2

In the Linux kernel, stack_canary is the one of the stack protection mechanisms.

This value is generated by boot_init_stack_canary(). (/init/main.c)

boot_init_stack_canary() randomly generates stack_canary from get_random_bytes().

And this canary value is referenced into task structure(struct task) and save in the gs segment register.

When a process is generated, the process gets stack_canary from gs segment.

If stack_canary is not refreshed anymore, all processes have the same stack_canary value?

Otherwise, are there any different generation methods?

Tylor Yoo
  • 21
  • 5

1 Answers1

4

The stack canary is initialised with a random value any time a task struct is duplicated; see dup_task_struct() in kernel/fork.c (and in particular line 380 in version 4.7). So each forked process gets a random canary, which means there's a very high probability that each process has a different canary (and more importantly, you can't predict another process's stack canary).

boot_init_stack_canary() ensures that the first "task" (the kernel) has a stack canary. That canary isn't re-used for processes.

Stephen Kitt
  • 411,918
  • 54
  • 1,065
  • 1,164
  • Linux kernel is very difficult and wide for me :( But I checked the code and exactly understood it thanks to you. Your reply is really really helpful :D Thanks a lot. – Tylor Yoo Sep 08 '16 at 02:49