From owner-freebsd-security@freebsd.org Thu Mar 10 13:54:49 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 208EEACAF71 for ; Thu, 10 Mar 2016 13:54:49 +0000 (UTC) (envelope-from shawn.webb@hardenedbsd.org) Received: from mail-qg0-x234.google.com (mail-qg0-x234.google.com [IPv6:2607:f8b0:400d:c04::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id CCAAEA71 for ; Thu, 10 Mar 2016 13:54:48 +0000 (UTC) (envelope-from shawn.webb@hardenedbsd.org) Received: by mail-qg0-x234.google.com with SMTP id w104so70580070qge.1 for ; Thu, 10 Mar 2016 05:54:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hardenedbsd-org.20150623.gappssmtp.com; s=20150623; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=q8NWW6n1xIC5n12YCancZuIap5qQaHcDd75ibsVxXng=; b=quUoRzcUgXQXYRs+kGcYg1ioYPxv6z36uTMBVf8UDG1z/Ojhnro+Wr3GT2MVa+fmds RH6lgr3NQwGpNfpgAt0G1V+A4AfooOI9wnOJ9XGRIZ4VofMrqoBVK8K0+hV/LpneBpks 7n2zlvu3v8FeEmAW4gtbr6BKlGM1r6O7taZxxNr0zDOHghjEUjSkThQ0gA8Nc2TTmHh5 yjAsKCw2CMQ7My1dXYPCrI3QwG2w8ZsCwuWuU7TAm8xmTwxOFniwu1GLYiF7FY1vwI2+ HckVzoz82puIP5UmaAB+vpG5eGKlm2Th8BJ/syFSopLNrCujFy2lcSVxijaI/jTzGkQi BNFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=q8NWW6n1xIC5n12YCancZuIap5qQaHcDd75ibsVxXng=; b=UFES6qeklVBCeAQzL0ZuhXMYtJRXbrANIn2K9a6UL2MCG93sudBIGG6q4zEQjgMh6O FI/9/jFTL762U/4eFxEmhhK8pIYndElRD58/h9p3Mcd34ca2FBzstg0QPcbmB8OHuADH OxvFVSji/GKgVdyvFNVdAy92ocly00K14O6CkkRHmfneX6HLzXtP4QcvYEtnBVzn+r2d a4E42QEmeB0rm0mTv9J9YyX33Eu0oLOacaFYHL5XHaLNQuK6PU7iHiVohlAfXOmfLa5g H+D3lLpFeSS73fU+mXryply73K8Lf1UEMEoNLFXvlbsM7DvfH4KU5SN6/Bu9QfcFrSos JyVg== X-Gm-Message-State: AD7BkJJFuxiuVJQQ2c0JP7IAcTk58Kce0TD+8ES9/GxrTJqh2l26IyyxVl6IxgXJCnLcG+q1 X-Received: by 10.140.133.133 with SMTP id 127mr4451391qhf.42.1457618087990; Thu, 10 Mar 2016 05:54:47 -0800 (PST) Received: from mutt-hardenedbsd (c-73-135-80-144.hsd1.md.comcast.net. [73.135.80.144]) by smtp.gmail.com with ESMTPSA id o97sm1704268qge.23.2016.03.10.05.54.46 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 10 Mar 2016 05:54:46 -0800 (PST) Date: Thu, 10 Mar 2016 08:54:45 -0500 From: Shawn Webb To: Brett Glass Cc: Sergej Schmidt , freebsd-security@freebsd.org Subject: Re: Will 11.0-RELEASE include ASLR? Message-ID: <20160310135445.GF42303@mutt-hardenedbsd> References: <56E02D95.9020303@anongoth.pl> <201603091722.KAA24139@mail.lariat.net> <56E0BEEB.2070901@uni-ulm.de> <201603100523.WAA00750@mail.lariat.net> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="ULyIDA2m8JTe+TiX" Content-Disposition: inline In-Reply-To: <201603100523.WAA00750@mail.lariat.net> X-Operating-System: FreeBSD mutt-hardenedbsd 11.0-CURRENT-HBSD FreeBSD 11.0-CURRENT-HBSD X-PGP-Key: http://pgp.mit.edu/pks/lookup?op=vindex&search=0x6A84658F52456EEE User-Agent: Mutt/1.5.24 (2015-08-30) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2016 13:54:49 -0000 --ULyIDA2m8JTe+TiX Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Mar 09, 2016 at 10:23:22PM -0700, Brett Glass wrote: > At 05:25 PM 3/9/2016, Sergej Schmidt wrote: >=20 > >In which way ASLR has something to do with security by obscurity? >=20 > ASLR attempts to create security by obscuring the locations of=20 > objects within the machine's address space. Critics of ASLR say=20 > (with some justification!) that this is just hiding them... in=20 > plain sight. Without getting into a flame war about that, I would=20 > simply like the option of compiling it in or not. That option has always been available in HardenedBSD's implementation. It has been a kernel option that you can toggle at compile time with the PAX_ASLR kernel option. IT can also be toggled via /boot/loader.conf by setting hardening.pax.aslr.status=3D0. Thanks, --=20 Shawn Webb HardenedBSD GPG Key ID: 0x6A84658F52456EEE GPG Key Fingerprint: 2ABA B6BD EF6A F486 BE89 3D9E 6A84 658F 5245 6EEE --ULyIDA2m8JTe+TiX Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJW4XyhAAoJEGqEZY9SRW7uAksP/jRzuQ1gZ0fZvjhTZOEfQwsS o0f+yuC7Zj/2eXn6Bychl8WsL+ZBqfUTZYJFQh+TbP4X3Oqs51np0G4h2R3dY6j5 L3P7SOui7I3eQRqGXnQNuvbVdN9++3EY5Km8qfzSU1FM+QQHCGJWO8LBGVLOAQiY Z3bXGreX0XYtAUFQOZPtJVDBnLz9K8LmEEFz5r89pkXqc1D6JxG5NRw4KDqQB+FS RgSWzDL52dT5MeUGYNFaAakatH7LJiTOXLMrVY3sWPkfwO+0HgJMApgg5yGJnckP ULXb7DkHL9aTv/Rv7WSe+6pybv+PLQPCY26c/gAxttCuH+TbHpjnuqsdHv6o3QzX 8E8PhhlioNr839Wl1UEw2fML41EuhiB0fC1ik135EAfIr7fhJMCFPixndM/c/aJx kb5xUMnYKDPitGzqXGOR1K/qw2ODARhSanbOkSwupM8t/13RhMVLVyiGxiF4TjW0 x8dSuzLYIw423qtCGWLYq16ZxP3e8scV5SRjfuE1gRuZzxmaelTkcWSkp9FQWGdN sr8/txrx0tE+OuZufwMGIp37jG3hNPkcCHRHFl0ANC0Si0nZ2dk0xw0U59/dQi34 D00/bAg5DHMFiott6SerEW0bg/tof9uUBOA88Q8tS5w4GL0fpe9SDAkU+MXvdbVd 1NMFWF0pEMYlLgo3g6Es =+RPW -----END PGP SIGNATURE----- --ULyIDA2m8JTe+TiX--