Date: Mon, 16 Sep 2019 15:45:04 +1000 From: Dewayne Geraghty <dewaynegeraghty@gmail.com> To: freebsd-stable stable <freebsd-stable@freebsd.org> Subject: ASLR requirement for images Message-ID: <CAGnMC6q0EhgkjPM0bo5JbUNxXHWM10pZXAyRE9LwpoyBjK_2kw@mail.gmail.com>
next in thread | raw e-mail | index | archive | help
>From the comment at https://reviews.freebsd.org/D5603 "The procctl(2) control for ASLR is implemented, [but] I have not provided a userspace wrapper around the syscall. In fact, the most reasonable control needed is per-image and not per-process, but we have no tradition to put the kernel-read attributes into the extattrs of binary, so I am still pondering that part and this also explains the non-written tool." I think its time to revisit the approach. Storing the attributes within the extattr is preferable to a central file - we're very fortunate to have the MAC framework, perhaps a MAC_ASLR is required (to identify those applications that can/can't use ASLR)? Other applications also make use of protection bits inside extattr, notably samba4. References: https://reviews.freebsd.org/D19281 mac_veriexec: Create kernel module to parse manifest based on envs.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAGnMC6q0EhgkjPM0bo5JbUNxXHWM10pZXAyRE9LwpoyBjK_2kw>