|
 |
047928c |
From 8b8addf891de8a00e4d39fc32f93f7c5eb8feceb Mon Sep 17 00:00:00 2001
|
|
|
047928c |
From: Hector Marco-Gisbert <hecmargi@upv.es>
|
|
|
047928c |
Date: Thu, 10 Mar 2016 20:51:00 +0100
|
|
|
047928c |
Subject: [PATCH] x86/mm/32: Enable full randomization on i386 and X86_32
|
|
|
047928c |
|
|
|
047928c |
Currently on i386 and on X86_64 when emulating X86_32 in legacy mode, only
|
|
|
047928c |
the stack and the executable are randomized but not other mmapped files
|
|
|
047928c |
(libraries, vDSO, etc.). This patch enables randomization for the
|
|
|
047928c |
libraries, vDSO and mmap requests on i386 and in X86_32 in legacy mode.
|
|
|
047928c |
|
|
|
047928c |
By default on i386 there are 8 bits for the randomization of the libraries,
|
|
|
047928c |
vDSO and mmaps which only uses 1MB of VA.
|
|
|
047928c |
|
|
|
047928c |
This patch preserves the original randomness, using 1MB of VA out of 3GB or
|
|
|
047928c |
4GB. We think that 1MB out of 3GB is not a big cost for having the ASLR.
|
|
|
047928c |
|
|
|
047928c |
The first obvious security benefit is that all objects are randomized (not
|
|
|
047928c |
only the stack and the executable) in legacy mode which highly increases
|
|
|
047928c |
the ASLR effectiveness, otherwise the attackers may use these
|
|
|
047928c |
non-randomized areas. But also sensitive setuid/setgid applications are
|
|
|
047928c |
more secure because currently, attackers can disable the randomization of
|
|
|
047928c |
these applications by setting the ulimit stack to "unlimited". This is a
|
|
|
047928c |
very old and widely known trick to disable the ASLR in i386 which has been
|
|
|
047928c |
allowed for too long.
|
|
|
047928c |
|
|
|
047928c |
Another trick used to disable the ASLR was to set the ADDR_NO_RANDOMIZE
|
|
|
047928c |
personality flag, but fortunately this doesn't work on setuid/setgid
|
|
|
047928c |
applications because there is security checks which clear Security-relevant
|
|
|
047928c |
flags.
|
|
|
047928c |
|
|
|
047928c |
This patch always randomizes the mmap_legacy_base address, removing the
|
|
|
047928c |
possibility to disable the ASLR by setting the stack to "unlimited".
|
|
|
047928c |
|
|
|
047928c |
Signed-off-by: Hector Marco-Gisbert <hecmargi@upv.es>
|
|
|
047928c |
Acked-by: Ismael Ripoll Ripoll <iripoll@upv.es>
|
|
|
047928c |
Acked-by: Kees Cook <keescook@chromium.org>
|
|
|
047928c |
Acked-by: Arjan van de Ven <arjan@linux.intel.com>
|
|
|
047928c |
Cc: Linus Torvalds <torvalds@linux-foundation.org>
|
|
|
047928c |
Cc: Peter Zijlstra <peterz@infradead.org>
|
|
|
047928c |
Cc: Thomas Gleixner <tglx@linutronix.de>
|
|
|
047928c |
Cc: akpm@linux-foundation.org
|
|
|
047928c |
Cc: kees Cook <keescook@chromium.org>
|
|
|
047928c |
Link: http://lkml.kernel.org/r/1457639460-5242-1-git-send-email-hecmargi@upv.es
|
|
|
047928c |
Signed-off-by: Ingo Molnar <mingo@kernel.org>
|
|
|
047928c |
---
|
|
|
047928c |
arch/x86/mm/mmap.c | 14 +-------------
|
|
|
047928c |
1 file changed, 1 insertion(+), 13 deletions(-)
|
|
|
047928c |
|
|
|
047928c |
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
|
|
|
047928c |
index 96bd1e2..389939f 100644
|
|
|
047928c |
--- a/arch/x86/mm/mmap.c
|
|
|
047928c |
+++ b/arch/x86/mm/mmap.c
|
|
|
047928c |
@@ -94,18 +94,6 @@ static unsigned long mmap_base(unsigned long rnd)
|
|
|
047928c |
}
|
|
|
047928c |
|
|
|
047928c |
/*
|
|
|
047928c |
- * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
|
|
|
047928c |
- * does, but not when emulating X86_32
|
|
|
047928c |
- */
|
|
|
047928c |
-static unsigned long mmap_legacy_base(unsigned long rnd)
|
|
|
047928c |
-{
|
|
|
047928c |
- if (mmap_is_ia32())
|
|
|
047928c |
- return TASK_UNMAPPED_BASE;
|
|
|
047928c |
- else
|
|
|
047928c |
- return TASK_UNMAPPED_BASE + rnd;
|
|
|
047928c |
-}
|
|
|
047928c |
-
|
|
|
047928c |
-/*
|
|
|
047928c |
* This function, called very early during the creation of a new
|
|
|
047928c |
* process VM image, sets up which VM layout function to use:
|
|
|
047928c |
*/
|
|
|
047928c |
@@ -116,7 +104,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
|
|
|
047928c |
if (current->flags & PF_RANDOMIZE)
|
|
|
047928c |
random_factor = arch_mmap_rnd();
|
|
|
047928c |
|
|
|
047928c |
- mm->mmap_legacy_base = mmap_legacy_base(random_factor);
|
|
|
047928c |
+ mm->mmap_legacy_base = TASK_UNMAPPED_BASE + random_factor;
|
|
|
047928c |
|
|
|
047928c |
if (mmap_is_legacy()) {
|
|
|
047928c |
mm->mmap_base = mm->mmap_legacy_base;
|
|
|
047928c |
--
|
|
|
047928c |
2.7.3
|
|
|
047928c |
|