Messages in this thread | | | Date | Tue, 18 Oct 2022 22:05:26 -0700 | From | Kees Cook <> | Subject | Re: [PATCH] x86/ibt: Implement FineIBT |
| |
On Tue, Oct 18, 2022 at 09:59:02PM +0200, Peter Zijlstra wrote: > On Tue, Oct 18, 2022 at 11:09:13AM -0700, Kees Cook wrote: > > > An improvement for kCFI would be to mutate all the hashes both at build > > time (perhaps using the same seed infrastructure that randstruct depends > > on for sharing a seed across compilation units), and at boot time, so > > an actual .text content exposure is needed to find the target hash value. > > What's the purpose of the build time randomization?
I was just considering options if run-time was too onerous.
> Find here the boot > time randomization (on top of my other patch).
Which it's clearly not. :P Nice!
> [...] > static enum cfi_mode cfi_mode __ro_after_init = CFI_DEFAULT; > +static bool cfi_rand __ro_after_init = true; > +static u32 cfi_seed __ro_after_init;
This is saved because we need to fix up modules, yes? I look forward to fine-grain randomization of the .data section. ;)
> [...] > +static int cfi_rand_preamble(s32 *start, s32 *end) > +{ > + s32 *s; > + > + for (s = start; s < end; s++) { > + void *addr = (void *)s + *s; > + u32 hash; > + > + hash = decode_preamble_hash(addr); > + if (WARN(!hash, "no CFI hash found at: %pS %px %*ph\n", > + addr, addr, 5, addr)) > + return -EINVAL; > + > + hash ^= cfi_seed; > + text_poke_early(addr + 1, &hash, 4); > + } > + > + return 0; > +}
The one glitch here is that the resulting hash needs to not contain an endbr...
Otherwise, yes, this looks lovely. Thank you!
-- Kees Cook
| |