From owner-freebsd-security@freebsd.org Mon May 4 15:12:06 2020 Return-Path: Delivered-To: freebsd-security@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 67CBC2D2565 for ; Mon, 4 May 2020 15:12:06 +0000 (UTC) (envelope-from carpeddiem@gmail.com) Received: from mail-il1-f173.google.com (mail-il1-f173.google.com [209.85.166.173]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "GTS CA 1O1" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 49G5tY4DNFz4KR4; Mon, 4 May 2020 15:12:05 +0000 (UTC) (envelope-from carpeddiem@gmail.com) Received: by mail-il1-f173.google.com with SMTP id c18so11584704ile.5; Mon, 04 May 2020 08:12:05 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=TXYsuAE/CxCiagOQ0s3LrLvCfhA8tkFXMQNcb3tG8d0=; b=QNRf7MyDysbJnan0Gf9jabANsa70Z1xX2pbxhBjBlK9JYLKrGEikxJmM3aap6QyCmU NYzgAU8qcprIR1ki1ZY7k2SPQswTqUWpfi4+w3g16DvOb9P0jpPEf5FdmSCuVCj+ZFwc wN/I+BD/vpk+5AX37i8IniON4KSvzgFBu7qpAY3yVbgFTPSXf31h7UR22khTem77OiFt yuLfh8J5nFTJQWBgsRXBXnSCAbEzVdlmDfThmdaoINV9sPLXwZiLhzI4necypquSGo1A 4g4RCRUbFTEQT6x+XeSGKQTrlyqM8xFbOnct0feTlcmiBunhaAx6ootIFS2Dbn2+Vy7j w6Fg== X-Gm-Message-State: AGi0Pua24KiaVdz/0zlib0G9uAVk8SEtZYxlsECxF41Z3E9l2otRpzlZ qfvJVM5+0qsFU/3oUyzYYdW6prc5GT+gn9vTfAQ3zjn8 X-Google-Smtp-Source: APiQypIcIi+bDHISez6FMzLKX83Ap1TUP6zLU7Nd2unaN5okhkMcEoeZA2J4Td+99yqcvEd+mNohd31ottBEjQg3gNY= X-Received: by 2002:a92:cd01:: with SMTP id z1mr501451iln.182.1588605122898; Mon, 04 May 2020 08:12:02 -0700 (PDT) MIME-Version: 1.0 References: <20200423153835.GF42225@spindle.one-eyed-alien.net> In-Reply-To: <20200423153835.GF42225@spindle.one-eyed-alien.net> From: Ed Maste Date: Mon, 4 May 2020 11:11:50 -0400 Message-ID: Subject: Re: ASLR/PIE status in FreeBSD HEAD To: Brooks Davis Cc: Marcin Wojtas , freebsd-security@freebsd.org, Rafal Jaworowski Content-Type: text/plain; charset="UTF-8" X-Rspamd-Queue-Id: 49G5tY4DNFz4KR4 X-Spamd-Bar: --- Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none; spf=pass (mx1.freebsd.org: domain of carpeddiem@gmail.com designates 209.85.166.173 as permitted sender) smtp.mailfrom=carpeddiem@gmail.com X-Spamd-Result: default: False [-3.46 / 15.00]; ARC_NA(0.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000,0]; RCVD_TLS_ALL(0.00)[]; FROM_HAS_DN(0.00)[]; RCPT_COUNT_THREE(0.00)[4]; R_SPF_ALLOW(-0.20)[+ip4:209.85.128.0/17:c]; NEURAL_HAM_LONG(-1.00)[-1.000,0]; MIME_GOOD(-0.10)[text/plain]; DMARC_NA(0.00)[freebsd.org]; TO_DN_SOME(0.00)[]; TO_MATCH_ENVRCPT_SOME(0.00)[]; RCVD_IN_DNSWL_NONE(0.00)[173.166.85.209.list.dnswl.org : 127.0.5.0]; IP_SCORE(-1.46)[ip: (-6.45), ipnet: 209.85.128.0/17(-0.40), asn: 15169(-0.43), country: US(-0.05)]; FORGED_SENDER(0.30)[emaste@freebsd.org,carpeddiem@gmail.com]; RWL_MAILSPIKE_POSSIBLE(0.00)[173.166.85.209.rep.mailspike.net : 127.0.0.17]; MIME_TRACE(0.00)[0:+]; R_DKIM_NA(0.00)[]; FREEMAIL_ENVFROM(0.00)[gmail.com]; ASN(0.00)[asn:15169, ipnet:209.85.128.0/17, country:US]; FROM_NEQ_ENVFROM(0.00)[emaste@freebsd.org,carpeddiem@gmail.com]; RCVD_COUNT_TWO(0.00)[2] X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 May 2020 15:12:06 -0000 On Thu, 23 Apr 2020 at 11:38, Brooks Davis wrote: > > > I was thinking if it is possible to come up with such wide test > > coverage to test every single application from the base system. Do you > > think it is achievable or should we rather follow the approach to do > > as many tests as possible, but rely on the community feedback to catch > > the corner cases (like the ntpd issue mentioned in this thread)? > > What about the ports? > > If we gate on full testing we'll never move forward. We had a GSoC > project a few years ago to try to generate lame tests for each program, > if someone picked that up, we could get better coverage fairly > quickly, but it would still be far from complete. Indeed, having a basic smoke test for as much of the base system as possible is a good initial step. I suspect it won't take very long to have confidence in turning on options for the base system, but ports will be a much longer process. For ports I think the first thing that needs to happen is to have some infrastructure in ports itself to allow individual ports to indicate (via elfctl) that they are not compatible with certain options; with that in place it should be trivial to start marking individual ports.