On 03/09/2015 05:03 PM, Kees Cook wrote: > On Mon, Mar 9, 2015 at 4:43 PM, Eric W. Biederman <ebied...@xmission.com> > wrote: >> A 1 to 1 blinding function like integer multiplication mudulo 2^32 by an >> appropriate random number ought to keep from revealing page numbers or >> page ajacencies while not requiring any changes in userspace. >> >> That way the revealed pfn and the physcial pfn would be different but >> you could still use pagemap for it's intended purpose. > > If this could be done in a way where it was sufficiently hard to > expose the random number, we should absolutely do this.
We would need something which is both reversible (so that the given offsets can still be used in /proc/kpagemap) and also hard to do a known-plaintext-type attack on it. Transparent huge pages are a place where userspace knows the relationship between 512 adjacent physical addresses. That represents a good chunk of known data. Surely there are more of these kinds of things. Right now, for instance, the ways in which a series of sequential allocations come out of the page allocator are fairly deterministic. We would also need to do some kind of allocator randomization to ensure that userspace couldn't make good guesses about the physical addresses of things coming out of the allocator. Or, we just be sure and turn the darn thing off. :) -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
