50 lines
1.5 KiB
Plaintext
50 lines
1.5 KiB
Plaintext
====== POINTER LEAKS ======
|
|
|
|
[DONE] -- Change the permissions of /dev/ksyms, as discussed in:
|
|
http://mail-index.netbsd.org/tech-kern/2018/01/17/msg022960.html
|
|
|
|
-- The address of a non-public section is leaked because of Meltdown,
|
|
"jmp handler". This can easily be fixed by pushing the handlers into
|
|
their own section.
|
|
|
|
-- Replace the "%p" fmt by something relative to the kernel section (if
|
|
any). Eg, from
|
|
printf("%p", &some_global_var); --> "0xffffffffe38010f0"
|
|
to
|
|
printf("%p", &some_global_var); --> ".data.4:0x8010f0"
|
|
This eases debugging and also prevents leaks if a driver prints
|
|
kernel addresses as debug (I've seen that already).
|
|
|
|
[DONE] -- PPPoE sends a kernel address as host unique. (What is this shit.)
|
|
|
|
-- Several entry points leak kernel addresses:
|
|
[DONE] - "modstat -k"
|
|
[DONE] - kern.proc
|
|
[DONE] - kern.proc2
|
|
[DONE] - kern.file
|
|
[DONE] - kern.file2
|
|
[DONE] - kern.lwp
|
|
[DONE] - sysctl_inpcblist
|
|
[DONE] - sysctl_unpcblist
|
|
[DONE] - sysctl_doevcnt
|
|
[DONE] - sysctl_dobuf
|
|
|
|
-- Be careful with dmesg.
|
|
|
|
====== RANDOMIZATION ======
|
|
|
|
[DONE] -- Randomize the PTE space.
|
|
|
|
[DONE] -- Randomize the kernel main memory (VM_MIN_KERNEL_ADDRESS).
|
|
|
|
[DONE] -- Randomize the direct map.
|
|
|
|
[POINTLESS, BECAUSE CPU LEAKY] -- Randomize the PCPU area.
|
|
|
|
====== GENERAL ======
|
|
|
|
-- Sort the kernel sections by size, from largest to smallest, to save
|
|
memory.
|
|
|
|
[DONE] -- Add the "pkboot" command in the EFI bootloader.
|