From owner-freebsd-stable@freebsd.org Sat Aug 24 22:19:55 2019 Return-Path: Delivered-To: freebsd-stable@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id E6E88CCAAE for ; Sat, 24 Aug 2019 22:19:55 +0000 (UTC) (envelope-from trond.endrestol@ximalas.info) Received: from enterprise.ximalas.info (enterprise.ximalas.info [IPv6:2001:700:1100:1::8]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ximalas.info", Issuer "Hostmaster ximalas.info" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 46GCPP5W2nz4DQK for ; Sat, 24 Aug 2019 22:19:53 +0000 (UTC) (envelope-from trond.endrestol@ximalas.info) Received: from enterprise.ximalas.info (Ximalas@localhost [127.0.0.1]) by enterprise.ximalas.info (8.15.2/8.15.2) with ESMTPS id x7OMJiSA038828 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NO); Sun, 25 Aug 2019 00:19:44 +0200 (CEST) (envelope-from trond.endrestol@ximalas.info) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ximalas.info; s=default; t=1566685184; bh=mkCVBSJZtgFruoxiJbCYOpknoBUzxB7wLe6Vj2QPhhs=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=naFbXxLvZDGZ2fLLQnajaplKk11oaKckETpjTy063VCzg8W6dVGgHSoDADFYHyP7V pNmPMjnc3i9WVvBo2UYEuT08yRzo7Ux+e5/9V5D0X+8k62hshnnVGFb9iPj15Zlffn NMlLUVJ670tTvGMmDntWUxyS5a0z/q3GaetBjWJX7v+yef5xj85hXhNbGTVW3Q8Fpt vsIwf7wDxs1dwR9BxyiCpQjMJtpazbNACWtxH3QSOx8NkTw5Gzm3lMRUcYkeBsjxy2 ur8+2bfomgmttN8K23/iIy2USPB/Jl7bVe7nXnwkVBeLjlB44RGv3St8klpgig3mqS zZUJ7QxSvtF5w== Received: from localhost (trond@localhost) by enterprise.ximalas.info (8.15.2/8.15.2/Submit) with ESMTP id x7OMJhXU038825; Sun, 25 Aug 2019 00:19:43 +0200 (CEST) (envelope-from trond.endrestol@ximalas.info) X-Authentication-Warning: enterprise.ximalas.info: trond owned process doing -bs Date: Sun, 25 Aug 2019 00:19:43 +0200 (CEST) From: =?UTF-8?Q?Trond_Endrest=C3=B8l?= Sender: Trond.Endrestol@ximalas.info To: Konstantin Belousov cc: freebsd-stable@freebsd.org Subject: Re: ntpd doesn't like ASLR on stable/12 post-r350672 In-Reply-To: <20190824204114.GG71821@kib.kiev.ua> Message-ID: References: <20190824204114.GG71821@kib.kiev.ua> User-Agent: Alpine 2.21.99999 (BSF 352 2019-06-22) OpenPGP: url=http://ximalas.info/about/tronds-openpgp-public-key MIME-Version: 1.0 X-Spam-Status: No, score=-1.2 required=5.0 tests=ALL_TRUSTED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on enterprise.ximalas.info X-Rspamd-Queue-Id: 46GCPP5W2nz4DQK X-Spamd-Bar: ---- Authentication-Results: mx1.freebsd.org; dkim=pass header.d=ximalas.info header.s=default header.b=naFbXxLv; dmarc=pass (policy=none) header.from=ximalas.info; spf=pass (mx1.freebsd.org: domain of trond.endrestol@ximalas.info designates 2001:700:1100:1::8 as permitted sender) smtp.mailfrom=trond.endrestol@ximalas.info X-Spamd-Result: default: False [-4.84 / 15.00]; ARC_NA(0.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000,0]; R_DKIM_ALLOW(-0.20)[ximalas.info:s=default]; FROM_HAS_DN(0.00)[]; TO_DN_SOME(0.00)[]; R_SPF_ALLOW(-0.20)[+a:c]; NEURAL_HAM_LONG(-1.00)[-1.000,0]; MIME_GOOD(-0.10)[multipart/mixed,text/plain]; HAS_XAW(0.00)[]; RCVD_COUNT_THREE(0.00)[3]; TO_MATCH_ENVRCPT_SOME(0.00)[]; DKIM_TRACE(0.00)[ximalas.info:+]; CTYPE_MIXED_BOGUS(1.00)[]; RCPT_COUNT_TWO(0.00)[2]; NEURAL_HAM_SHORT(-0.99)[-0.994,0]; DMARC_POLICY_ALLOW(-0.50)[ximalas.info,none]; FREEMAIL_TO(0.00)[gmail.com]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+,1:+]; RCVD_TLS_LAST(0.00)[]; ASN(0.00)[asn:224, ipnet:2001:700::/32, country:NO]; IP_SCORE(-1.85)[ip: (-8.24), ipnet: 2001:700::/32(-0.58), asn: 224(-0.41), country: NO(-0.01)] Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8BIT X-Content-Filtered-By: Mailman/MimeDel 2.1.29 X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 24 Aug 2019 22:19:56 -0000 On Sat, 24 Aug 2019 23:41+0300, Konstantin Belousov wrote: > On Sat, Aug 24, 2019 at 10:04:49PM +0200, Trond Endrestøl wrote: > > > Disabling ASLR, kern.elf64.aslr.enable=0, before starting ntpd > > manually is a workaround, but this is not viable in the long run. > > Why ? I like to keep ALSR enabled in the hope that it actually achieves something. You are right, I can disable it completely. > > I tried changing command="/usr/sbin/${name}" to > > command="/usr/bin/proccontrol -m aslr -s disable /usr/sbin/${name}" in > > /etc/rc.d/ntpd, but that didn't go well. > > If you set kern.elf64.aslr.stack_gap to zero, does it help ? That helped. Thank you again. -- Trond. From owner-freebsd-stable@freebsd.org Sat Aug 24 22:28:26 2019 Return-Path: Delivered-To: freebsd-stable@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id A1BE4CCE9A for ; Sat, 24 Aug 2019 22:28:26 +0000 (UTC) (envelope-from kostikbel@gmail.com) Received: from kib.kiev.ua (kib.kiev.ua [IPv6:2001:470:d5e7:1::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 46GCbF6Bnjz4Dqn for ; Sat, 24 Aug 2019 22:28:25 +0000 (UTC) (envelope-from kostikbel@gmail.com) Received: from tom.home (kib@localhost [127.0.0.1]) by kib.kiev.ua (8.15.2/8.15.2) with ESMTPS id x7OMSIoe009091 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NO); Sun, 25 Aug 2019 01:28:21 +0300 (EEST) (envelope-from kostikbel@gmail.com) DKIM-Filter: OpenDKIM Filter v2.10.3 kib.kiev.ua x7OMSIoe009091 Received: (from kostik@localhost) by tom.home (8.15.2/8.15.2/Submit) id x7OMSHOo009090; Sun, 25 Aug 2019 01:28:17 +0300 (EEST) (envelope-from kostikbel@gmail.com) X-Authentication-Warning: tom.home: kostik set sender to kostikbel@gmail.com using -f Date: Sun, 25 Aug 2019 01:28:17 +0300 From: Konstantin Belousov To: Trond =?utf-8?Q?Endrest=C3=B8l?= Cc: freebsd-stable@freebsd.org Subject: Re: ntpd doesn't like ASLR on stable/12 post-r350672 Message-ID: <20190824222817.GJ71821@kib.kiev.ua> References: <20190824204114.GG71821@kib.kiev.ua> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.12.1 (2019-06-15) X-Spam-Status: No, score=-1.0 required=5.0 tests=ALL_TRUSTED,BAYES_00, DKIM_ADSP_CUSTOM_MED,FORGED_GMAIL_RCVD,FREEMAIL_FROM, NML_ADSP_CUSTOM_MED autolearn=no autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on tom.home X-Rspamd-Queue-Id: 46GCbF6Bnjz4Dqn X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=fail reason="No valid SPF, No valid DKIM" header.from=gmail.com (policy=none); spf=softfail (mx1.freebsd.org: 2001:470:d5e7:1::1 is neither permitted nor denied by domain of kostikbel@gmail.com) smtp.mailfrom=kostikbel@gmail.com X-Spamd-Result: default: False [-2.98 / 15.00]; ARC_NA(0.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000,0]; RCVD_TLS_ALL(0.00)[]; FROM_HAS_DN(0.00)[]; TO_DN_SOME(0.00)[]; FREEMAIL_FROM(0.00)[gmail.com]; NEURAL_HAM_LONG(-1.00)[-1.000,0]; MIME_GOOD(-0.10)[text/plain]; HAS_XAW(0.00)[]; R_SPF_SOFTFAIL(0.00)[~all]; IP_SCORE_FREEMAIL(0.00)[]; TO_MATCH_ENVRCPT_SOME(0.00)[]; NEURAL_HAM_SHORT(-0.98)[-0.979,0]; RCPT_COUNT_TWO(0.00)[2]; IP_SCORE(0.00)[ip: (-2.58), ipnet: 2001:470::/32(-4.44), asn: 6939(-3.06), country: US(-0.05)]; FROM_EQ_ENVFROM(0.00)[]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:6939, ipnet:2001:470::/32, country:US]; RCVD_COUNT_TWO(0.00)[2]; FREEMAIL_ENVFROM(0.00)[gmail.com]; DMARC_POLICY_SOFTFAIL(0.10)[gmail.com : No valid SPF, No valid DKIM,none] X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 24 Aug 2019 22:28:26 -0000 On Sun, Aug 25, 2019 at 12:19:43AM +0200, Trond Endrestøl wrote: > On Sat, 24 Aug 2019 23:41+0300, Konstantin Belousov wrote: > > > I tried changing command="/usr/sbin/${name}" to > > > command="/usr/bin/proccontrol -m aslr -s disable /usr/sbin/${name}" in > > > /etc/rc.d/ntpd, but that didn't go well. > > > > If you set kern.elf64.aslr.stack_gap to zero, does it help ? > > That helped. Thank you again. Can you verify is ntpd sets new rlimit(RLIMIT_STACK) for the main thread, and if yes, what this new limit is ? aslr.stack_gap is the percentage for the gap on that stack, and since default size of the main stack limit is quite large 512M, even 3% (default gap upper limit) are whole 15M. If the new limit is less than 15M, there is a likely probability that only the gap is left after the rlimit(2) call, leaving no space for the program frames. At least this looks like a nice theory.