From owner-freebsd-arch@FreeBSD.ORG Wed May 27 16:54:51 2015 Return-Path: Delivered-To: freebsd-arch@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id CE09EDD7; Wed, 27 May 2015 16:54:51 +0000 (UTC) (envelope-from adrian.chadd@gmail.com) Received: from mail-ig0-x229.google.com (mail-ig0-x229.google.com [IPv6:2607:f8b0:4001:c05::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 96DECE9A; Wed, 27 May 2015 16:54:51 +0000 (UTC) (envelope-from adrian.chadd@gmail.com) Received: by igbsb11 with SMTP id sb11so18832425igb.0; Wed, 27 May 2015 09:54:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:cc:content-type; bh=NtjqxT7CwZUbZbNNx2BhSzm2IrTBH+bnvMRbIDnotn0=; b=EfLmclpS/9rOHmqt6UwW42SzcMQYODci7lGhyGNe38ymdkcgQDRlk8Q+oVlFGGkR6t GzMehpHWBHfLNzcFrwv3rZMdIP1T2rjbXxP8VlbUOhJ6XvfkTHZXuBGwt02VWMelGpjT QjW+OleXs+JPjt2zKtWvrTOQE6nWsv8J5/6QDx5ZrjLsnzLa7J2sf01fMjJnxZ5d+L7q V6n32BAU+mXZ71uIfC7rr8rwbOY5RtYkBiKo4bNWfvxNW2gC/lxnBzPF3wgQmShe02RB /bAul+s8OgBWTT7lAcY5iC7sLPdVDGdChpCfGYhysiEPd6B5D5H0s9hBqWYH3epwcLv6 wNQQ== MIME-Version: 1.0 X-Received: by 10.43.163.129 with SMTP id mo1mr4521328icc.61.1432745690953; Wed, 27 May 2015 09:54:50 -0700 (PDT) Sender: adrian.chadd@gmail.com Received: by 10.36.38.133 with HTTP; Wed, 27 May 2015 09:54:50 -0700 (PDT) In-Reply-To: <1432744877.1200.65.camel@freebsd.org> References: <555CADB6.202@FreeBSD.org> <555CC369.1030206@FreeBSD.org> <555FBE83.6080103@FreeBSD.org> <55656245.3000205@freebsd.org> <5565EB16.20208@FreeBSD.org> <1432744877.1200.65.camel@freebsd.org> Date: Wed, 27 May 2015 09:54:50 -0700 X-Google-Sender-Auth: D8WSmmiJ3gewYtSCi_wDcy3lx5Y Message-ID: Subject: Re: ASLR work into -HEAD ? From: Adrian Chadd To: Ian Lepore Cc: Pedro Giffuni , Alfred Perlstein , "freebsd-arch@freebsd.org" Content-Type: text/plain; charset=UTF-8 X-BeenThere: freebsd-arch@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: Discussion related to FreeBSD architecture List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 May 2015 16:54:51 -0000 On 27 May 2015 at 09:41, Ian Lepore wrote: > You may be in a minority, but you're not alone. I just hope that when > this fad fades away we aren't left with a permenent performance hit that > we can't get rid of. The best way to ensure that is to make sure > there's a no-performance-hit way to disable this stuff on day one. I believe that's the point of the implementation. It's disabled by default. We can also remove it relatively easily too. I may want this compiled into access points and other IoT devices to harden against a class of attacks, but I also want to be able to remove it for debugging. He makes it so you can enable/disable it during runtime with a sysctl - it's quite nice. -adrian