \ > + if (unlikely(cond)) \ > + _exploit(id); \ > + } while (0)
What if we make exploit_on() something like this:
#define exploit_on(cond, id) ({ \ int __ret_exploit_on = !!(cond); \ if (unlikely(__ret_exploit_on)) \ _exploit(id); \ unlikely(__ret_exploit_on); \ })
That way we can use it within if() conditionals similar to WARN_ON:
if (exploit_on(srclen > HFS_NAMELEN, "CVE-2011-4330")) srclen = HFS_NAMELEN;
Thanks, Sasha
|  |