Re: Future of STACKLEAK plugin?
On Mon, Mar 12, 2018 at 10:06 AM, Kees Cookwrote: > > I was curious, after the last week of discussion, what you thought of > the future of Alexander's port of the STACKLEAK plugin[0]. Given that > there is progress being made (by at least 8 people at last count) to > actually remove VLAs (and bogus warnings)[1], and that there appears > to be consensus[2] on the approach for how to deal with uninitialized > stack variables, this still leaves an aspect of STACKLEAK unaddressed, > which is reducing the lifetime of stack content validity. Honestly, I consider that to be one of those crazy patches that people can apply if they want to, but that there is no point in having upstream. Hundreds of extra lines of assembly for something that isn't even a leak or a theoretical fix, when there is a better model for just improving the compiler? Yeah, no. The fact is, people can do their own thing. But for it to make sense _mainline_, it has to improve kernel development, and I don't see it doing that. I just haven't seen an argument for why it makes sense to do the belt-and-suspenders-and-glue-your-pants-on approach. Linus
Re: Future of STACKLEAK plugin?
On Mon, Mar 12, 2018 at 10:06 AM, Kees Cook wrote: > > I was curious, after the last week of discussion, what you thought of > the future of Alexander's port of the STACKLEAK plugin[0]. Given that > there is progress being made (by at least 8 people at last count) to > actually remove VLAs (and bogus warnings)[1], and that there appears > to be consensus[2] on the approach for how to deal with uninitialized > stack variables, this still leaves an aspect of STACKLEAK unaddressed, > which is reducing the lifetime of stack content validity. Honestly, I consider that to be one of those crazy patches that people can apply if they want to, but that there is no point in having upstream. Hundreds of extra lines of assembly for something that isn't even a leak or a theoretical fix, when there is a better model for just improving the compiler? Yeah, no. The fact is, people can do their own thing. But for it to make sense _mainline_, it has to improve kernel development, and I don't see it doing that. I just haven't seen an argument for why it makes sense to do the belt-and-suspenders-and-glue-your-pants-on approach. Linus
Future of STACKLEAK plugin?
Hi Linus, I was curious, after the last week of discussion, what you thought of the future of Alexander's port of the STACKLEAK plugin[0]. Given that there is progress being made (by at least 8 people at last count) to actually remove VLAs (and bogus warnings)[1], and that there appears to be consensus[2] on the approach for how to deal with uninitialized stack variables, this still leaves an aspect of STACKLEAK unaddressed, which is reducing the lifetime of stack content validity. We have options available for heap memory poison-on-free[3] (which can serve both as a debugging feature and a security feature), but we continue not to have this for the stack. I'd still like to be able to provide coverage here. AIUI, your objections revolved around not directly addressing the VLA and uninit cases (which are now underway). Would you reconsider your NACK, and if not, what do you think the right approach would be for performing stack clearing at the end of syscalls? Thanks! -Kees [0] http://www.openwall.com/lists/kernel-hardening/2018/03/03/7 [1] https://patchwork.kernel.org/project/LKML/list/?q=VLA [2] https://marc.info/?l=kernel-hardening=152036383124266=2 [3] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/mm/Kconfig.debug?h=v4.15#n42 -- Kees Cook Pixel Security
Future of STACKLEAK plugin?
Hi Linus, I was curious, after the last week of discussion, what you thought of the future of Alexander's port of the STACKLEAK plugin[0]. Given that there is progress being made (by at least 8 people at last count) to actually remove VLAs (and bogus warnings)[1], and that there appears to be consensus[2] on the approach for how to deal with uninitialized stack variables, this still leaves an aspect of STACKLEAK unaddressed, which is reducing the lifetime of stack content validity. We have options available for heap memory poison-on-free[3] (which can serve both as a debugging feature and a security feature), but we continue not to have this for the stack. I'd still like to be able to provide coverage here. AIUI, your objections revolved around not directly addressing the VLA and uninit cases (which are now underway). Would you reconsider your NACK, and if not, what do you think the right approach would be for performing stack clearing at the end of syscalls? Thanks! -Kees [0] http://www.openwall.com/lists/kernel-hardening/2018/03/03/7 [1] https://patchwork.kernel.org/project/LKML/list/?q=VLA [2] https://marc.info/?l=kernel-hardening=152036383124266=2 [3] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/mm/Kconfig.debug?h=v4.15#n42 -- Kees Cook Pixel Security