ACK/Cmnt: [SRU Unstable 1/1] UBUNTU: [Config]: set ARCH_MMAP_RND_{COMPAT_, }BITS to the maximum

[Andrea Righi]

On Thu, Oct 19, 2023 at 05:12:59PM -0300, Thadeu Lima de Souza Cascardo wrote:
> BugLink: https://bugs.launchpad.net/bugs/1983357
> 
> Specially given that some mappings may now be aligned to the PMD, a big
> chunk of the randomization is being lost. In some cases, like 32-bit
> programs on x86, there are no random bits left when defaulting to the
> minimum.
> 
> Defaulting to the maximum may lead to programs breaking, specially the ones
> running on limited virtual address space. Those should have moved to 64-bit
> anyway.
> 
> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo at canonical.com>
> ---
>  debian.master/config/annotations | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/debian.master/config/annotations b/debian.master/config/annotations
> index 4e9a14102082..90a1aee47ca4 100644
> --- a/debian.master/config/annotations
> +++ b/debian.master/config/annotations
> @@ -1294,10 +1294,10 @@ CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT               policy<{'amd64': 'y', 'armhf': '
>  CONFIG_ARCH_MIGHT_HAVE_PC_SERIO                 policy<{'amd64': 'y', 'ppc64el': 'y'}>
>  CONFIG_ARCH_MILBEAUT                            policy<{'armhf': 'y'}>
>  CONFIG_ARCH_MILBEAUT_M10V                       policy<{'armhf': 'y'}>
> -CONFIG_ARCH_MMAP_RND_BITS                       policy<{'amd64': '28', 'arm64': '18', 'armhf': '8', 'ppc64el': '28', 'riscv64': '18'}>
> +CONFIG_ARCH_MMAP_RND_BITS                       policy<{'amd64': '32', 'arm64': '33', 'arm64-generic-64k': '29', 'armhf': '16', 'ppc64el': '29', 'riscv64': '24'}>

I would also add:

CONFIG_ARCH_MMAP_RND_BITS                       note<'LP: #1983357'>

>  CONFIG_ARCH_MMAP_RND_BITS_MAX                   policy<{'amd64': '32', 'arm64': '33', 'arm64-generic-64k': '29', 'armhf': '16', 'ppc64el': '29', 'riscv64': '24'}>
>  CONFIG_ARCH_MMAP_RND_BITS_MIN                   policy<{'amd64': '28', 'arm64': '18', 'arm64-generic-64k': '14', 'armhf': '8', 'ppc64el': '14', 'riscv64': '18'}>
> -CONFIG_ARCH_MMAP_RND_COMPAT_BITS                policy<{'amd64': '8', 'arm64': '11', 'ppc64el': '8'}>
> +CONFIG_ARCH_MMAP_RND_COMPAT_BITS                policy<{'amd64': '16', 'arm64': '16', 'ppc64el': '13', 'riscv64': '17'}>

Ditto:

CONFIG_ARCH_MMAP_RND_COMPAT_BITS                note<'LP: #1983357'>

>  CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX            policy<{'amd64': '16', 'arm64': '16', 'ppc64el': '13', 'riscv64': '17'}>
>  CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN            policy<{'amd64': '8', 'arm64': '11', 'arm64-generic-64k': '7', 'ppc64el': '7', 'riscv64': '8'}>
>  CONFIG_ARCH_MMP                                 policy<{'armhf': 'n'}>

In general this looks like a good change that can provide a better level
of security for 32-bit apps, therefore:

Acked-by: Andrea Righi <andrea.righi at canonical.com>