Re: [kernel-hardening] Re: [PATCH v3 03/31] usercopy: Mark kmalloc caches as usercopy caches
On Thu, Sep 21, 2017 at 9:04 AM, Christopher Lameter wrote: > On Thu, 21 Sep 2017, Kees Cook wrote: > >> > So what is the point of this patch? >> >> The DMA kmalloc caches are not whitelisted: > > The DMA kmalloc caches are pretty obsolete and mostly there for obscure > drivers. > > ?? They may be obsolete, but they're still in the kernel, and they aren't copied to userspace, so we can mark them. >> >> kmalloc_dma_caches[i] = create_kmalloc_cache(n, >> >> - size, SLAB_CACHE_DMA | flags); >> >> + size, SLAB_CACHE_DMA | flags, 0, 0); >> >> So this is creating the distinction between the kmallocs that go to >> userspace and those that don't. The expectation is that future work >> can start to distinguish between "for userspace" and "only kernel" >> kmalloc allocations, as is already done here for DMA. > > The creation of the kmalloc caches in earlier patches already setup the > "whitelisting". Why do it twice? Patch 1 is to allow for things to mark their whitelists. Patch 30 disables the full whitelisting, since then we've defined them all, so the kmalloc caches need to mark themselves as whitelisted. Patch 1 leaves unmarked things whitelisted so we can progressively tighten the restriction and have a bisectable series. (i.e. if there is something wrong with one of the whitelists in the series, it will bisect to that one, not the one that removes the global whitelist from patch 1.) -Kees -- Kees Cook Pixel Security
Re: [kernel-hardening] Re: [PATCH v3 03/31] usercopy: Mark kmalloc caches as usercopy caches
On Thu, 21 Sep 2017, Kees Cook wrote: > > So what is the point of this patch? > > The DMA kmalloc caches are not whitelisted: The DMA kmalloc caches are pretty obsolete and mostly there for obscure drivers. ?? > >> kmalloc_dma_caches[i] = create_kmalloc_cache(n, > >> - size, SLAB_CACHE_DMA | flags); > >> + size, SLAB_CACHE_DMA | flags, 0, 0); > > So this is creating the distinction between the kmallocs that go to > userspace and those that don't. The expectation is that future work > can start to distinguish between "for userspace" and "only kernel" > kmalloc allocations, as is already done here for DMA. The creation of the kmalloc caches in earlier patches already setup the "whitelisting". Why do it twice?
Re: [kernel-hardening] Re: [PATCH v3 03/31] usercopy: Mark kmalloc caches as usercopy caches
On Thu, Sep 21, 2017 at 8:27 AM, Christopher Lameter wrote: > On Wed, 20 Sep 2017, Kees Cook wrote: > >> --- a/mm/slab.c >> +++ b/mm/slab.c >> @@ -1291,7 +1291,8 @@ void __init kmem_cache_init(void) >>*/ >> kmalloc_caches[INDEX_NODE] = create_kmalloc_cache( >> kmalloc_info[INDEX_NODE].name, >> - kmalloc_size(INDEX_NODE), ARCH_KMALLOC_FLAGS); >> + kmalloc_size(INDEX_NODE), ARCH_KMALLOC_FLAGS, >> + 0, kmalloc_size(INDEX_NODE)); >> slab_state = PARTIAL_NODE; >> setup_kmalloc_cache_index_table(); > > Ok this presumes that at some point we will be able to restrict the number > of bytes writeable and thus set the offset and size field to different > values. Is that realistic? > > We already whitelist all kmalloc caches (see first patch). > > So what is the point of this patch? The DMA kmalloc caches are not whitelisted: >> kmalloc_dma_caches[i] = create_kmalloc_cache(n, >> - size, SLAB_CACHE_DMA | flags); >> + size, SLAB_CACHE_DMA | flags, 0, 0); So this is creating the distinction between the kmallocs that go to userspace and those that don't. The expectation is that future work can start to distinguish between "for userspace" and "only kernel" kmalloc allocations, as is already done here for DMA. -Kees -- Kees Cook Pixel Security
