Re: [RFC PATCH] selinux: randomize layout of key structures

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, Dec 16, 2019 at 9:21 AM Stephen Smalley <sds@xxxxxxxxxxxxx> wrote:
> On 12/14/19 1:50 PM, Dan Aloni wrote:
> > On Fri, Dec 13, 2019 at 03:28:38PM -0500, Stephen Smalley wrote:
> >> I would have expected that two kernels built with the same config
> >> with this enabled would have yielded different struct layouts in
> >> pahole vmlinux output, but that doesn't appear to be the case. They
> >> do have different seeds.  Am I doing something wrong?
> >> Also, does DEBUG_INFO_BTF effectively undermine/negate the benefits of this
> >> change if enabled?
> >
> > There's currently a long-standing bug with the GCC plugin where the
> > generated debug info is in declaration order, not build order (see:
> > [1]).  So, to verify it, try looking at the generated machine code.
>
> Thanks for that clarification; I can see in the code that the struct
> layout has changed between the two kernel builds.

This likely falls under the category of stupid questions, but I'm
assuming it passed the test suite w/o problems and the system
generally ran as expected?

I've also heard some comments about performance concerns, have you
done any testing?  I'm guessing that isn't a major concern here
because I don't recall any of the structs marked in this patch going
through any optimizations, but I could be forgetting something (or
missing a performance concern with RANDSTRUCT).

-- 
paul moore
www.paul-moore.com



[Index of Archives]     [Selinux Refpolicy]     [Linux SGX]     [Fedora Users]     [Fedora Desktop]     [Yosemite Photos]     [Yosemite Camping]     [Yosemite Campsites]     [KDE Users]     [Gnome Users]

  Powered by Linux