diff mbox series

security: keys: add __randomize_layout to keyring_search_context

Message ID 20220518091841.141441-1-gongruiqi1@huawei.com (mailing list archive)
State Handled Elsewhere
Headers show
Series security: keys: add __randomize_layout to keyring_search_context | expand

Commit Message

Gong Ruiqi May 18, 2022, 9:18 a.m. UTC
Struct keyring_search_context contains a pointer to `struct cred`, which
is a security-critical structure and whose layout is randomized already.
Apply __randomize_layout to struct keyring_search_context as well, as
suggested in [1].

[1]: https://github.com/KSPP/linux/issues/188

Signed-off-by: GONG, Ruiqi <gongruiqi1@huawei.com>
---
 security/keys/internal.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Kees Cook May 18, 2022, 8:25 p.m. UTC | #1
On Wed, May 18, 2022 at 09:18:41AM +0000, GONG, Ruiqi wrote:
> Struct keyring_search_context contains a pointer to `struct cred`, which
> is a security-critical structure and whose layout is randomized already.
> Apply __randomize_layout to struct keyring_search_context as well, as
> suggested in [1].
> 
> [1]: https://github.com/KSPP/linux/issues/188
> 
> Signed-off-by: GONG, Ruiqi <gongruiqi1@huawei.com>

Seems reasonable to me; it's an entirely internal structure.

Reviewed-by: Kees Cook <keescook@chromium.org>

> ---
>  security/keys/internal.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/security/keys/internal.h b/security/keys/internal.h
> index 9b9cf3b6fcbb..3e3def5fbaa4 100644
> --- a/security/keys/internal.h
> +++ b/security/keys/internal.h
> @@ -136,7 +136,7 @@ struct keyring_search_context {
>  	bool			possessed;
>  	key_ref_t		result;
>  	time64_t		now;
> -};
> +} __randomize_layout;
>  
>  extern bool key_default_cmp(const struct key *key,
>  			    const struct key_match_data *match_data);
> -- 
> 2.17.1
>
diff mbox series

Patch

diff --git a/security/keys/internal.h b/security/keys/internal.h
index 9b9cf3b6fcbb..3e3def5fbaa4 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -136,7 +136,7 @@  struct keyring_search_context {
 	bool			possessed;
 	key_ref_t		result;
 	time64_t		now;
-};
+} __randomize_layout;
 
 extern bool key_default_cmp(const struct key *key,
 			    const struct key_match_data *match_data);