Live data from Hacker News

Microsoft Engineer Proposes “Trampfd” for Improving Linux Security

phoronix.com

11–20 of 39 posts

Re: Microsoft Engineer Proposes “Trampfd” for Improving Linux Security

#11

Does it really matter that he's a "Microsoft Engineer" or is that just thrown in there to ruffle old people's feathers?

I could imagine that Microsoft has dealt with similar issues, which would give the proposal extra credibility to me.

But the article is lazy and doesn't mention why it's important, so we're all going to infer something different about it.

Re: Microsoft Engineer Proposes “Trampfd” for Improving Linux Security

#13
post #8
post #5

Earlier quoted context omitted.

> From: "Madhavan T. Venkataraman" https://lkml.org/lkml/2020/7/28/640

Who would thought, years ago, seeing an email address "@linux.microsoft.com"?

The creation of that domain must have a story.

"We're getting ignored in the mailing lists. What can we do about it?"

Re: Microsoft Engineer Proposes “Trampfd” for Improving Linux Security

#15

Does it really matter that he's a "Microsoft Engineer" or is that just thrown in there to ruffle old people's feathers?

It seems that it's common practice on phoronix to list the employer of the person submitting the patch. I found a few examples where Intel, Google, and Amazon are all mentioned

[1] https://www.phoronix.com/scan.php?page=news_item&px=Intel-Bu...

[2] https://www.phoronix.com/scan.php?page=news_item&px=Google-Z...

[3] https://www.phoronix.com/scan.php?page=news_item&px=L1d-Cach...

Re: Microsoft Engineer Proposes “Trampfd” for Improving Linux Security

#16
post #6
post #2

Someone in the Phoronix comments wondered why not just map it (the kernel-assisted trampoline memory page) executable and not writeable, to avoid the attack surface but be significantly faster. I also wonder exactly why, admittedly I haven’t read the mailing list thread entirely but purely working on theory I wonder what the advantages of working on page fault is. Less abusable gadgets in memory? More flexibility? Pe…

Currently the page must be writeable at some point in order to create the trampoline. A page fault is used as a way of executing the trampoline without the page having to be made executable/writable---the page fault handler recognises the page as a special trampoline page and handles the jump to the trampolines target address (which was previously registered using the new syscall). Note that AFAICS this is unrelated…

Double map it, like a JIT does. Once writable, and once executable. Put the pointers into different shared objects so that ASLR puts a randomized offset between them and you can't discover the write pointers from the execute pointer, and vice versa.

Re: Microsoft Engineer Proposes “Trampfd” for Improving Linux Security

#17

Does it really matter that he's a "Microsoft Engineer" or is that just thrown in there to ruffle old people's feathers?

It's pretty common for Michael to add the affiliation/organization of people involved, since the social aspects are as interesting as the technical ones.

For example, since Alyssa Rosenzweig writes full-length articles about her and others' work on Mesa drivers for Mali GPUs, she is mentioned in article titles or in main paragraphs, or Collabora is mentioned.

Michael also covers interesting hires and organizational changes, like Valve hiring another developer for RADV this week, Valve is prominent in the title because it is important social information.

Re: Microsoft Engineer Proposes “Trampfd” for Improving Linux Security

#19
post #2

Someone in the Phoronix comments wondered why not just map it (the kernel-assisted trampoline memory page) executable and not writeable, to avoid the attack surface but be significantly faster. I also wonder exactly why, admittedly I haven’t read the mailing list thread entirely but purely working on theory I wonder what the advantages of working on page fault is. Less abusable gadgets in memory? More flexibility? Pe…

Its a good question, and one that seem to be unspoken.

I'm guessing, the charitable version could be that the implementation on a major processor vendor works out to be just the right amount of security because the page fault handler wasn't optimized as heavily as the syscall interface. So, this might provide better security on a "slower" path, which turns out to actually be faster once the faster path is fully secured?

Re: Microsoft Engineer Proposes “Trampfd” for Improving Linux Security

#20
post #2

Someone in the Phoronix comments wondered why not just map it (the kernel-assisted trampoline memory page) executable and not writeable, to avoid the attack surface but be significantly faster. I also wonder exactly why, admittedly I haven’t read the mailing list thread entirely but purely working on theory I wonder what the advantages of working on page fault is. Less abusable gadgets in memory? More flexibility? Pe…

Interestingly on ARM64 such mappings are prohibited, since this breaks PAN (the spec requires it: https://siguza.github.io/PAN/).
Post reply on HN