13d11b485Smaxv====== POINTER LEAKS ====== 23d11b485Smaxv 3fa386c03Smaxv[DONE] -- Change the permissions of /dev/ksyms, as discussed in: 43d11b485Smaxv http://mail-index.netbsd.org/tech-kern/2018/01/17/msg022960.html 53d11b485Smaxv 63d11b485Smaxv-- The address of a non-public section is leaked because of Meltdown, 73d11b485Smaxv "jmp handler". This can easily be fixed by pushing the handlers into 83d11b485Smaxv their own section. 93d11b485Smaxv 103d11b485Smaxv-- Replace the "%p" fmt by something relative to the kernel section (if 113d11b485Smaxv any). Eg, from 123d11b485Smaxv printf("%p", &some_global_var); --> "0xffffffffe38010f0" 133d11b485Smaxv to 143d11b485Smaxv printf("%p", &some_global_var); --> ".data.4:0x8010f0" 153d11b485Smaxv This eases debugging and also prevents leaks if a driver prints 163d11b485Smaxv kernel addresses as debug (I've seen that already). 173d11b485Smaxv 1831315407Smaxv[DONE] -- PPPoE sends a kernel address as host unique. (What is this shit.) 193d11b485Smaxv 2089de9eebSmaxv-- Several entry points leak kernel addresses: 2189de9eebSmaxv [DONE] - "modstat -k" 2241e8bd38Smaxv [DONE] - kern.proc 2341e8bd38Smaxv [DONE] - kern.proc2 24db14f028Smaxv [DONE] - kern.file 25123d3b68Smaxv [DONE] - kern.file2 26db14f028Smaxv [DONE] - kern.lwp 27db14f028Smaxv [DONE] - sysctl_inpcblist 28db14f028Smaxv [DONE] - sysctl_unpcblist 29ab639344Smaxv [DONE] - sysctl_doevcnt 30ab639344Smaxv [DONE] - sysctl_dobuf 313d11b485Smaxv 323d11b485Smaxv-- Be careful with dmesg. 333d11b485Smaxv 343d11b485Smaxv====== RANDOMIZATION ====== 353d11b485Smaxv 36dc70fdb7Smaxv[DONE] -- Randomize the PTE space. 373d11b485Smaxv 38dc70fdb7Smaxv[DONE] -- Randomize the kernel main memory (VM_MIN_KERNEL_ADDRESS). 393d11b485Smaxv 40fa386c03Smaxv[DONE] -- Randomize the direct map. 413d11b485Smaxv 42123d3b68Smaxv[POINTLESS, BECAUSE CPU LEAKY] -- Randomize the PCPU area. 433d11b485Smaxv 443d11b485Smaxv====== GENERAL ====== 453d11b485Smaxv 463d11b485Smaxv-- Sort the kernel sections by size, from largest to smallest, to save 473d11b485Smaxv memory. 483d11b485Smaxv 49*61683f02Smaxv[DONE] -- Add the "pkboot" command in the EFI bootloader. 50