From owner-freebsd-toolchain@freebsd.org Fri Aug 26 15:01:22 2016 Return-Path: Delivered-To: freebsd-toolchain@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id BE3E9B701A7 for ; Fri, 26 Aug 2016 15:01:22 +0000 (UTC) (envelope-from wlosh@bsdimp.com) Received: from mail-it0-x229.google.com (mail-it0-x229.google.com [IPv6:2607:f8b0:4001:c0b::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 864AFDED for ; Fri, 26 Aug 2016 15:01:22 +0000 (UTC) (envelope-from wlosh@bsdimp.com) Received: by mail-it0-x229.google.com with SMTP id e63so336671656ith.1 for ; Fri, 26 Aug 2016 08:01:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bsdimp-com.20150623.gappssmtp.com; s=20150623; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc; bh=rUKE3FABTHs2dSH69Yt7RPTinhLyjzhmRCG1Ck60ZMc=; b=JBNF3BR2XTz+Dyb1sAry+MI70tFWdwOVYhn0VBiiiDxW+6DUKpCv1kHj9fzSbAOQVR /5u/y09eKZv1fX3iNUATKKXwEKCy59Sio5BvKME7XBN2C6TIC4dMO0womeNd1N4iO5VJ R//Ix23mr0h6BlJw3ZtdbzD8KpZXMnhpX3KoIwhJgEwZxeyFoh6UzaDi5SF2PfMGClie mUdydDtcodk1YQ+aI4LXhIQIfOPJ/lJ6HNyslT+g4FUoDxQ3hHWAcS+UW3mtJ3JM78I1 VIT2wy9c8SHEFX4iGRS9PL3Aktl3EtB0yQLLgVmLPL3vyOkDGiqFOWRCc6Vvxv9JP7Z2 cocA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc; bh=rUKE3FABTHs2dSH69Yt7RPTinhLyjzhmRCG1Ck60ZMc=; b=FXc1yn/xWH4Jf4JfHYkcc+MD4e6ajOjldhAcLtjSjbReWuZhChqn+RoPl6jaL3A3rW bKqgK8OM3JpILjrx7ob3yks8gu9+tzgp9IErUUk+rN9d5PupRpa3iz5zw4q/WwkwNKca ymnWBBEW5p2M+Fg2s4t/bXjkBmCDZXqbrJOatMkdlndscG6MbymgXMAwweqd6GrYzmoE 8aUuUx/VX67NQM/IgtH+RCCbLIV5Mtt0Hp4j0/NSieax9EeJFvql6dkbc26l/QAsnoxu VNBmMJ7lzaj6vaFKZZxRfAMtPcsofN59QUwvQrk7J9NTY/6ZXyfga2aGsb/yXQfDp6+T F1ww== X-Gm-Message-State: AEkoouu+AA5HWhMeEELw2vxBtZeSWz2yUMKE/01jWbW4X2L3DhWUylctTXyadf8VDe9G7JS8X2E53rWjAQt2ig== X-Received: by 10.36.116.193 with SMTP id o184mr12473692itc.14.1472223681829; Fri, 26 Aug 2016 08:01:21 -0700 (PDT) MIME-Version: 1.0 Sender: wlosh@bsdimp.com Received: by 10.36.65.7 with HTTP; Fri, 26 Aug 2016 08:01:21 -0700 (PDT) X-Originating-IP: [69.53.245.200] In-Reply-To: References: From: Warner Losh Date: Fri, 26 Aug 2016 09:01:21 -0600 X-Google-Sender-Auth: XBe7cbTeX-52m2gKXdMoNIv36qA Message-ID: Subject: Re: Time to enable partial relro To: Ed Maste Cc: Pedro Giffuni , "freebsd-toolchain@FreeBSD.org" Content-Type: text/plain; charset=UTF-8 X-BeenThere: freebsd-toolchain@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Maintenance of FreeBSD's integrated toolchain List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Aug 2016 15:01:22 -0000 On Fri, Aug 26, 2016 at 8:36 AM, Ed Maste wrote: > On 26 August 2016 at 10:18, Warner Losh wrote: >> >> So what's the summary of why we'd want to do that? What benefit does it bring? >> Sure, other folks do it, but why? > > It's a relatively low cost technique to mitigate certain > vulnerabilities. rtld needs to write to some sections during load but > they don't need to be writeable after starting the program. relro > reorders the output sections so that they are grouped together, and > rtld remaps them read-only on start. This is often called "partial > relro." I don't know of any real downside to enabling it, other than > it could possibly break some strangely built third party software. > It's been enabled on other platforms for quite some time though and I > doubt we'd run into new issues. > > It doesn't bring a huge benefit by itself though; the PLT is still > writeable. Adding "-z now" to the linker invocation produces "full > relro" which makes the PLT read-only too. It has a negative impact on > process start-up time though. Sounds like this has implications for all the RTLD on all our architectures. Has this been tested across all of them? Warner