From patchwork Fri Dec 13 20:28:38 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephen Smalley X-Patchwork-Id: 11291039 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 63ADC6C1 for ; Fri, 13 Dec 2019 20:38:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1875E24728 for ; Fri, 13 Dec 2019 20:38:52 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=tycho.nsa.gov header.i=@tycho.nsa.gov header.b="O/5rIwJj" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728837AbfLMU2h (ORCPT ); Fri, 13 Dec 2019 15:28:37 -0500 Received: from UPDC19PA19.eemsg.mail.mil ([214.24.27.194]:58942 "EHLO UPDC19PA19.eemsg.mail.mil" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728696AbfLMU2h (ORCPT ); Fri, 13 Dec 2019 15:28:37 -0500 X-EEMSG-check-017: 38164433|UPDC19PA19_ESA_OUT01.csd.disa.mil X-IronPort-AV: E=Sophos;i="5.69,311,1571702400"; d="scan'208";a="38164433" Received: from emsm-gh1-uea11.ncsc.mil ([214.29.60.3]) by UPDC19PA19.eemsg.mail.mil with ESMTP/TLS/DHE-RSA-AES256-SHA256; 13 Dec 2019 20:28:34 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tycho.nsa.gov; i=@tycho.nsa.gov; q=dns/txt; s=tycho.nsa.gov; t=1576268914; x=1607804914; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=NKMSUYVonUE0kQ8NsbDTxIhmAJASPOrRpBllLU97BQ4=; b=O/5rIwJj0AT7HSg03uhzMjlHBGBIJvDRZINT7Z7ifQ+Ztg79EpfGptk4 FSDDykUIp18OP3H3VEYQJX6Y6/eYPDF4rSjaN21ZPksZujgIKWxSBi70k B7PhICAcCZwmDl22Zq5mXRgzgyjagW5BaWrv2gfZ7lp0U/86LOx+qDQIh lfK6rqytRcTTJ//KbHrSR+/Rj/KcSXWA+jSeVEEIreOFkrPO65EefedV4 dJFlzeTrRANz+DV3GXOFCHC4ZkyLM/Wc5VG5IPBT9SNIW3Aflb4OsiEPz lMwjC4HGY0CCWAeyfuJXb40WKdEV9t+3+ByFKDmpw6K34udyuig3JILe0 w==; X-IronPort-AV: E=Sophos;i="5.69,311,1571702400"; d="scan'208";a="36740856" IronPort-PHdr: 9a23:GEgYVRcovCFk7ByAzerbG59elGMj4u6mDksu8pMizoh2WeGdxcW9bB7h7PlgxGXEQZ/co6odzbaP6Oa5CD1LuM3f+Fk5M7V0HycfjssXmwFySOWkMmbcaMDQUiohAc5ZX0Vk9XzoeWJcGcL5ekGA6ibqtW1aFRrwLxd6KfroEYDOkcu3y/qy+5rOaAlUmTaxe7x/IAi4oAnLq8UbhY9vJqksxhbHo3ZDZvhby35vKV+PhRj3+92+/IRk8yReuvIh89BPXKDndKkmTrJWESorPXkt6MLkqRfMQw2P5mABUmoNiRpHHxLF7BDhUZjvtCbxq/dw1zObPc3ySrA0RCii4qJ2QxLmlCsLKzg0+3zZhcxqiKJQvQyvqRpxzYXJZI2ZLfpzc6fYcd4cWGFPXNteVzZZD428cYUBEuQPM+VfoYbyqFUDtgeyCAq2Ce/z0DJEmmP60Ksn2OohCwHG2wkgEsoTvnTIstr1LKcSXv6zzKLV0DvDaulZ2TP56IfWchEqvPaBXaltfsrK0kQvCwPEgUmQqYziJT+V0P8NvHKB4+pvUuKvlXcqpgdsqTas3schkpTFi40ax1ze9Sh13Zw5KcO3RUJle9KoDZ1dvDyAOYRsWMMtWWRotT4/yr0BpJG0YjAHyI8ixx7Dc/yHdJWI4g77WOaRPzh4gHVldaqjhxmo60igy/D8VtKu3FZLqCpFnN7MtmsT2BPP8MSHVvt88Vuh2TaIzQzT7P1LIVsomqbBLp4hw7owmoISsUTFACD2hF37gLKZe0gr4OSl6/nrbq/4qpKTKYN4kBzyPrwrmsOlAOQ4NgYOX3Kc+eS5zLDj5lD2QK5Rg/0qkqjWrJDaJcMBqq6/GA9ayJwv6xm4Dze4yNgYh2UILEpZeBKbiIjkI1POL+72DfexnVShizhrx/fBPr3uBpXCMGLPn6vmfbZ480Rc0hY8zchD55JIDbEMOPXzWkr2tNzDCB82KRC7zPj8BdVnyIwRRGKPDbWFMK/IrVCI4ecvKfGWZIAJoDb9N+Ql5/n2gH86h1ASY7Kp0ocQaHC/HfRrOFmWYXr2gtcGFGcKvxc+TOnwhF2FSz5TaG64X7gg6TEjFIKmEYDDS5i2gLOf2Ce7H5tWZn1JC12XD3foeJuLW+0WZCKRPMBhiDoEWqalS4M70hGurgD6waJ9LuXI4i0YqY7j1N9t6u3Ljx4y6Dh0At+F026XUmF0mnoERzox3KB4u0xy1E2P3rR/g/xdRpRv4KZRWxo+HYbV0ug/Dtf1QA+HddCMG3i8RdDzOi08VtI8xZc1Zk95H9izxkTY0zGCH64el7vNAoc9tK3bwS6idI5G13/a2fx53BEdScxVODjj2/9y X-IPAS-Result: A2B3AADG8/Nd/wHyM5BlHQEBAQkBEQUFAYFsBgELAYFzgWwBIBIqjQaGdAaLII9KgXsJAQEBAQEBAQEBGxwBAYRAgjU2Bw4CEAEBAQQBAQEBAQUDAQFshUOCOymDMwFGgVGCYz+CUyWucokBgUiBNgGHPoRzeYEHgUeDG4UWhSEEl0+XKYI6gj+TOQwbmkYBqxIMJoFYKwgCGAghD4MnUBEUjR4XjkEjAzCPTwEB Received: from tarius.tycho.ncsc.mil (HELO tarius.infosec.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea11.NCSC.MIL with ESMTP; 13 Dec 2019 20:28:33 +0000 Received: from moss-pluto.infosec.tycho.ncsc.mil (moss-pluto [192.168.25.131]) by tarius.infosec.tycho.ncsc.mil (8.14.7/8.14.4) with ESMTP id xBDKSCSr127737; Fri, 13 Dec 2019 15:28:15 -0500 From: Stephen Smalley To: paul@paul-moore.com Cc: selinux@vger.kernel.org, keescook@chromium.org, omosnace@redhat.com, jeffv@google.com, Stephen Smalley Subject: [RFC PATCH] selinux: randomize layout of key structures Date: Fri, 13 Dec 2019 15:28:38 -0500 Message-Id: <20191213202838.7323-1-sds@tycho.nsa.gov> X-Mailer: git-send-email 2.23.0 MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Randomize the layout of key selinux data structures. Initially this is applied to the selinux_state, selinux_ss, policydb, and task_security_struct data structures. NB To test/use this mechanism, one must install the necessary build-time dependencies, e.g. gcc-plugin-devel on Fedora, and enable CONFIG_GCC_PLUGIN_RANDSTRUCT in the kernel configuration. Signed-off-by: Stephen Smalley Reviewed-by: Kees Cook --- I would have expected that two kernels built with the same config with this enabled would have yielded different struct layouts in pahole vmlinux output, but that doesn't appear to be the case. They do have different seeds. Am I doing something wrong? Also, does DEBUG_INFO_BTF effectively undermine/negate the benefits of this change if enabled? security/selinux/include/objsec.h | 2 +- security/selinux/include/security.h | 2 +- security/selinux/ss/policydb.h | 2 +- security/selinux/ss/services.h | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h index a4a86cbcfb0a..330b7b6d44e0 100644 --- a/security/selinux/include/objsec.h +++ b/security/selinux/include/objsec.h @@ -35,7 +35,7 @@ struct task_security_struct { u32 create_sid; /* fscreate SID */ u32 keycreate_sid; /* keycreate SID */ u32 sockcreate_sid; /* fscreate SID */ -}; +} __randomize_layout; enum label_initialized { LABEL_INVALID, /* invalid or not initialized */ diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h index 49737087ad33..3ea406ad91b6 100644 --- a/security/selinux/include/security.h +++ b/security/selinux/include/security.h @@ -110,7 +110,7 @@ struct selinux_state { bool policycap[__POLICYDB_CAPABILITY_MAX]; struct selinux_avc *avc; struct selinux_ss *ss; -}; +} __randomize_layout; void selinux_ss_init(struct selinux_ss **ss); void selinux_avc_init(struct selinux_avc **avc); diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h index bc56b14e2216..98afe52a3d19 100644 --- a/security/selinux/ss/policydb.h +++ b/security/selinux/ss/policydb.h @@ -307,7 +307,7 @@ struct policydb { u16 process_class; u32 process_trans_perms; -}; +} __randomize_layout;; extern void policydb_destroy(struct policydb *p); extern int policydb_load_isids(struct policydb *p, struct sidtab *s); diff --git a/security/selinux/ss/services.h b/security/selinux/ss/services.h index fc40640a9725..c5896f39e8f6 100644 --- a/security/selinux/ss/services.h +++ b/security/selinux/ss/services.h @@ -31,7 +31,7 @@ struct selinux_ss { struct selinux_map map; struct page *status_page; struct mutex status_lock; -}; +} __randomize_layout; void services_compute_xperms_drivers(struct extended_perms *xperms, struct avtab_node *node);