summaryrefslogtreecommitdiff
path: root/doc/TODO.kaslr
blob: a1ec6d263a94e607923b04ad60918e92f2400167 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
====== POINTER LEAKS ======

[DONE] -- Change the permissions of /dev/ksyms, as discussed in:
          http://mail-index.netbsd.org/tech-kern/2018/01/17/msg022960.html

-- The address of a non-public section is leaked because of Meltdown,
   "jmp handler". This can easily be fixed by pushing the handlers into
   their own section.

-- Replace the "%p" fmt by something relative to the kernel section (if
   any). Eg, from
       printf("%p", &some_global_var); --> "0xffffffffe38010f0"
   to
       printf("%p", &some_global_var); --> ".data.4:0x8010f0"
   This eases debugging and also prevents leaks if a driver prints
   kernel addresses as debug (I've seen that already).

[DONE] -- PPPoE sends a kernel address as host unique. (What is this shit.)

-- Several entry points leak kernel addresses:
       [DONE] - "modstat -k"
       [DONE] - kern.proc
       [DONE] - kern.proc2
       [DONE] - kern.file
       [DONE] - kern.file2
       [DONE] - kern.lwp
       [DONE] - sysctl_inpcblist
       [DONE] - sysctl_unpcblist
       [DONE] - sysctl_doevcnt
       [DONE] - sysctl_dobuf

-- Be careful with dmesg.

====== RANDOMIZATION ======

[DONE] -- Randomize the PTE space.

[DONE] -- Randomize the kernel main memory (VM_MIN_KERNEL_ADDRESS).

[DONE] -- Randomize the direct map.

[POINTLESS, BECAUSE CPU LEAKY] -- Randomize the PCPU area.

====== GENERAL ======

-- Sort the kernel sections by size, from largest to smallest, to save
   memory.

[DONE] -- Add the "pkboot" command in the EFI bootloader.