Kernel Self Protection Project/Work - Revision history

KeesCook: the issue track is canonical now

2020-08-10T18:41:56Z

the issue track is canonical now

← Older revision		Revision as of 18:41, 10 August 2020
Line 1:		Line 1:
	= Work Areas =		= Work Areas =

	The [[Kernel Self Protection Project]] has a lot of work to do! While there are already a number of upstream [[Feature List\|kernel security features]], we are still missing many. ~~The following is far from a comprehensive~~ list, ~~but it's at least a starting point we can add to~~:		The [[Kernel Self Protection Project]] has a lot of work to do! While there are already a number of upstream [[Feature List\|kernel security features]], we are still missing many.

			For the list of specific items and desired features, see the [https://github.com/KSPP/linux/issues KSPP Issue Tracker].

			General concepts and concerns are here:


	== [[Bug Classes]] ==		== [[Bug Classes]] ==
Line 21:		Line 26:
	* [[Exploit Methods/Userspace data usage\|Userspace data usage]]		* [[Exploit Methods/Userspace data usage\|Userspace data usage]]
	* [[Exploit Methods/Reused code chunks\|Reused code chunks]]		* [[Exploit Methods/Reused code chunks\|Reused code chunks]]

	~~= Specific TODO Items =~~

	Besides the general work outlined above, there are number of specific tasks that have either been asked about frequently or are otherwise in need some time and attention. This list below is slightly out of date, and we are transitioning to better tracking here:
	~~https://github.com/KSPP/linux/issues~~

	~~== Kernel items ==~~
	* Split thread_info off of kernel stack (Done: x86, arm64, s390, powerpc. Needed on arm and others?)
	* Move kernel stack to vmap area (Done: x86, s390. Needed on arm, arm64, powerpc and others?)
	* Implement kernel relocation and KASLR for ARM
	* Make CONFIG_STRICT_KERNEL_RWX and CONFIG_STRICT_MODULE_RWX mandatory (done for arm64 and x86, other archs still need it)
	* Further restriction of perf_event_open (e.g. perf_event_paranoid=3)
	* Extend HARDENED_USERCOPY to split user-facing kmalloc()s and in-kernel kmalloc()
	* split short-lived kmalloc()s from long-lived kmalloc()s
	* split user-size-controlled kmalloc()s from regular kmalloc()s
	* protect ARM vector table as fixed-location kernel target
	* disable kuser helpers on arm
	* add constant-blinding tests to lib/test_bpf.c
	* rename CONFIG_DEBUG_LIST better and default=y
	* create defconfig "make" target for by-default hardened Kconfigs
	* expand use of __ro_after_init, especially in arch/arm64
	* restrict autoloading of kernel modules (like GRKERNSEC_MODHARDEN) ([http://www.openwall.com/lists/kernel-hardening/2017/02/02/21 Timgad LSM])
	* set_memory_*() needs __must_check and/or atomicity
	* refactor tasklets to avoid unsigned long argument (WIP: Romain Perier <romain.perier@gmail.com>, "rperier" on FreeNode)
	* have kfree() (and related) set the pointer to NULL too
	* create per-task stack canary (Done: x86, arm, arm64, powerpc. Needed on s390 and others?)
	* deprecate strcpy() in favor of strscpy()
	* deprecate strlcpy() in favor of strscpy()
	* deprecate strncpy() in favor of strscpy(), strscpy_pad(), or str2mem_pad()
	* fix sizeof_field() vs SIZEOF_FIELD() vs FIELD_SIZEOF() (WIP: Shyam Saini <mayhs11saini@gmail.com>)
	* expand use of opt-in mult/div/add/sub overflow wrappers
	* WARN on kfree() of ERR_PTR range (WIP: Shyam Saini <mayhs11saini@gmail.com>)
	* add detection for double-reads
	* add FORTIFY_SOURCE checks to strscpy*()
	* add static_branch for iopl removal (and zeroing?)
	* enhance objtool to search for ROP gadgets
	* signed integer overflow detection
	* unsigned integer overflow detection
	* exec brute force detection

	~~== Compiler items ==~~
	* Write a plugin to do format string warnings correctly (gcc's -Wformat-security is bad about const strings)
	* Finish Clang implementation of __randomize_layout
	* Implement clearing of caller-saved regs (https://github.com/clearlinux-pkgs/gcc/blob/master/zero-regs-gcc8.patch)

KeesCook: /* Specific TODO Items */ add github tracker

2019-11-20T17:43:18Z

Specific TODO Items: add github tracker

← Older revision		Revision as of 17:43, 20 November 2019
Line 24:		Line 24:
	= Specific TODO Items =		= Specific TODO Items =

	Besides the general work outlined above, there are number of specific tasks that have either been asked about frequently or are otherwise in need some time and attention:		Besides the general work outlined above, there are number of specific tasks that have either been asked about frequently or are otherwise in need some time and attention. This list below is slightly out of date, and we are transitioning to better tracking here:
			https://github.com/KSPP/linux/issues

	== Kernel items ==		== Kernel items ==

ChristopheLeroy at 12:20, 31 July 2019

2019-07-31T12:20:02Z

← Older revision		Revision as of 12:20, 31 July 2019
Line 27:		Line 27:

	== Kernel items ==		== Kernel items ==
	* Split thread_info off of kernel stack (Done: x86, arm64, s390. Needed on arm~~, powerpc~~ and others?)		* Split thread_info off of kernel stack (Done: x86, arm64, s390, powerpc. Needed on arm and others?)
	* Move kernel stack to vmap area (Done: x86, s390. Needed on arm, arm64, powerpc and others?)		* Move kernel stack to vmap area (Done: x86, s390. Needed on arm, arm64, powerpc and others?)
	* Implement kernel relocation and KASLR for ARM		* Implement kernel relocation and KASLR for ARM

RomainPerier: /* Kernel items */

2019-07-03T18:13:05Z

Kernel items

← Older revision		Revision as of 18:13, 3 July 2019
Line 43:		Line 43:
	* restrict autoloading of kernel modules (like GRKERNSEC_MODHARDEN) ([http://www.openwall.com/lists/kernel-hardening/2017/02/02/21 Timgad LSM])		* restrict autoloading of kernel modules (like GRKERNSEC_MODHARDEN) ([http://www.openwall.com/lists/kernel-hardening/2017/02/02/21 Timgad LSM])
	* set_memory_*() needs __must_check and/or atomicity		* set_memory_*() needs __must_check and/or atomicity
	* refactor tasklets to avoid unsigned long argument		* refactor tasklets to avoid unsigned long argument (WIP: Romain Perier <romain.perier@gmail.com>, "rperier" on FreeNode)
	* have kfree() (and related) set the pointer to NULL too		* have kfree() (and related) set the pointer to NULL too
	* create per-task stack canary (Done: x86, arm, arm64, powerpc. Needed on s390 and others?)		* create per-task stack canary (Done: x86, arm, arm64, powerpc. Needed on s390 and others?)

RomainPerier: /* Kernel items */

2019-07-01T09:52:58Z

Kernel items

← Older revision		Revision as of 09:52, 1 July 2019
Line 49:		Line 49:
	* deprecate strlcpy() in favor of strscpy()		* deprecate strlcpy() in favor of strscpy()
	* deprecate strncpy() in favor of strscpy(), strscpy_pad(), or str2mem_pad()		* deprecate strncpy() in favor of strscpy(), strscpy_pad(), or str2mem_pad()
	* fix sizeof_field() vs SIZEOF_FIELD() vs FIELD_SIZEOF()		* fix sizeof_field() vs SIZEOF_FIELD() vs FIELD_SIZEOF() (WIP: Shyam Saini <mayhs11saini@gmail.com>)
	* expand use of opt-in mult/div/add/sub overflow wrappers		* expand use of opt-in mult/div/add/sub overflow wrappers
	* WARN on kfree() of ERR_PTR range (WIP: Shyam Saini <mayhs11saini@gmail.com>)		* WARN on kfree() of ERR_PTR range (WIP: Shyam Saini <mayhs11saini@gmail.com>)

RomainPerier: /* Kernel items */

2019-06-27T14:28:53Z

Kernel items

← Older revision		Revision as of 14:28, 27 June 2019
Line 52:		Line 52:
	* expand use of opt-in mult/div/add/sub overflow wrappers		* expand use of opt-in mult/div/add/sub overflow wrappers
	* WARN on kfree() of ERR_PTR range (WIP: Shyam Saini <mayhs11saini@gmail.com>)		* WARN on kfree() of ERR_PTR range (WIP: Shyam Saini <mayhs11saini@gmail.com>)
	* audit and fix all misuse of NLA_STRING (DONE)
	* add detection for double-reads		* add detection for double-reads
	* add FORTIFY_SOURCE checks to strscpy*()		* add FORTIFY_SOURCE checks to strscpy*()

RomainPerier: /* Kernel items */

2019-06-27T14:28:17Z

Kernel items

← Older revision		Revision as of 14:28, 27 June 2019
Line 52:		Line 52:
	* expand use of opt-in mult/div/add/sub overflow wrappers		* expand use of opt-in mult/div/add/sub overflow wrappers
	* WARN on kfree() of ERR_PTR range (WIP: Shyam Saini <mayhs11saini@gmail.com>)		* WARN on kfree() of ERR_PTR range (WIP: Shyam Saini <mayhs11saini@gmail.com>)
	* audit and fix all misuse of NLA_STRING (~~WIP: Romain Perier <romain.perier@gmail.com> (aka "rperier", on IRC)~~)		* audit and fix all misuse of NLA_STRING (DONE)
	* add detection for double-reads		* add detection for double-reads
	* add FORTIFY_SOURCE checks to strscpy*()		* add FORTIFY_SOURCE checks to strscpy*()

RomainPerier: /* Kernel items */

2019-06-10T16:08:59Z

Kernel items

← Older revision		Revision as of 16:08, 10 June 2019
Line 51:		Line 51:
	* fix sizeof_field() vs SIZEOF_FIELD() vs FIELD_SIZEOF()		* fix sizeof_field() vs SIZEOF_FIELD() vs FIELD_SIZEOF()
	* expand use of opt-in mult/div/add/sub overflow wrappers		* expand use of opt-in mult/div/add/sub overflow wrappers
	* WARN on kfree() of ERR_PTR range		* WARN on kfree() of ERR_PTR range (WIP: Shyam Saini <mayhs11saini@gmail.com>)
	* audit and fix all misuse of NLA_STRING (WIP: rperier)		* audit and fix all misuse of NLA_STRING (WIP: Romain Perier <romain.perier@gmail.com> (aka "rperier", on IRC))
	* add detection for double-reads		* add detection for double-reads
	* add FORTIFY_SOURCE checks to strscpy*()		* add FORTIFY_SOURCE checks to strscpy*()

RomainPerier: /* Kernel items */

2019-06-10T16:07:38Z

Kernel items

← Older revision		Revision as of 16:07, 10 June 2019
Line 52:		Line 52:
	* expand use of opt-in mult/div/add/sub overflow wrappers		* expand use of opt-in mult/div/add/sub overflow wrappers
	* WARN on kfree() of ERR_PTR range		* WARN on kfree() of ERR_PTR range
	* audit and fix all misuse of NLA_STRING		* audit and fix all misuse of NLA_STRING (WIP: rperier)
	* add detection for double-reads		* add detection for double-reads
	* add FORTIFY_SOURCE checks to strscpy*()		* add FORTIFY_SOURCE checks to strscpy*()

KeesCook: /* Specific TODO Items */

2019-04-11T21:47:08Z

Specific TODO Items

← Older revision		Revision as of 21:47, 11 April 2019
Line 26:		Line 26:
	Besides the general work outlined above, there are number of specific tasks that have either been asked about frequently or are otherwise in need some time and attention:		Besides the general work outlined above, there are number of specific tasks that have either been asked about frequently or are otherwise in need some time and attention:

			== Kernel items ==
	* Split thread_info off of kernel stack (Done: x86, arm64, s390. Needed on arm, powerpc and others?)		* Split thread_info off of kernel stack (Done: x86, arm64, s390. Needed on arm, powerpc and others?)
	* Move kernel stack to vmap area (Done: x86, s390. Needed on arm, arm64, powerpc and others?)		* Move kernel stack to vmap area (Done: x86, s390. Needed on arm, arm64, powerpc and others?)
	* Implement kernel relocation and KASLR for ARM		* Implement kernel relocation and KASLR for ARM
	* Write a plugin to clear struct padding
	* Write a plugin to do format string warnings correctly (gcc's -Wformat-security is bad about const strings)
	* Make CONFIG_STRICT_KERNEL_RWX and CONFIG_STRICT_MODULE_RWX mandatory (done for arm64 and x86, other archs still need it)		* Make CONFIG_STRICT_KERNEL_RWX and CONFIG_STRICT_MODULE_RWX mandatory (done for arm64 and x86, other archs still need it)
	* Write lib/test_bpf.c tests for eBPF constant blinding
	* Further restriction of perf_event_open (e.g. perf_event_paranoid=3)		* Further restriction of perf_event_open (e.g. perf_event_paranoid=3)
	* Extend HARDENED_USERCOPY to split user-facing ~~malloc~~()s and in-kernel ~~malloc~~(~~)svmalloc stack guard pages (in progress~~)		* Extend HARDENED_USERCOPY to split user-facing kmalloc()s and in-kernel kmalloc()
	* split short-lived kmalloc()s from long-lived kmalloc()s		* split short-lived kmalloc()s from long-lived kmalloc()s
	* split user-size-controlled kmalloc()s from regular kmalloc()s		* split user-size-controlled kmalloc()s from regular kmalloc()s
	* protect ARM vector table as fixed-location kernel target		* protect ARM vector table as fixed-location kernel target
	* disable kuser helpers on arm		* disable kuser helpers on arm
			* add constant-blinding tests to lib/test_bpf.c
	* rename CONFIG_DEBUG_LIST better and default=y		* rename CONFIG_DEBUG_LIST better and default=y
	* add WARN path for page-spanning usercopy checks (instead of the separate CONFIG)
	* create UNEXPECTED(), like BUG() but without the lock-busting, etc
	* create defconfig "make" target for by-default hardened Kconfigs		* create defconfig "make" target for by-default hardened Kconfigs
	* provide mechanism to check for ro_after_init memory areas, and reject structures not marked ro_after_init in vmbus_register()
	* expand use of __ro_after_init, especially in arch/arm64		* expand use of __ro_after_init, especially in arch/arm64
	* restrict autoloading of kernel modules (like GRKERNSEC_MODHARDEN) (~~In progress:~~ [http://www.openwall.com/lists/kernel-hardening/2017/02/02/21 Timgad LSM])		* restrict autoloading of kernel modules (like GRKERNSEC_MODHARDEN) ([http://www.openwall.com/lists/kernel-hardening/2017/02/02/21 Timgad LSM])
	* wire up LKDTM tests to kselftest
	* set_memory_*() needs __must_check and/or atomicity		* set_memory_*() needs __must_check and/or atomicity
	* refactor tasklets to avoid unsigned long argument		* refactor tasklets to avoid unsigned long argument
	* have kfree() (and related) set the pointer to NULL too		* have kfree() (and related) set the pointer to NULL too
	* create per-task stack canary on ~~arm~~ and ~~arm64~~		* create per-task stack canary (Done: x86, arm, arm64, powerpc. Needed on s390 and others?)
			* deprecate strcpy() in favor of strscpy()
			* deprecate strlcpy() in favor of strscpy()
			* deprecate strncpy() in favor of strscpy(), strscpy_pad(), or str2mem_pad()
			* fix sizeof_field() vs SIZEOF_FIELD() vs FIELD_SIZEOF()
			* expand use of opt-in mult/div/add/sub overflow wrappers
			* WARN on kfree() of ERR_PTR range
			* audit and fix all misuse of NLA_STRING
			* add detection for double-reads
			* add FORTIFY_SOURCE checks to strscpy*()
			* add static_branch for iopl removal (and zeroing?)
			* enhance objtool to search for ROP gadgets
			* signed integer overflow detection
			* unsigned integer overflow detection
			* exec brute force detection

			== Compiler items ==
			* Write a plugin to do format string warnings correctly (gcc's -Wformat-security is bad about const strings)
			* Finish Clang implementation of __randomize_layout
			* Implement clearing of caller-saved regs (https://github.com/clearlinux-pkgs/gcc/blob/master/zero-regs-gcc8.patch)