Hi, On Fri, Jul 09, 2010 at 02:03:26PM -0700, Roland McGrath wrote: > and Fedora. I figure that eventually some Fedora release cycle will stop > supporting non-PAE hardware anyway and/or officially just not care about > maximal exploit mitigation for non-PAE or ancient hardware. So one day > we'll just drop that patch. Yeah, Ubuntu is in a similar situation, but I fear it's still several years out. It seems like the patches you've got still don't have the brk collision fix I sent[1] a while back? (Looks like the va_randomize fix was done, though.) Also, it looks like the ASLR is seriously flawed. In actual testing, the ASLR in this patch set is extremely predictable due to how it does the reordering, which actually reduces its entropy. :( I haven't worked out a good way to fix it yet, though, but I suspect doing a base offset like is done in mainline is the way to go, though the range is so tiny, I'm not sure how to best deal with it. Maybe wrap around in the SHLIB_BASE through 0x08000000 range? Anyway, running "ldd $(which mysql)" 1000 times sometimes shows libc in the same place almost 500 of those times. Regardless, having a branch rebased on upstream linux would be nice. I've got one here at the moment: http://kernel.ubuntu.com/git?p=kees/linux-2.6.git;a=shortlog;h=refs/heads/nx-emu It looks like you've added a few more CONFIG_X86_32 checks, but not as many as I've got still. Have you got any feedback on the patches I'm carrying here? Thanks, -Kees [1] first hunk of http://kernel.ubuntu.com/git?p=ubuntu/ubuntu-maverick.git;a=commitdiff;h=07c4182e1f32e59da7cbc8dde3aff1c8479dad62 -- Kees Cook Ubuntu Security Team _______________________________________________ kernel mailing list kernel@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/kernel
