Text relocations in kernel modules

[Richard Yao]

On 04/02/12 13:13, Tom Evans wrote:
> On Mon, Apr 2, 2012 at 5:49 PM, Richard Yao <ryao at cs.stonybrook.edu> wrote:
>> On 04/02/12 05:56, Tom Evans wrote:
>>> On Sat, Mar 31, 2012 at 3:42 AM, Richard Yao <ryao at cs.stonybrook.edu> wrote:
>>>>> There are no security implications, no system resources to be wasted.
>>>>>
>>>>> And if you think there are security implications, then lets see a
>>>>> proof-of-concept.
>>>>
>>>> If I find time to write a proof-of-concept, I promise to publish it
>>>> publicly. Your security team will find out when everyone else does.
>>>
>>> Richard, I'm not sure what you are trying to accomplish here. You have
>>> had a clear explanation of why certain things are done in a certain
>>> way in the FreeBSD codebase, and a confirmation that they do not think
>>> it causes any security issues in FreeBSD.
>>>
>>> Your response is to threaten to write an exploit against FreeBSD, and
>>> distribute it publicly before disclosing to security at .
>>
>> Some people believe that projects that do not take proper
>> countermeasures against security vulnerabilities do not deserve to have
>> special notification of issues. I happen to be one of them.
> 
> This is a straw man argument - FreeBSD does take proper
> countermeasures against security vulnerabilities - and so your
> conclusion that you can blithely fully disclose vulnerabilities with
> no moral concerns is a logical fallacy.

My opinion is that any OS that lacks ALSR lacks proper countermeasures
against vunerabilities that ASLR would kill. Furthermore, I believe that
trying to minimize the impact of bugs that would be addressed by ASLR is
ultimately harmful to users' security. Logically, full disclosure would
only apply to attacks that ASLR would kill.

With that said, I should remind you of the FreeBSD project's license,
which disclaims the possibility of "moral concerns":

THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT ``AS IS'' AND ANY
EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FREEBSD PROJECT OR
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

It is highly unlikely that anyone who opts for full disclosure of
vulnerabilities that ASLR would kill would also be the person who wrote
the vulnerable code in the first place. However, should he be the same
person, it would seem that you have already accepted a license freeing
him of responsibility.

there are many people who have commit access. Any of them could
intentionally commit vulnerabilities that ASLR would kill. If you do not
like this situation, I suggest that you consider alternative operating
systems, such as AIX, Mac OS X or Solaris. Their licenses might be more
permissive in your ability to hold their makers responsible for flaws.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 900 bytes
Desc: OpenPGP digital signature
Url : http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20120402/36234a05/signature.pgp