Messages in this thread | | | Date | Tue, 21 Jan 2014 10:37:00 -0800 | Subject | Re: [GIT PULL] x86/kaslr for v3.14 | From | Kees Cook <> |
| |
On Tue, Jan 21, 2014 at 6:20 AM, H. Peter Anvin <hpa@zytor.com> wrote: > On 01/21/2014 01:00 AM, Peter Zijlstra wrote: >>> >>> So this is presumably something that needs to be fixed in perf? >> >> Where do we learn about the offset from userspace? > > Now this is tricky... if this offset is too easy to get it completely > defeats kASLR. On the other hand, I presume that if we are exporting > /proc/kcore we're not secure anyway. Kees, I assume that in "secure" > mode perf annotations simply wouldn't work anyway?
The goal scope of the kernel base address randomization is to keep it secret from non-root users, confined processes, and/or remote systems. For local secrecy, if you're running with kaslr and you haven't set kptr_restrict, dmesg_restrict, and perf_event_paranoid, that's a problem since you're likely leaking things trivially through /proc/kallsyms, dmesg, and/or perf.
-Kees
-- Kees Cook Chrome OS Security
| |