2

In the Linux kernel, stack_canary is the one of the stack protection mechanisms.

This value is generated by boot_init_stack_canary(). (/init/main.c)

boot_init_stack_canary() randomly generates stack_canary from get_random_bytes().

And this canary value is referenced into task structure(struct task) and save in the gs segment register.

When a process is generated, the process gets stack_canary from gs segment.

If stack_canary is not refreshed anymore, all processes have the same stack_canary value?

Otherwise, are there any different generation methods?

1 Answer 1

4

The stack canary is initialised with a random value any time a task struct is duplicated; see dup_task_struct() in kernel/fork.c (and in particular line 380 in version 4.7). So each forked process gets a random canary, which means there's a very high probability that each process has a different canary (and more importantly, you can't predict another process's stack canary).

boot_init_stack_canary() ensures that the first "task" (the kernel) has a stack canary. That canary isn't re-used for processes.

1
  • Linux kernel is very difficult and wide for me :( But I checked the code and exactly understood it thanks to you. Your reply is really really helpful :D Thanks a lot.
    – Tylor Yoo
    Sep 8, 2016 at 2:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .