diff options
| author | dcashman <dcashman@google.com> | 2015-12-29 14:24:39 -0800 |
|---|---|---|
| committer | Kees Cook <keescook@google.com> | 2016-03-24 15:31:55 -0700 |
| commit | 09ff768f3e9b7ac4acfb4e4632b1a3db881593c5 (patch) | |
| tree | d73f8dff34a581b97520366c0865350a6c4c5209 /kernel | |
| parent | fbf026203949539560a630434db444fd25ff68d3 (diff) | |
| download | edison-v3.10-09ff768f3e9b7ac4acfb4e4632b1a3db881593c5.tar.gz | |
FROMLIST: mm: mmap: Add new /proc tunable for mmap_base ASLR.
(cherry picked from commit https://lkml.org/lkml/2015/12/21/337)
ASLR only uses as few as 8 bits to generate the random offset for the
mmap base address on 32 bit architectures. This value was chosen to
prevent a poorly chosen value from dividing the address space in such
a way as to prevent large allocations. This may not be an issue on all
platforms. Allow the specification of a minimum number of bits so that
platforms desiring greater ASLR protection may determine where to place
the trade-off.
Signed-off-by: Daniel Cashman <dcashman@android.com>
Signed-off-by: Daniel Cashman <dcashman@google.com>
Bug: 27796957
Patchset: ASLR sysctl
Change-Id: I1278914139a2e3910a301ab34755f409076768e7
Signed-off-by: Kees Cook <keescook@google.com>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/sysctl.c | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 34b8f77b4c0..f48e60e5f73 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -1476,6 +1476,28 @@ static struct ctl_table vm_table[] = { .mode = 0644, .proc_handler = proc_doulongvec_minmax, }, +#ifdef CONFIG_HAVE_ARCH_MMAP_RND_BITS + { + .procname = "mmap_rnd_bits", + .data = &mmap_rnd_bits, + .maxlen = sizeof(mmap_rnd_bits), + .mode = 0600, + .proc_handler = proc_dointvec_minmax, + .extra1 = (void *)&mmap_rnd_bits_min, + .extra2 = (void *)&mmap_rnd_bits_max, + }, +#endif +#ifdef CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS + { + .procname = "mmap_rnd_compat_bits", + .data = &mmap_rnd_compat_bits, + .maxlen = sizeof(mmap_rnd_compat_bits), + .mode = 0600, + .proc_handler = proc_dointvec_minmax, + .extra1 = (void *)&mmap_rnd_compat_bits_min, + .extra2 = (void *)&mmap_rnd_compat_bits_max, + }, +#endif { } }; |