RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-08-01 Thread Reshetova, Elena
>> The in-stack randomization is really a very small change both code wise and >> logic wise. >> It does not affect real workloads and does not require enablement of other >> features (such as GCC plugins). >> So, I think we should really reconsider its inclusion. >I'd agree: the code is tiny and

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-07-30 Thread Kees Cook
On Mon, Jul 29, 2019 at 11:41:11AM +, Reshetova, Elena wrote: > I want to summarize here the data (including the performance numbers) > and reasoning for the in-stack randomization feature. I have organized > it in a simple set of Q below. Thanks for these! > The in-stack randomization is

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-07-29 Thread Reshetova, Elena
Ingo, Andy, I want to summarize here the data (including the performance numbers) and reasoning for the in-stack randomization feature. I have organized it in a simple set of Q below. Q: Why do we need in-stack per-syscall randomization when we already have all known attack vectors covered with

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-29 Thread Kees Cook
On Wed, May 29, 2019 at 10:13:43AM +, Reshetova, Elena wrote: > On related note: the current prng we have in kernel (prandom) is based on a > *very old* style of prngs, which is basically 4 linear LFSRs xored together. > Nowadays, we have much more powerful prngs that show much better >

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-29 Thread Kees Cook
On Wed, May 29, 2019 at 10:13:43AM +, Reshetova, Elena wrote: > Not sure about ideal params for the whole combination here since security > and performance are basically conflicting with each other (as usual). > So, that's why I was trying to propose to have two version of this: > - one with

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-29 Thread David Laight
From: Reshetova, Elena > Sent: 29 May 2019 11:14 > On related note: the current prng we have in kernel (prandom) is based on a > *very old* style of prngs, which is basically 4 linear LFSRs xored together. I'm no expert here (apart from some knowledge of LFRS/CRC) but even adding the results

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-29 Thread Reshetova, Elena
> I confess I've kind of lost the plot on the performance requirements > at this point. Instead of measuring and evaluating potential > solutions, can we try to approach this from the opposite direction and > ask what the requirements are? > > What's the maximum number of CPU cycles that we are

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-28 Thread Theodore Ts'o
I confess I've kind of lost the plot on the performance requirements at this point. Instead of measuring and evaluating potential solutions, can we try to approach this from the opposite direction and ask what the requirements are? What's the maximum number of CPU cycles that we are allowed to

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-28 Thread Reshetova, Elena
> > With 5 bits there's a ~96.9% chance of crashing the system in an attempt, > > the exploit cannot be used for a range of attacks, including spear > > attacks and fast-spreading worms, right? A crashed and inaccessible > > system also increases the odds of leaving around unfinished attack code >

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-12 Thread Kees Cook
On Sun, May 12, 2019 at 10:02:45AM +0200, Ingo Molnar wrote: > * Kees Cook wrote: > > I still think just using something very simply like rdtsc would be good > > enough. > > > > This isn't meant to be a perfect defense: it's meant to disrupt the > > ability to trivially predict (usually another

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-12 Thread Ingo Molnar
* Kees Cook wrote: > On Sat, May 11, 2019 at 03:45:19PM -0700, Andy Lutomirski wrote: > > ISTM maybe a better first step would be to make get_random_bytes() be > > much faster? :) > > I'm not opposed to that, but I want to make sure we don't break it for > "real" crypto uses... I'm quite

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-11 Thread Kees Cook
On Sat, May 11, 2019 at 03:45:19PM -0700, Andy Lutomirski wrote: > ISTM maybe a better first step would be to make get_random_bytes() be > much faster? :) I'm not opposed to that, but I want to make sure we don't break it for "real" crypto uses... I still think just using something very simply

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-11 Thread Andy Lutomirski
On Thu, May 9, 2019 at 1:43 AM Ingo Molnar wrote: > > > * Reshetova, Elena wrote: > > > > I find it ridiculous that even with 4K blocked get_random_bytes(), > > > which gives us 32k bits, which with 5 bits should amortize the RNG > > > call to something like "once per 6553 calls", we still see

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-09 Thread Ingo Molnar
* Reshetova, Elena wrote: > > I find it ridiculous that even with 4K blocked get_random_bytes(), > > which gives us 32k bits, which with 5 bits should amortize the RNG > > call to something like "once per 6553 calls", we still see 17% > > overhead? It's either a measurement artifact, or

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-09 Thread Reshetova, Elena
> > I find it ridiculous that even with 4K blocked get_random_bytes(), which > > gives us 32k bits, which with 5 bits should amortize the RNG call to > > something like "once per 6553 calls", we still see 17% overhead? It's > > either a measurement artifact, or something doesn't compute. > > If

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-09 Thread Reshetova, Elena
> * Reshetova, Elena wrote: > > > > * Reshetova, Elena wrote: > > > > > > > CONFIG_PAGE_TABLE_ISOLATION=n: > > > > > > > > base: Simple syscall: 0.0510 > > > > microseconds > > > > get_random_bytes(4096 bytes buffer): Simple syscall: 0.0597 > > > >

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-08 Thread Ingo Molnar
* Reshetova, Elena wrote: > > * Reshetova, Elena wrote: > > > > > CONFIG_PAGE_TABLE_ISOLATION=n: > > > > > > base: Simple syscall: 0.0510 microseconds > > > get_random_bytes(4096 bytes buffer): Simple syscall: 0.0597 microseconds > > > > > > So, pure speed

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-08 Thread Reshetova, Elena
> * Reshetova, Elena wrote: > > > CONFIG_PAGE_TABLE_ISOLATION=n: > > > > base: Simple syscall: 0.0510 microseconds > > get_random_bytes(4096 bytes buffer): Simple syscall: 0.0597 microseconds > > > > So, pure speed wise get_random_bytes() with 1 page per-cpu

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-08 Thread Ingo Molnar
* Reshetova, Elena wrote: > CONFIG_PAGE_TABLE_ISOLATION=n: > > base: Simple syscall: 0.0510 microseconds > get_random_bytes(4096 bytes buffer): Simple syscall: 0.0597 microseconds > > So, pure speed wise get_random_bytes() with 1 page per-cpu buffer wins.

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-08 Thread Reshetova, Elena
.. > > rdrand (calling every 8 syscalls): Simple syscall: 0.0795 microseconds > > You could try something like: > u64 rand_val = cpu_var->syscall_rand > > while (unlikely(rand_val == 0)) > rand_val = rdrand64(); > > stack_offset = rand_val & 0xff; >

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-06 Thread Reshetova, Elena
> * Andy Lutomirski wrote: > > > Or we decide that calling get_random_bytes() is okay with IRQs off and > > this all gets a bit simpler. > > BTW., before we go down this path any further, is the plan to bind this > feature to a real CPU-RNG capability, i.e. to the RDRAND instruction, > which

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-06 Thread Reshetova, Elena
> From: Reshetova, Elena > > Sent: 03 May 2019 17:17 > ... > > rdrand (calling every 8 syscalls): Simple syscall: 0.0795 microseconds > > You could try something like: > u64 rand_val = cpu_var->syscall_rand > > while (unlikely(rand_val == 0)) > rand_val = rdrand64(); >

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-06 Thread Reshetova, Elena
>> On Fri, May 3, 2019 at 9:40 AM David Laight wrote: > > > > That gives you 10 system calls per rdrand instruction > > and mostly takes the latency out of line. > > Do we really want to do this? What is the attack scenario? > > With no VLA's, and the stackleak plugin, what's the upside? Are we

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-03 Thread Linus Torvalds
On Fri, May 3, 2019 at 9:40 AM David Laight wrote: > > That gives you 10 system calls per rdrand instruction > and mostly takes the latency out of line. Do we really want to do this? What is the attack scenario? With no VLA's, and the stackleak plugin, what's the upside? Are we adding random

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-03 Thread David Laight
From: Reshetova, Elena > Sent: 03 May 2019 17:17 ... > rdrand (calling every 8 syscalls): Simple syscall: 0.0795 microseconds You could try something like: u64 rand_val = cpu_var->syscall_rand while (unlikely(rand_val == 0)) rand_val = rdrand64();

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-03 Thread Andy Lutomirski
> On May 2, 2019, at 9:43 AM, Ingo Molnar wrote: > > > * Andy Lutomirski wrote: > >>> 8 gigabits/sec sounds good throughput in principle, if there's no >>> scalability pathologies with that. >> >> The latency is horrible. > > Latency would be amortized via batching anyway, so 8

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-03 Thread Reshetova, Elena
> * David Laight wrote: > > > It has already been measured - it is far too slow. > > I don't think proper buffering was tested, was it? Only a per syscall > RDRAND overhead which I can imagine being not too good. > Well, I have some numbers, but I am struggling to understand one aspect there.

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-02 Thread Ingo Molnar
* David Laight wrote: > It has already been measured - it is far too slow. I don't think proper buffering was tested, was it? Only a per syscall RDRAND overhead which I can imagine being not too good. > > Because calling tens of millions of system calls per second will > > deplete any

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-02 Thread Ingo Molnar
* Andy Lutomirski wrote: > > 8 gigabits/sec sounds good throughput in principle, if there's no > > scalability pathologies with that. > > The latency is horrible. Latency would be amortized via batching anyway, so 8 gigabits/sec suggests something on the order of magnitude of 4 bits per

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-02 Thread David Laight
From: Ingo Molnar > Sent: 02 May 2019 16:09 > * Andy Lutomirski wrote: > > > Or we decide that calling get_random_bytes() is okay with IRQs off and > > this all gets a bit simpler. > > BTW., before we go down this path any further, is the plan to bind this > feature to a real CPU-RNG

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-02 Thread Andy Lutomirski
On Thu, May 2, 2019 at 8:09 AM Ingo Molnar wrote: > > > * Andy Lutomirski wrote: > > > Or we decide that calling get_random_bytes() is okay with IRQs off and > > this all gets a bit simpler. > > BTW., before we go down this path any further, is the plan to bind this > feature to a real CPU-RNG

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-02 Thread Ingo Molnar
* Andy Lutomirski wrote: > Or we decide that calling get_random_bytes() is okay with IRQs off and > this all gets a bit simpler. BTW., before we go down this path any further, is the plan to bind this feature to a real CPU-RNG capability, i.e. to the RDRAND instruction, which excludes a

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-02 Thread Andy Lutomirski
On Thu, May 2, 2019 at 2:23 AM David Laight wrote: > > From: Reshetova, Elena > > Sent: 02 May 2019 09:16 > ... > > > I'm also guessing that get_cpu_var() disables pre-emption? > > > > Yes, in my understanding: > > > > #define get_cpu_var(var) \ > >

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-02 Thread David Laight
From: Reshetova, Elena > Sent: 02 May 2019 09:16 ... > > I'm also guessing that get_cpu_var() disables pre-emption? > > Yes, in my understanding: > > #define get_cpu_var(var) \ > (*({ \

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-02 Thread Reshetova, Elena
From: Reshetova, Elena > > Sent: 30 April 2019 18:51 > ... > > +unsigned char random_get_byte(void) > > +{ > > +struct rnd_buffer *buffer = _cpu_var(stack_rand_offset); > > +unsigned char res; > > + > > +if (buffer->byte_counter >= RANDOM_BUFFER_SIZE) { > > +

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-02 Thread Reshetova, Elena
> From: Reshetova, Elena > > Sent: 30 April 2019 18:51 > ... > > I guess this is true, so I did a quick implementation now to estimate the > > performance hits. > > Here are the preliminary numbers (proper ones will take a bit more time): > > > > base: Simple syscall: 0.1761 microseconds > >

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-01 Thread Andy Lutomirski
On Wed, May 1, 2019 at 1:42 AM David Laight wrote: > > From: Reshetova, Elena > > Sent: 30 April 2019 18:51 > ... > > +unsigned char random_get_byte(void) > > +{ > > +struct rnd_buffer *buffer = _cpu_var(stack_rand_offset); > > +unsigned char res; > > + > > +if (buffer->byte_counter

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-01 Thread David Laight
From: Reshetova, Elena > Sent: 30 April 2019 18:51 ... > +unsigned char random_get_byte(void) > +{ > +struct rnd_buffer *buffer = _cpu_var(stack_rand_offset); > +unsigned char res; > + > +if (buffer->byte_counter >= RANDOM_BUFFER_SIZE) { > +get_random_bytes(&(buffer->buffer),

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-05-01 Thread David Laight
From: Reshetova, Elena > Sent: 30 April 2019 18:51 ... > I guess this is true, so I did a quick implementation now to estimate the > performance hits. > Here are the preliminary numbers (proper ones will take a bit more time): > > base: Simple syscall: 0.1761 microseconds > get_random_bytes (4096

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-30 Thread Kees Cook
On Tue, Apr 30, 2019 at 10:51 AM Reshetova, Elena wrote: > base: Simple syscall: 0.1761 microseconds > get_random_bytes (4096 bytes per-cpu buffer): 0.1793 microsecons > get_random_bytes (64 bytes per-cpu buffer): 0.1866 microsecons The 4096 size seems pretty good. > Below is a snip of what I

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-30 Thread Reshetova, Elena
> > > On Apr 29, 2019, at 12:46 AM, Reshetova, Elena > wrote: > > > > > On Apr 26, 2019, at 7:01 AM, Theodore Ts'o wrote: > >>> > > > >> It seems to me > >> that we should be using the “fast-erasure” construction for all > get_random_bytes() > >> invocations. Specifically, we should have a

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-29 Thread Andy Lutomirski
> On Apr 29, 2019, at 12:46 AM, Reshetova, Elena > wrote: > > On Apr 26, 2019, at 7:01 AM, Theodore Ts'o wrote: >>> > >> It seems to me >> that we should be using the “fast-erasure” construction for all >> get_random_bytes() >> invocations. Specifically, we should have a per cpu

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-29 Thread Reshetova, Elena
> On Fri, Apr 26, 2019 at 10:01:02AM -0400, Theodore Ts'o wrote: > > On Fri, Apr 26, 2019 at 11:33:09AM +, Reshetova, Elena wrote: > > > Adding Eric and Herbert to continue discussion for the chacha part. > > > So, as a short summary I am trying to find out a fast (fast enough to be > > >

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-29 Thread Reshetova, Elena
> On Fri, Apr 26, 2019 at 11:33:09AM +, Reshetova, Elena wrote: > > Adding Eric and Herbert to continue discussion for the chacha part. > > So, as a short summary I am trying to find out a fast (fast enough to be > > used per > syscall > > invocation) source of random bits with good enough

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-29 Thread Reshetova, Elena
> > On Apr 26, 2019, at 7:01 AM, Theodore Ts'o wrote: > > > >> On Fri, Apr 26, 2019 at 11:33:09AM +, Reshetova, Elena wrote: > >> Adding Eric and Herbert to continue discussion for the chacha part. > >> So, as a short summary I am trying to find out a fast (fast enough to be > >> used per >

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-27 Thread Andy Lutomirski
> On Apr 26, 2019, at 11:02 AM, Theodore Ts'o wrote: > >> On Fri, Apr 26, 2019 at 10:44:20AM -0700, Eric Biggers wrote: >> Would it be possibly to call ChaCha20 through the actual crypto API so that >> SIMD >> instructions (e.g. AVX-2) could be used? That would make it *much* faster. >>

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-26 Thread Andy Lutomirski
> On Apr 26, 2019, at 7:01 AM, Theodore Ts'o wrote: > >> On Fri, Apr 26, 2019 at 11:33:09AM +, Reshetova, Elena wrote: >> Adding Eric and Herbert to continue discussion for the chacha part. >> So, as a short summary I am trying to find out a fast (fast enough to be >> used per syscall

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-26 Thread Theodore Ts'o
On Fri, Apr 26, 2019 at 10:44:20AM -0700, Eric Biggers wrote: > Would it be possibly to call ChaCha20 through the actual crypto API so that > SIMD > instructions (e.g. AVX-2) could be used? That would make it *much* faster. > Also consider AES-CTR with AES-NI instructions. It's not obvious SIMD

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-26 Thread Eric Biggers
On Fri, Apr 26, 2019 at 10:01:02AM -0400, Theodore Ts'o wrote: > On Fri, Apr 26, 2019 at 11:33:09AM +, Reshetova, Elena wrote: > > Adding Eric and Herbert to continue discussion for the chacha part. > > So, as a short summary I am trying to find out a fast (fast enough to be > > used per

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-26 Thread Edgecombe, Rick P
On Fri, 2019-04-26 at 12:33 +0100, Reshetova, Elena wrote: > 1) rdtsc or variations based on it (David proposed some CRC-based variants for > > example) Hi, Could we repeatedly measure the time for a short syscall on a quiet system and estimate the entropy we get from this? In some scenarios the

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-26 Thread Theodore Ts'o
On Fri, Apr 26, 2019 at 11:33:09AM +, Reshetova, Elena wrote: > Adding Eric and Herbert to continue discussion for the chacha part. > So, as a short summary I am trying to find out a fast (fast enough to be used > per syscall > invocation) source of random bits with good enough security

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-26 Thread Reshetova, Elena
> Hi, > > Sorry for the delay - Easter holidays + I was trying to arrange my brain > around > proposed options. > Here what I think our options are with regards to the source of randomness: > > 1) rdtsc or variations based on it (David proposed some CRC-based variants for > example) > 2)

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-25 Thread Reshetova, Elena
> From: Reshetova, Elena > > Sent: 24 April 2019 12:43 > > > > Sorry for the delay - Easter holidays + I was trying to arrange my brain > > around > proposed options. > > Here what I think our options are with regards to the source of randomness: > > > > 1) rdtsc or variations based on it (David

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-24 Thread David Laight
From: Reshetova, Elena > Sent: 24 April 2019 12:43 > > Sorry for the delay - Easter holidays + I was trying to arrange my brain > around proposed options. > Here what I think our options are with regards to the source of randomness: > > 1) rdtsc or variations based on it (David proposed some

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-24 Thread Reshetova, Elena
Hi, Sorry for the delay - Easter holidays + I was trying to arrange my brain around proposed options. Here what I think our options are with regards to the source of randomness: 1) rdtsc or variations based on it (David proposed some CRC-based variants for example) 2) prandom-based options

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-17 Thread David Laight
From: Theodore Ts'o > Sent: 17 April 2019 16:16 > On Wed, Apr 17, 2019 at 09:28:35AM +, David Laight wrote: > > > > If you can guarantee back to back requests on the PRNG then it is probably > > possible to recalculate its state from 'bits of state'/5 calls. > > Depend on the PRNG this might

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-17 Thread Kees Cook
On Wed, Apr 17, 2019 at 10:17 AM Theodore Ts'o wrote: > > On Wed, Apr 17, 2019 at 09:28:35AM +, David Laight wrote: > > > > If you can guarantee back to back requests on the PRNG then it is probably > > possible to recalculate its state from 'bits of state'/5 calls. > > Depend on the PRNG

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-17 Thread Theodore Ts'o
On Wed, Apr 17, 2019 at 09:28:35AM +, David Laight wrote: > > If you can guarantee back to back requests on the PRNG then it is probably > possible to recalculate its state from 'bits of state'/5 calls. > Depend on the PRNG this might be computationally expensive. > For some PRNG it will be

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-17 Thread David Laight
From: Reshetova, Elena > Sent: 16 April 2019 17:47 .. > > It seems though the assumption that we're assuming the attacker has > > arbitrary ability to get the low bits of the stack, so *if* that's > > true, then eventually, you'd be able to get enough samples that you > > could reverse engineer

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-17 Thread Ingo Molnar
* Theodore Ts'o wrote: > It seems though the assumption that we're assuming the attacker has > arbitrary ability to get the low bits of the stack, so *if* that's > true, then eventually, you'd be able to get enough samples that you > could reverse engineer the prandom state. This could

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-16 Thread Reshetova, Elena
> On Tue, Apr 16, 2019 at 11:10:16AM +, Reshetova, Elena wrote: > > > > > > The kernel can execute millions of syscalls per second, I'm pretty sure > > > there's a statistical attack against: > > > > > > * This is a maximally equidistributed combined Tausworthe generator > > > * based on

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-16 Thread Reshetova, Elena
> So a couple of comments; I wasn't able to find the full context for > this patch, and looking over the thread on kernel-hardening from late > February still left me confused exactly what attacks this would help > us protect against (since this isn't my area and I didn't take the > time to read

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-16 Thread Peter Zijlstra
On Tue, Apr 16, 2019 at 11:43:49AM -0400, Theodore Ts'o wrote: > If it's x86 specific, maybe the simplest thing to do is to use RDRAND > if it exists, and fall back to something involving a TSC and maybe > prandom_u32 (assuming on how bad you think the stack leak is going to > be) if RDRAND isn't

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-16 Thread Theodore Ts'o
So a couple of comments; I wasn't able to find the full context for this patch, and looking over the thread on kernel-hardening from late February still left me confused exactly what attacks this would help us protect against (since this isn't my area and I didn't take the time to read all of the

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-16 Thread David Laight
From: Peter Zijlstra > Sent: 16 April 2019 13:08 ... > So the argument against using TSC directly was that it might be easy to > guess most of the TSC bits in timing attack. But IIRC there is fairly > solid evidence that the lowest TSC bits are very hard to guess and might > in fact be a very good

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-16 Thread Peter Zijlstra
On Tue, Apr 16, 2019 at 11:10:16AM +, Reshetova, Elena wrote: > > > > The kernel can execute millions of syscalls per second, I'm pretty sure > > there's a statistical attack against: > > > > * This is a maximally equidistributed combined Tausworthe generator > > * based on code from GNU

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-16 Thread Reshetova, Elena
Adding Theodore & Daniel since I guess they are the best positioned to comment on exact strengths of prandom. See my comments below. > * Reshetova, Elena wrote: > > > > 4) > > > > > > But before you tweak the patch, a more fundamental question: > > > > > > Does the stack offset have to be per

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-16 Thread Ingo Molnar
* Reshetova, Elena wrote: > > 4) > > > > But before you tweak the patch, a more fundamental question: > > > > Does the stack offset have to be per *syscall execution* randomized? > > Which threats does this protect against that a simpler per task syscall > > random offset wouldn't protect

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-15 Thread Reshetova, Elena
Hi Ingo, Thank you for your feedback! See my comments below. > * Elena Reshetova wrote: > > > This is an example of produced assembly code for gcc x86_64: > > > > ... > > add_random_stack_offset(); > > 0x810022e9 callq 0x81459570 > > 0x810022ee movzbl %al,%eax > >

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-15 Thread Ingo Molnar
* Elena Reshetova wrote: > This is an example of produced assembly code for gcc x86_64: > > ... > add_random_stack_offset(); > 0x810022e9 callq 0x81459570 > 0x810022ee movzbl %al,%eax > 0x810022f1 add$0x16,%rax > 0x810022f5 and$0x1f8,%eax >

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-12 Thread Andy Lutomirski
On Thu, Apr 11, 2019 at 10:36 PM Reshetova, Elena wrote: > > > On Wed, Apr 10, 2019 at 3:24 AM Reshetova, Elena > > wrote: > > > > > > > > > > > > On Mon, Apr 08, 2019 at 09:13:58AM +0300, Elena Reshetova wrote: > > > > > > > diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c > > > >

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-11 Thread Reshetova, Elena
> On Wed, Apr 10, 2019 at 3:24 AM Reshetova, Elena > wrote: > > > > > > > > > On Mon, Apr 08, 2019 at 09:13:58AM +0300, Elena Reshetova wrote: > > > > > > diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c > > > > > > index 7bc105f47d21..38ddc213a5e9 100644 > > > > > > ---

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-10 Thread Andy Lutomirski
On Wed, Apr 10, 2019 at 3:24 AM Reshetova, Elena wrote: > > > > > > On Mon, Apr 08, 2019 at 09:13:58AM +0300, Elena Reshetova wrote: > > > > > diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c > > > > > index 7bc105f47d21..38ddc213a5e9 100644 > > > > > --- a/arch/x86/entry/common.c >

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-10 Thread Reshetova, Elena
> > > On Mon, Apr 08, 2019 at 09:13:58AM +0300, Elena Reshetova wrote: > > > > diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c > > > > index 7bc105f47d21..38ddc213a5e9 100644 > > > > --- a/arch/x86/entry/common.c > > > > +++ b/arch/x86/entry/common.c > > > > @@ -35,6 +35,12 @@ > >

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-10 Thread Ingo Molnar
* Reshetova, Elena wrote: > > * Josh Poimboeuf wrote: > > > > > On Mon, Apr 08, 2019 at 09:13:58AM +0300, Elena Reshetova wrote: > > > > diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c > > > > index 7bc105f47d21..38ddc213a5e9 100644 > > > > --- a/arch/x86/entry/common.c > > >

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-10 Thread Reshetova, Elena
> * Josh Poimboeuf wrote: > > > On Mon, Apr 08, 2019 at 09:13:58AM +0300, Elena Reshetova wrote: > > > diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c > > > index 7bc105f47d21..38ddc213a5e9 100644 > > > --- a/arch/x86/entry/common.c > > > +++ b/arch/x86/entry/common.c > > > @@

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-10 Thread Ingo Molnar
* Josh Poimboeuf wrote: > On Mon, Apr 08, 2019 at 09:13:58AM +0300, Elena Reshetova wrote: > > diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c > > index 7bc105f47d21..38ddc213a5e9 100644 > > --- a/arch/x86/entry/common.c > > +++ b/arch/x86/entry/common.c > > @@ -35,6 +35,12 @@ >

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-08 Thread Kees Cook
On Mon, Apr 8, 2019 at 6:31 AM Reshetova, Elena wrote: > Originally I was thinking that in-stack randomization makes sense > only for x86_64, since this is what VMAP stack on x86 depends on. > Without VMAP stack and guard pages, there are easier ways to attack, > so hardening there does not

RE: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-08 Thread Reshetova, Elena
> On Mon, Apr 08, 2019 at 09:13:58AM +0300, Elena Reshetova wrote: > > diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c > > index 7bc105f47d21..38ddc213a5e9 100644 > > --- a/arch/x86/entry/common.c > > +++ b/arch/x86/entry/common.c > > @@ -35,6 +35,12 @@ > > #define

Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

2019-04-08 Thread Josh Poimboeuf
On Mon, Apr 08, 2019 at 09:13:58AM +0300, Elena Reshetova wrote: > diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c > index 7bc105f47d21..38ddc213a5e9 100644 > --- a/arch/x86/entry/common.c > +++ b/arch/x86/entry/common.c > @@ -35,6 +35,12 @@ > #define CREATE_TRACE_POINTS >