Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752839AbcDFSbx (ORCPT ); Wed, 6 Apr 2016 14:31:53 -0400 Received: from mail-io0-f194.google.com ([209.85.223.194]:34110 "EHLO mail-io0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752682AbcDFSbw (ORCPT ); Wed, 6 Apr 2016 14:31:52 -0400 MIME-Version: 1.0 In-Reply-To: <5e5e7c7ced7bede343530ed1447d7453@abdsec.com> References: <1459947782-5071-1-git-send-email-ed@abdsec.com> <5e5e7c7ced7bede343530ed1447d7453@abdsec.com> Date: Wed, 6 Apr 2016 11:31:50 -0700 X-Google-Sender-Auth: yGlqPgQvMddBlKvORvN26X_qZMo Message-ID: Subject: Re: [PATCH] KERNEL: resource: Fix bug on leakage in /proc/iomem file From: Linus Torvalds To: Emrah Demir Cc: Dan Rosenberg , Dave Jones , Kees Cook , Kernel Hardening , Linux Kernel Mailing List Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1489 Lines: 35 On Wed, Apr 6, 2016 at 11:05 AM, wrote: > > Most distros don't use KASLR, but they use kptr_restrict. Without KASLR, > kptr_restirct most likely useless. Well, yes kaslr is effectively useless right now due to the fact that people still use hibernation in effectively every single distro out there. But kptr_restrict was enabled by distro people, and in theory it does end up possibly helping: it at least it hides the exact per-function addresses. Of course, with 99.9% of all users then using a distro kernel, you can just get those remotely anyway by just downloading the distro image, so it turns out that now there is effectively zero bits that you are really hiding, because the information is effectively right there in "uname -a". End result: kptr_restrict is a wonderful flag if all you want to disable is a trivial convenience function that is easy for an attacker to do other ways. Quite frankly, personally I find a lot of security people and patches to be disingenuous for exactly this kind of reason. They look at the small details, and are completely missing the big picture. I'm at the IoT conference right now. "Security" has been a big word this week. "45 billion devices, lack of security, the sky is falling". I don't think we had a lot of people talking about "oh, the cloud service is getting shut down, so now those devices don't even *work*". But that's ok. Because "security" is more important than "reality". Groan. Linus