Re: [kernel-hardening] Re: [PATCH] KERNEL: resource: Fix bug on leakage in /proc/iomem file

From: Ingo Molnar
Date: Wed Apr 06 2016 - 17:47:13 EST



* Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> wrote:

> So yeah, maybe swap partitions are still more common than I thought. And I
> didn't even consider the possibility that people would hibernate a desktop like
> you do.

Also many distros will hibernate automatically on critically low battery (when
suspend won't save the system).

It would be much better to fix the kASLR/hibernation incompatibility ...

Just a random guess: much of the hibernation incompatibility comes from the fact
that on hibernation bootups the kASLR seed changes, which breaks hibernated kernel
addresses, right?

That should be easy to fix: if we added a kaslr_seed=xyz boot option, and added
that parmeter automatically (without showing it in /proc/cmdline ;-) on
hibernation bootups, we could solve much of the incompatibility, right?

This means that the first 'cold' bootup would set the kASLR seed - and subsequent
hibernated bootups would inherit it. That should be perfectly OK as long as we
don't expose the seed somewhere.

We could also write the kASLR seed to the hibernation image, but I don't think we
have the value available early enough - a boot option is better.

Thanks,

Ingo