[PATCH] sysctl: improve KASLR effectiveness for mmap

[PATCH] sysctl: improve KASLR effectiveness for mmap

[Peter Müller]

[-- Attachment #1: Type: text/plain, Size: 1290 bytes --]

By feeding more random bits into mmap allocation, the
effectiveness of KASLR will be improved, making attacks
trying to bypass address randomisation more difficult.

Changed sysctl values are:

vm.mmap_rnd_bits = 32 (default: 28)
vm.mmap_rnd_compat_bits = 16 (default: 8)

This patch backports the same change made in IPFire 2.x into
IPFire 3.x .

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>
---
 setup/setup.nm                     | 2 +-
 setup/sysctl/kernel-hardening.conf | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/setup/setup.nm b/setup/setup.nm
index be0ca4ba0..09d94e23d 100644
--- a/setup/setup.nm
+++ b/setup/setup.nm
@@ -5,7 +5,7 @@
 
 name       = setup
 version    = 3.0
-release    = 13
+release    = 14
 arch       = noarch
 
 groups     = Base Build System/Base
diff --git a/setup/sysctl/kernel-hardening.conf b/setup/sysctl/kernel-hardening.conf
index 9bb6e9f45..33e096c7c 100644
--- a/setup/sysctl/kernel-hardening.conf
+++ b/setup/sysctl/kernel-hardening.conf
@@ -4,3 +4,6 @@ kernel.kptr_restrict = 2
 # Avoid kernel memory address exposures via dmesg.
 kernel.dmesg_restrict = 1
 
+# Improve KASLR effectiveness for mmap.
+vm.mmap_rnd_bits = 32
+vm.mmap_rnd_compat_bits = 16
-- 
2.16.4

[PATCH] sysctl: improve KASLR effectiveness for mmap

[Peter Müller]

[-- Attachment #1: Type: text/plain, Size: 947 bytes --]

By feeding more random bits into mmap allocation, the
effectiveness of KASLR will be improved, making attacks
trying to bypass address randomisation more difficult.

Changed sysctl values are:

vm.mmap_rnd_bits = 32 (default: 28)
vm.mmap_rnd_compat_bits = 16 (default: 8)

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>
---
 config/etc/sysctl.conf | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf
index 9a943fffa..5a67f1795 100644
--- a/config/etc/sysctl.conf
+++ b/config/etc/sysctl.conf
@@ -45,6 +45,10 @@ kernel.kptr_restrict = 2
 # Avoid kernel memory address exposures via dmesg.
 kernel.dmesg_restrict = 1
 
+# Improve KASLR effectiveness for mmap
+vm.mmap_rnd_bits = 32
+vm.mmap_rnd_compat_bits = 16
+
 # Minimal preemption granularity for CPU-bound tasks:
 # (default: 1 msec#  (1 + ilog(ncpus)), units: nanoseconds)
 kernel.sched_min_granularity_ns = 10000000
-- 
2.16.4

Re: [PATCH] sysctl: improve KASLR effectiveness for mmap

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 1169 bytes --]

Hi,

LOL. “Effectiveness” of the KASLR. Do we even have this enabled?

-Michael

> On 4 Jul 2019, at 20:15, Peter Müller <peter.mueller(a)ipfire.org> wrote:
> 
> By feeding more random bits into mmap allocation, the
> effectiveness of KASLR will be improved, making attacks
> trying to bypass address randomisation more difficult.
> 
> Changed sysctl values are:
> 
> vm.mmap_rnd_bits = 32 (default: 28)
> vm.mmap_rnd_compat_bits = 16 (default: 8)
> 
> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>
> ---
> config/etc/sysctl.conf | 4 ++++
> 1 file changed, 4 insertions(+)
> 
> diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf
> index 9a943fffa..5a67f1795 100644
> --- a/config/etc/sysctl.conf
> +++ b/config/etc/sysctl.conf
> @@ -45,6 +45,10 @@ kernel.kptr_restrict = 2
> # Avoid kernel memory address exposures via dmesg.
> kernel.dmesg_restrict = 1
> 
> +# Improve KASLR effectiveness for mmap
> +vm.mmap_rnd_bits = 32
> +vm.mmap_rnd_compat_bits = 16
> +
> # Minimal preemption granularity for CPU-bound tasks:
> # (default: 1 msec#  (1 + ilog(ncpus)), units: nanoseconds)
> kernel.sched_min_granularity_ns = 10000000
> -- 
> 2.16.4
> 

Re: [PATCH] sysctl: improve KASLR effectiveness for mmap

[Peter Müller]

[-- Attachment #1: Type: text/plain, Size: 1465 bytes --]

Hello Michael,

> Hi,
> 
> LOL. “Effectiveness” of the KASLR. Do we even have this enabled?
Yes. Words failed me here - and 8 Bits do not leave _that_ much possibilities...

Thanks, and best regards,
Peter Müller
> 
> -Michael
> 
>> On 4 Jul 2019, at 20:15, Peter Müller <peter.mueller(a)ipfire.org> wrote:
>>
>> By feeding more random bits into mmap allocation, the
>> effectiveness of KASLR will be improved, making attacks
>> trying to bypass address randomisation more difficult.
>>
>> Changed sysctl values are:
>>
>> vm.mmap_rnd_bits = 32 (default: 28)
>> vm.mmap_rnd_compat_bits = 16 (default: 8)
>>
>> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>
>> ---
>> config/etc/sysctl.conf | 4 ++++
>> 1 file changed, 4 insertions(+)
>>
>> diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf
>> index 9a943fffa..5a67f1795 100644
>> --- a/config/etc/sysctl.conf
>> +++ b/config/etc/sysctl.conf
>> @@ -45,6 +45,10 @@ kernel.kptr_restrict = 2
>> # Avoid kernel memory address exposures via dmesg.
>> kernel.dmesg_restrict = 1
>>
>> +# Improve KASLR effectiveness for mmap
>> +vm.mmap_rnd_bits = 32
>> +vm.mmap_rnd_compat_bits = 16
>> +
>> # Minimal preemption granularity for CPU-bound tasks:
>> # (default: 1 msec#  (1 + ilog(ncpus)), units: nanoseconds)
>> kernel.sched_min_granularity_ns = 10000000
>> -- 
>> 2.16.4
>>
> 

-- 
The road to Hades is easy to travel.
	-- Bion of Borysthenes