Date: Thu, 16 Oct 2014 17:37:19 -0500 From: Bryan Drewery <bdrewery@FreeBSD.org> To: Shawn Webb <lattera@gmail.com>, Jeremie Le Hen <jlh@freebsd.org> Cc: hunger@hunger.hu, David Carlier <david.carlier@hardenedbsd.org>, Oliver Pinter <oliver.pntr@gmail.com>, Sean Bruno <sbruno@freebsd.org>, Konstantin Belousov <kib@freebsd.org>, freebsd-arch@freebsd.org, PaX Team <pageexec@freemail.hu> Subject: Re: PIE/PIC support on base Message-ID: <5440489F.3080602@FreeBSD.org> In-Reply-To: <CADt0fhzg5G1cLEBNfHXSEi9iP7mCP=8sSwpXbFobig=pm=QsFQ@mail.gmail.com> References: <CAMe1fxaYn%2BJaKzGXx%2Bywv8F0mKDo72g=W23KUWOKZzpm8wX4Tg@mail.gmail.com> <CAGSa5y3s9r0DRyinfqV=PJc_BT=Em-SLfwhD25nP0=6ki9pHWw@mail.gmail.com> <CAMe1fxaBEc5T77xjpRsMi_kkc5LXwPGooLWTO9C1FJcLSPnO8w@mail.gmail.com> <CAGSa5y2=bKpaeLO_S5W%2B1YGq02WMgCZn_5bbEMw%2Bx3j-MYDOoA@mail.gmail.com> <CADt0fhzg5G1cLEBNfHXSEi9iP7mCP=8sSwpXbFobig=pm=QsFQ@mail.gmail.com>
index | next in thread | previous in thread | raw e-mail
[-- Attachment #1 --] On 10/16/2014 5:15 PM, Shawn Webb wrote: > > > On Thu, Oct 16, 2014 at 5:59 PM, Jeremie Le Hen <jlh@freebsd.org > <mailto:jlh@freebsd.org>> wrote: > > On Thu, Oct 16, 2014 at 8:21 PM, David Carlier > <david.carlier@hardenedbsd.org > <mailto:david.carlier@hardenedbsd.org>> wrote: > > > > I chose the "atomic" approach, at the moment very few binaries are > > concerned at the moment. So I applied INCLUDE_PIC_ARCHIVE in the needed > > libraries plus created WITH_PIE which add fPIE/fpie -pie flags only if you > > include <bsd.prog.pie.mk <http://bsd.prog.pie.mk>>; (which include > <bsd.prog.mk <http://bsd.prog.mk>>...) otherwise other > > binaries include <bsd.prog.mk <http://bsd.prog.mk>>; as usual hence does not apply. Look > > reasonable approach ? > > I think I understand what you mean. But I think PIE is commonplace > nowadays and I don't understand what you win by not enabling it for > the whole system. Is it a performance concern? Is it to preserve > conservative minds from to much change? :) > > > Looping in Kostik, Bryan Drewery, the PaX team, Hunger, and Sean Bruno. > > On i386, there is a performance cost due to not having an extra register > available for the relocation work that has to happen. PIE doesn't carry > much of a performance penalty on amd64, though it still does carry some > on first resolution of functions (due to the extra relocation step the > RTLD has to worry about). On amd64, after symbol resolution has taken > place, there is no further performance penalty due to amd64 having an > extra register to use for PIE/PIC. I'm unsure what, if any, performance > penalty PIE carries on ARM, AArch64, and sparc64. > I think if the performance impact can be well understood on all architectures, and that it is not more than a few % points, other people may be more willing to enable it on all. I can't speak for them, but if the impact is not significant then it is safer and simpler to enable everywhere and I would think that argument would win over anything else. What do I know though? That approach failed already. > Certain folk would prefer to see PIE enabled only in certain > applications. /bin/ls can't really make much use of PIE. But sshd can. I > personally would like to see all of base's applications compiled as > PIEs, but that's a long ways off. It took OpenBSD several years to > accomplish that. Having certain high-visibility applications (like sshd, > inetd, etc) is a great start. Providing a framework for application > developers to opt their application into PIE is another great start. > > Those are my two cents. > > Thanks, > > Shawn -- Regards, Bryan Drewery [-- Attachment #2 --] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (MingW32) iQEcBAEBAgAGBQJUQEifAAoJEDXXcbtuRpfPGpcH/i2FCR+S5iFns4VqxcxupJRB Fx5Me/j1l8WPOIjnsCDAa6Ojz178YuaTl7SCAPSrCG7+NE0X1XpSmeqMXzx4TSZu IbxgMVQnHrgR0Wde02l0chStIRBPZs8RrOis8QvfrRtWKelSLe1swkSNguAR4onE xD6XpbOsM5/Kl1lwde9WAkL0/20vjuChl5k0FHEJNWifImiwz+5t5/NRpxYKX8en dph8Ownh0Iskp1Wl/2qVh7yOtl5rcOqKrSGb0+WPxfjowXMVx6C91xKQtmqLxaAg GFVArVU3hsWjxzrxhgLD2K/M4OJXy6Iy8/Jkr0pY/dDlqy/2T3iTWBCF5yiVMPA= =/Lxy -----END PGP SIGNATURE-----help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5440489F.3080602>