search

GrapheneOS / linux-hardened

Minimal supplement to upstream Kernel Self Protection Project changes. Features already provided by SELinux + Yama and archs other than multiarch arm64 / x86_64 aren't in scope. Only tags have stable history. Shared IRC channel with KSPP: irc.freenode.net ##linux-hardened. Currently maintained at https://github.com/anthraxx/linux-hardened.
https://grapheneos.org/
Other
400 stars 106 forks source link

pointer printing sanitization #16

Closed thestinger closed 6 years ago

sempervictus commented 7 years ago

I think this is now "in progress elsewhere," yay. Thank you for tracking all of this.

thestinger commented 7 years ago

Yeah, just marked it as that a minute before you replied.

Note that I stopped tracking issues tied to GCC plugins here because Google is moving to Clang and since they're such a big part of the kernel hardening effort the writing is on the wall for GCC despite the history in PaX and grsecurity of GCC plugins.

sempervictus commented 7 years ago

Suppose that bodes well for kcfi and other complicated as a rubix dodecahedron functions. Thanks

thestinger commented 7 years ago

I've done compiler work on LLVM before and I'll be much happier working with that. From my perspective, Google dropping GCC for compiling the kernel as they've done for everything else can't come soon enough.

thestinger commented 7 years ago

Most compiler hardening can be shared between the kernel and userspace and GCC is already gone for the Android userspace.

thestinger commented 6 years ago

This is a mess upstream and I'm not following it anymore. I don't know what's happening with it.

sempervictus commented 6 years ago

Yeah, they're tossing around a bunch of scriptage and esoteric rigmarole about why production kernels need to leak sensitive data to enable use of dangerously implemented userspace functions... I think.