pageexec at freemail
Dec 20, 2011, 3:01 PM
Post #2 of 2
(164 views)
Permalink
|
On 18 Dec 2011 at 23:48, Magnus Granberg wrote:
> [21:30:59] <blueness> also, there is a new kernel feature for PaX
> [21:31:12] <blueness> it will be related to the gcc plugin to constify kernel pointers
it's actually for KERNEXEC/amd64, not constification ;). what the KERNEXEC gcc plugin does is
simple, it ensures that kernel function pointers point to the kernel's part of the address
space. the two methods differ in the low-level asm insn sequences used in the instrumentation
of function pointer dereferences and have a different performance impact (vs. usability).
the BTS method has a higher impact but it's compatible with binary modules (as in, they'll
continue to work but obviously without the extra protection offered by the plugin) whereas
the OR method has a lower impact however it cannot coexist with binary modules (due to the
low-level function call ABI change). so the safe (but less secure) default should probably
be BTS and let the users explicitly switch to OR if they know they won't need binary modules
(there's a runtime check against the module license to ensure some minimum safety against
bad user choice ;).
|
meeting-2011-12-14_20:00UTC.log
