[PATCH] Add swich to enable/disable re-link the kernel at startup

classic Classic list List threaded Threaded
8 messages Options
Reply | Threaded
Open this post in threaded view
|

[PATCH] Add swich to enable/disable re-link the kernel at startup

Ricardo Fraile
Hi all,

As exists the variable "library_aslr" to disable library randomization
on rc, it would be helpful to have the same option for the kernel. Here
is the patch to add the "kernel_aslr" swich.

Regards,
Ricardo F.


diff --git etc/rc etc/rc
index 9a3917986cc..df2abbaa652 100644
--- etc/rc
+++ etc/rc
@@ -615,7 +615,9 @@ echo '.'

  # Re-link the kernel, placing the objects in a random order.
  # Replace current with relinked kernel and inform root about it.
-/usr/libexec/reorder_kernel &
+if [[ $kernel_aslr == YES ]]; then
+ /usr/libexec/reorder_kernel &
+fi

  date
  exit 0
diff --git etc/rc.conf etc/rc.conf
index a513b7575d4..30d1ca8953b 100644
--- etc/rc.conf
+++ etc/rc.conf
@@ -101,6 +101,7 @@ multicast=NO # Reject IPv4 multicast packets by
default
  # miscellaneous other flags
  amd_master=/etc/amd/master # AMD 'master' map
  library_aslr=YES # set to NO to disable library randomization
+kernel_aslr=YES # set to NO to disable kernel randomization
  savecore_flags= # "-z" to compress
  spamd_black=NO # set to YES to run spamd without greylisting
  shlib_dirs= # extra directories for ldconfig, separated
diff --git etc/rc.d/rc.subr etc/rc.d/rc.subr
index 6a8e05e3b3e..3dafbba3e7e 100644
--- etc/rc.d/rc.subr
+++ etc/rc.d/rc.subr
@@ -140,8 +140,9 @@ _rc_parse_conf() {
  typeset -l _key
  local _l _rcfile _val
  set -A _allowed_keys -- \
- accounting amd_master check_quotas ipsec library_aslr \
- multicast nfs_server pexp pf pkg_scripts shlib_dirs spamd_black
+ accounting amd_master check_quotas ipsec kernel_aslr \
+ library_aslr multicast nfs_server pexp pf pkg_scripts \
+ shlib_dirs spamd_black

  [ $# -gt 0 ] || set -- /etc/rc.conf /etc/rc.conf.local
  for _rcfile; do

Reply | Threaded
Open this post in threaded view
|

Re: [PATCH] Add swich to enable/disable re-link the kernel at startup

Stuart Henderson
On 2019/05/19 13:04, Ricardo Fraile wrote:
> Hi all,
>
> As exists the variable "library_aslr" to disable library randomization on
> rc, it would be helpful to have the same option for the kernel. Here is the
> patch to add the "kernel_aslr" swich.

I don't think an "easy" option for this should be given, if somebody
disables kernel_aslr they need to know what they're doing and be fully
responsible - syspatch relies on it.

Reply | Threaded
Open this post in threaded view
|

Re: [PATCH] Add swich to enable/disable re-link the kernel at startup

Paul de Weerd
In reply to this post by Ricardo Fraile
On Sun, May 19, 2019 at 01:04:53PM +0200, Ricardo Fraile wrote:
| Hi all,
|
| As exists the variable "library_aslr" to disable library randomization on
| rc, it would be helpful to have the same option for the kernel. Here is the
| patch to add the "kernel_aslr" swich.

If you must do this: `doas sha256 -h /var/db/kernel.SHA256 /dev/null`

To undo: `doas sha256 -h /var/db/kernel.SHA256 /bsd`

You can put these in a simple script to make it easier for you, or in
/etc/rc.local to survive upgrades.


However, library_aslr delays the boot sequence (because libraries must
be completed before the system can boot up) while kernel_aslr does not
- it only introduces a bit of extra load on your machine.  What
problem are you trying to solve?

Paul 'WEiRD' de Weerd

| Regards,
| Ricardo F.
|
|
| diff --git etc/rc etc/rc
| index 9a3917986cc..df2abbaa652 100644
| --- etc/rc
| +++ etc/rc
| @@ -615,7 +615,9 @@ echo '.'
|
|  # Re-link the kernel, placing the objects in a random order.
|  # Replace current with relinked kernel and inform root about it.
| -/usr/libexec/reorder_kernel &
| +if [[ $kernel_aslr == YES ]]; then
| + /usr/libexec/reorder_kernel &
| +fi
|
|  date
|  exit 0
| diff --git etc/rc.conf etc/rc.conf
| index a513b7575d4..30d1ca8953b 100644
| --- etc/rc.conf
| +++ etc/rc.conf
| @@ -101,6 +101,7 @@ multicast=NO # Reject IPv4 multicast packets by default
|  # miscellaneous other flags
|  amd_master=/etc/amd/master # AMD 'master' map
|  library_aslr=YES # set to NO to disable library randomization
| +kernel_aslr=YES # set to NO to disable kernel randomization
|  savecore_flags= # "-z" to compress
|  spamd_black=NO # set to YES to run spamd without greylisting
|  shlib_dirs= # extra directories for ldconfig, separated
| diff --git etc/rc.d/rc.subr etc/rc.d/rc.subr
| index 6a8e05e3b3e..3dafbba3e7e 100644
| --- etc/rc.d/rc.subr
| +++ etc/rc.d/rc.subr
| @@ -140,8 +140,9 @@ _rc_parse_conf() {
|   typeset -l _key
|   local _l _rcfile _val
|   set -A _allowed_keys -- \
| - accounting amd_master check_quotas ipsec library_aslr \
| - multicast nfs_server pexp pf pkg_scripts shlib_dirs spamd_black
| + accounting amd_master check_quotas ipsec kernel_aslr \
| + library_aslr multicast nfs_server pexp pf pkg_scripts \
| + shlib_dirs spamd_black
|
|   [ $# -gt 0 ] || set -- /etc/rc.conf /etc/rc.conf.local
|   for _rcfile; do
|

--
>++++++++[<++++++++++>-]<+++++++.>+++[<------>-]<.>+++[<+
+++++++++++>-]<.>++[<------------>-]<+.--------------.[-]
                 http://www.weirdnet.nl/                 

Reply | Threaded
Open this post in threaded view
|

Re: [PATCH] Add swich to enable/disable re-link the kernel at startup

Stuart Henderson
On 2019/05/20 10:46, Paul de Weerd wrote:
> However, library_aslr delays the boot sequence (because libraries must
> be completed before the system can boot up) while kernel_aslr does not
> - it only introduces a bit of extra load on your machine.

That depends if reorder_kernel can run without killing the machine,
it doesn't do very well on my alixes.

Reply | Threaded
Open this post in threaded view
|

Re: [PATCH] Add swich to enable/disable re-link the kernel at startup

Paul de Weerd
Hi Stuart,

On Mon, May 20, 2019 at 12:14:56PM +0100, Stuart Henderson wrote:
| On 2019/05/20 10:46, Paul de Weerd wrote:
| > However, library_aslr delays the boot sequence (because libraries must
| > be completed before the system can boot up) while kernel_aslr does not
| > - it only introduces a bit of extra load on your machine.
|
| That depends if reorder_kernel can run without killing the machine,
| it doesn't do very well on my alixes.

Fair point - for such machines the suggestion from my previous mail to
put the "wrong" hash in /var/db/kernel.SHA256 may help, as alixes tend
to not be super fast and have slow storage.

However, the one alix I still run in production personally doesn't
have too much of an issue with the reorder_kernel run.

Reminds me that I should find some bigger CF to stick in there; 2GB
really doesn't cut it anymore these days.

Cheers,

Paul

--
>++++++++[<++++++++++>-]<+++++++.>+++[<------>-]<.>+++[<+
+++++++++++>-]<.>++[<------------>-]<+.--------------.[-]
                 http://www.weirdnet.nl/                 

Reply | Threaded
Open this post in threaded view
|

Re: [PATCH] Add swich to enable/disable re-link the kernel at startup

Ricardo Fraile
In reply to this post by Paul de Weerd
Hi Paul,

El 2019-05-20 10:46, Paul de Weerd escribió:
| However, library_aslr delays the boot sequence (because libraries must
| be completed before the system can boot up) while kernel_aslr does not
| - it only introduces a bit of extra load on your machine.  What
| problem are you trying to solve?
|

The problem is related with a single core board and the time that need
to pass between the startup of the system and when it can be consider
started to do their target stuff with the right resources.

I understand your suggestion about forcing a failed checksum to verify
/bsd, its clever, but I tried to copy the easy solution that was already
done with the libraries aslr.

You, guys, understand better how the things fits better in the
project...

Thanks,

Reply | Threaded
Open this post in threaded view
|

Re: [PATCH] Add swich to enable/disable re-link the kernel at startup

Stefan Sperling-5
In reply to this post by Paul de Weerd
On Mon, May 20, 2019 at 01:25:17PM +0200, Paul de Weerd wrote:

> Hi Stuart,
>
> On Mon, May 20, 2019 at 12:14:56PM +0100, Stuart Henderson wrote:
> | On 2019/05/20 10:46, Paul de Weerd wrote:
> | > However, library_aslr delays the boot sequence (because libraries must
> | > be completed before the system can boot up) while kernel_aslr does not
> | > - it only introduces a bit of extra load on your machine.
> |
> | That depends if reorder_kernel can run without killing the machine,
> | it doesn't do very well on my alixes.
 
> Reminds me that I should find some bigger CF to stick in there; 2GB
> really doesn't cut it anymore these days.

My alix survives reorder_kernel just fine with 2GB of swap space,
though 1GB would probably be more than sufficient (I just lazily
added all unused paritions as swap and haven't had an issue since).

Reply | Threaded
Open this post in threaded view
|

Re: [PATCH] Add swich to enable/disable re-link the kernel at startup

Paul de Weerd
Hi Stefan,

On Tue, May 21, 2019 at 09:10:51PM +0200, Stefan Sperling wrote:
| > Reminds me that I should find some bigger CF to stick in there; 2GB
| > really doesn't cut it anymore these days.
|
| My alix survives reorder_kernel just fine with 2GB of swap space,
| though 1GB would probably be more than sufficient (I just lazily
| added all unused paritions as swap and haven't had an issue since).

2GB of swap .. wow :)  2GB is the total amount of space on my alix:

[weerd@twix] $ dmesg | grep wd0
wd0 at pciide0 channel 0 drive 0: <SanDisk SDCFX-2048>
wd0: 4-sector PIO, LBA, 1953MB, 4001760 sectors
wd0(pciide0:0:0): using PIO mode 4, Ultra-DMA mode 4
root on wd0a (85814e48b96fac91.a) swap on wd0b dump on wd0b

Ahh!  Found a 4GB CF.  Will upgrade...

--
>++++++++[<++++++++++>-]<+++++++.>+++[<------>-]<.>+++[<+
+++++++++++>-]<.>++[<------------>-]<+.--------------.[-]
                 http://www.weirdnet.nl/