Previously:
v4.12.
Here s a short summary of some of interesting security things in Sunday s v4.13 release of the Linux kernel:
security documentation ReSTification
The kernel has been switching to formatting documentation with
ReST, and I noticed that none of the
Documentation/security/ tree had been converted yet. I
took the opportunity to take a few passes at formatting the existing documentation and, at Jon Corbet s recommendation, split it up between
end-user documentation (which is mainly how to use LSMs) and
developer documentation (which is mainly how to use various internal APIs). A bunch of these docs need some updating, so maybe with the improved visibility, they ll get some extra attention.
CONFIG_REFCOUNT_FULL
Since Peter Zijlstra implemented the
refcount_t API in v4.11, Elena Reshetova (with Hans Liljestrand and David Windsor) has been systematically replacing
atomic_t reference counters with
refcount_t. As of v4.13, there are now
close to 125 conversions with many more to come. However, there were concerns over the performance characteristics of the
refcount_t implementation from the maintainers of the net, mm, and block subsystems. In order to assuage these concerns and help the conversion progress continue, I added an unchecked
refcount_t implementation (identical to the earlier
atomic_t implementation) as the default, with the fully checked implementation now available under
CONFIG_REFCOUNT_FULL. The plan is that for v4.14 and beyond, the kernel can grow
per-architecture implementations of refcount_t that have performance characteristics on par with
atomic_t (as done in grsecurity s PAX_REFCOUNT).
CONFIG_FORTIFY_SOURCE
Daniel Micay
created a version of glibc s
FORTIFY_SOURCE compile-time and run-time protection for finding overflows in the common string (e.g.
strcpy,
strcmp) and memory (e.g.
memcpy,
memcmp) functions. The idea is that since the compiler already knows the size of many of the buffer arguments used by these functions, it can already build in checks for buffer overflows. When all the sizes are known at compile time, this can actually allow the compiler to fail the build instead of continuing with a proven overflow. When only some of the sizes are known (e.g. destination size is known at compile-time, but source size is only known at run-time) run-time checks are added to catch any cases where an overflow might happen. Adding this
found several places where minor leaks were happening, and Daniel and I chased down fixes for them.
One interesting note about this protection is that is only examines the
size of the whole object for its size (via
__builtin_object_size(..., 0)). If you have a string within a structure,
CONFIG_FORTIFY_SOURCE as currently implemented will make sure only that you can t copy beyond the structure (but therefore, you
can still overflow the string within the structure). The next step in enhancing this protection is to switch from 0 (above) to 1, which will use the closest surrounding subobject (e.g. the string). However, there are a lot of cases where the kernel intentionally copies across multiple structure fields, which means more fixes before this higher level can be enabled.
NULL-prefixed stack canary
Rik van Riel and Daniel Micay changed how the stack canary is defined on 64-bit systems to always make sure that the
leading byte is zero. This provides a deterministic defense against overflowing string functions (e.g.
strcpy), since they will either stop an overflowing read at the NULL byte, or be unable to write a NULL byte, thereby always triggering the canary check. This does reduce the entropy from 64 bits to 56 bits for overflow cases where NULL bytes can be written (e.g.
memcpy), but the trade-off is worth it. (Besdies, x86_64 s canary was 32-bits
until recently.)
IPC refactoring
Partially in support of allowing IPC structure layouts to be randomized by the randstruct plugin, Manfred Spraul and I reorganized the
internal layout of how IPC is tracked in the kernel. The resulting allocations are smaller and much easier to deal with, even if I initially missed a
few needed container_of() uses.
randstruct gcc plugin
I ported grsecurity s clever
randstruct gcc plugin to upstream. This plugin allows structure layouts to be randomized on a per-build basis, providing a probabilistic defense against attacks that need to know the location of sensitive structure fields in kernel memory (which is most attacks). By moving things around in this fashion, attackers need to perform much more work to determine the resulting layout before they can mount a reliable attack.
Unfortunately, due to the timing of the development cycle, only the manual mode of randstruct landed in upstream (i.e.
marking structures with __randomize_layout). v4.14 will also have the
automatic mode enabled, which randomizes all structures that contain only function pointers.
A large number of fixes to support randstruct have been landing from
v4.10 through v4.13, most of which were already identified and fixed by grsecurity, but many were novel, either in newly added drivers, as
whitelisted cross-structure casts,
refactorings (like IPC noted above), or in a
corner case on ARM found during upstream testing.
lower ELF_ET_DYN_BASE
One of the issues identified from the
Stack Clash set of vulnerabilities was that it was possible to collide stack memory with the highest portion of a PIE program s text memory since the default
ELF_ET_DYN_BASE (the lowest possible random position of a PIE executable in memory) was already so high in the memory layout (specifically, 2/3rds of the way through the address space). Fixing this required
teaching the ELF loader how to load interpreters as shared objects in the mmap region instead of as a PIE executable (to avoid potentially colliding with the binary it was loading). As a result, the PIE default could be moved down to ET_EXEC (0x400000) on 32-bit, entirely avoiding the subset of Stack Clash attacks. 64-bit could be moved to just above the 32-bit address space (0x100000000), leaving the entire 32-bit region open for VMs to do 32-bit addressing, but late in the cycle it was discovered that
Address Sanitizer couldn t handle it moving. With most of the Stack Clash risk only applicable to 32-bit, fixing 64-bit has been deferred until there is a way to teach Address Sanitizer how to load itself as a shared object instead of as a PIE binary.
early device randomness
I noticed that early device randomness wasn t actually getting added to the kernel entropy pools, so I
fixed that to improve the effectiveness of the latent_entropy gcc plugin.
That s it for now; please let me know if I missed anything. As a side note, I was rather alarmed to discover that due to all my trivial ReSTification formatting, and tiny FORTIFY_SOURCE and randstruct fixes, I made it into the
most active 4.13 developers list (by patch count) at LWN with 76 patches: a whopping 0.6% of the cycle s patches. ;)
Anyway, the v4.14 merge window is open!
2017, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 License.
Here s a summary of the bugs against the Debian Policy Manual. Please
consider getting involved, whether or not you re an existing
contributor.
Consensus has been reached and help is needed to write a patch
#172436 BROWSER and sensible-browser standardization
#273093 document interactions of multiple clashing package diversions
#299007 Transitioning perms of /usr/local
#314808 Web applications should use /usr/share/package, not /usr/share/doc/
#425523 Describe error unwind when unpacking a package fails
#452393 Clarify difference between required and important priorities
#476810 Please clarify 12.5, Copyright information
#484673 file permissions for files potentially including credential informa
#491318 init scripts should support start/stop/restart/force-reload - why
#556015 Clarify requirements for linked doc directories
#568313 Suggestion: forbid the use of dpkg-statoverride when uid and gid ar
#578597 Recommend usage of dpkg-buildflags to initialize CFLAGS and al.
#582109 document triggers where appropriate
#587991 perl-policy: /etc/perl missing from Module Path
#592610 Clarify when Conflicts + Replaces et al are appropriate
#613046 please update example in 4.9.1 (debian/rules and DEB_BUILD_OPTIONS)
#614807 Please document autobuilder-imposed build-dependency alternative re
#628515 recommending verbose build logs
#664257 document Architecture name definitions
#682347 mark editor virtual package name as obsolete
#685506 copyright-format: new Files-Excluded field
#685746 debian-policy Consider clarifying the use of recommends
#688251 Built-Using description too aggressive
#749826 [multiarch] please document the use of Multi-Arch field in debian/c
#757760 please document build profiles
#759316 Document the use of /etc/default for cron jobs
#761219 document versioned Provides
#767839 Linking documentation of arch:any package to arch:all
#770440 policy should mention systemd timers
#773557 Avoid unsafe RPATH/RUNPATH
#780725 PATH used for building is not specified
#793499 The Installed-Size algorithm is out-of-date
#810381 Update wording of 5.6.26 VCS-* fields to recommend encryption
#823256 Update maintscript arguments with dpkg >= 1.18.5
#833401 virtual packages: dbus-session-bus, dbus-default-session-bus
#835451 Building as root should be discouraged
#838777 Policy 11.8.4 for x-window-manager needs update for freedesktop menus
#845715 Please document that packages are not allowed to write outside thei
#853779 Clarify requirements about update-rc.d and invoke-rc.d usage in mai
#874019 Note that the -e argument to x-terminal-emulator works like
#874206 allow a trailing comma in package relationship fields
Wording proposed, awaiting review from anyone and/or seconds by DDs
#515856 remove get-orig-source
#542288 Versions for native packages, NMU s, and binary only uploads
#582109 document triggers where appropriate
#610083 Remove requirement to document upstream source location in debian/c
#645696 [copyright-format] clearer definitions and more consistent License:
#649530 [copyright-format] clearer definitions and more consistent License:
#662998 stripping static libraries
#682347 mark editor virtual package name as obsolete
#683222 say explicitly that debian/changelog is required in source packages
#688251 Built-Using description too aggressive
#737796 copyright-format: support Files: paragraph with both abbreviated na
#756835 Extension of the syntax of the Packages-List field.
#786470 [copyright-format] Add an optional License-Grant field
#810381 Update wording of 5.6.26 VCS-* fields to recommend encryption
#835451 Building as root should be discouraged
#845255 Include best practices for packaging database applications
#850729 Documenting special version number suffixes
#874090 Clarify wording of some passages
#874095 copyright-format: Use the synopsis term established in the de
Merged for the next release
#661928 recipe for determining shlib package name
#679751 please clarify package account and home directory location in policy
#683222 say explicitly that debian/changelog is required in source packages
#870915 [5.6.30] Testsuite: There are much more defined values
#872893 Chapters, sections, appendices and numbering
#872895 Include multi-page HTML in package
#872896 An html.tar.gz has leaked into the .deb?
#872900 Very generic info file name
#872950 Too much indirection in info file menus
#873819 upgrading-checklist.txt: typo pgpsignurlmangle in section 4.11 of V
#874411 missing line breaks in summary of ways maintainers scripts are call
I d like to start making weekly reports again on my free software efforts. Part of the reason for these reports is for me to see how much time I m putting into free software. Hopefully I can keep these reports up.
This week's energy was provided by Club Mate
Like 
This would be a longish piece so please bear and play with tea, coffee, beer or anything stronger that you desire while reading below 
I had bought an Android phone, a 
The reason I shared about Developer Options in Android is that few days back I noticed that the phone wonks off and has unpredictable behaviour such as not letting me browse the web, do additions or deletions using the google play store and alike . Things came to a head when few days back I saw a fibre-optic 
Welcome to gambaru.de. Here is my monthly report that covers what I have been doing for Debian. If you re interested in Java, Games and LTS topics, this might be interesting for you.
DebConf 17 in Montreal
I traveled to 
I ve been using 
Yesterday, at the 
During DebConf 17 in Montr al I had a FAI demo session
(
For a number of years now there has been growing concern that the management technologies in recent Intel CPUs (ME, AMT and vPro) also conceal capabilities for spying, either due to design flaws (no software is perfect) or backdoors deliberately installed for US spy agencies, 
and filesystem changes (!!). En vrac, a list of
changes which may be of interest:
Shockingly enough, my focus started out on 