2

I started with kaslr.c and found that it uses kaslr_get_random_long() defined in kaslr.h and implemented in lib/kaslr.c where it possibly uses RDRAND (Intel's hardware PRNG), a timestamp, and at least a system timer to generate more entropy.

unsigned long raw, random = get_boot_seed();
bool use_i8254 = true;

debug_putstr(purpose);
debug_putstr(" KASLR using");

if (has_cpuflag(X86_FEATURE_RDRAND)) {
    debug_putstr(" RDRAND");
    if (rdrand_long(&raw)) {
        random ^= raw;
        use_i8254 = false;
    }
}

if (has_cpuflag(X86_FEATURE_TSC)) {
    debug_putstr(" RDTSC");
    raw = rdtsc();

    random ^= raw;
    use_i8254 = false;
}

if (use_i8254) {
    debug_putstr(" i8254");
    random ^= i8254();
}

The returned value is diffused a bit though some asm circular multiplication.

    /* Circular multiply for better bit diffusion */
asm(_ASM_MUL "%3"
    : "=a" (random), "=d" (raw)
    : "a" (random), "rm" (mix_const));
random += raw;

get_boot_seed seems to be a very simple linear xor PRNG on a hash set to a static 0. It uses a very simple xor relying on kernel boot parameters.

    /* Attempt to create a simple but unpredictable starting entropy. */
static unsigned long get_boot_seed(void)
{
    unsigned long hash = 0;

    hash = rotate_xor(hash, build_str, sizeof(build_str));
    hash = rotate_xor(hash, boot_params, sizeof(*boot_params));

    return hash;
}

This seems to be a "good enough" type of approach and was wondering if another distro has patched it to use a stronger CSPRNG? For a performance/security tradeoff, I can understand the choice. However, I'm fairly certain that someone must have already patched this to allow for more options for hardened kernels.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.