Re: [PATCH v2] kaslr: allow kASLR to be default over Hibernation

[Emrah Demir]

On 2016-04-14 18:42, Kees Cook wrote:
> On Thu, Apr 14, 2016 at 1:34 PM, Pavel Machek <pavel@xxxxxxx> wrote:
> > On Thu 2016-04-14 13:14:07, Kees Cook wrote:
> > > On Thu, Apr 14, 2016 at 1:01 PM, Pavel Machek <pavel@xxxxxxx> wrote:
> > > > Hi!
> > > >
> > > >> Since kASLR and Hibernation can not currently coexist at runtime
> > > >> on x86, the default behavior was to disable kASLR by default when
> > > >> CONFIG_HIBERNATION was present (to retain original behavior).
> > > >>
> > > >> The behavior of kASLR on arm64 (and soon MIPS) is to be enabled by
> > > >> default when selected at build time. Since arm64 Hibernation does not
> > > >> conflict with kASLR, this fixes the hibernation argument parsing to be
> > > >> x86-specific. Additionally, since end users want to be able to select
> > > >> kASLR on x86 by default at build time, create CONFIG_RANDOMIZE_BASE_ON
> > > >> that is present only on x86.

> > > >
> > > > I believe this is bad idea. arm64 shows that kaslr and hibernation can
> > > > coexist, and hibernation is still useful when your battery runs out.
> > >
> > > What? I'm confused -- this patch leaves the x86 behavior as-is by
> > > default but allows hibernation to work with arm64. (For example, 
> > > right
> > > now, if you boot arm64 with "kaslr" kernel argument, hibernation will
> > > get needlessly disabled.)

So what about making new kernel parameters. "hibernate" and 
"nohibernate"

This way before decompression it will look at the parameters and depend 
on parameters it will act differently

"kaslr" "nohibernate"  -->  kASLR will enable, no hibernate

"nokaslr" "nohibernate" --> Neither of them will work

"kaslr" "hiberante"   ---> Owner has to face consequences(ARM has 
advantages)

"nokaslr" "hibernate"  ---> kASLR disabled and hibernate will works.

Before writing something I want to know your ideas.


-Emrah