Date: Fri, 26 Feb 2021 20:32:26 +0100 From: Gordon Bergling <gbe@freebsd.org> To: Konstantin Belousov <kostikbel@gmail.com> Cc: Gordon Bergling <gbe@freebsd.org>, Ed Maste <emaste@freebsd.org>, FreeBSD Current <freebsd-current@freebsd.org> Subject: Re: HEADS-UP: PIE enabled by default on main Message-ID: <YDlMykRXkT03y6Kt@lion.0xfce3.net> In-Reply-To: <YDlEs6tA9e9VJJ0C@kib.kiev.ua> References: <CAPyFy2CyxG=Bj8T22ixW3=E3dv6mPoZRwJ_VSN%2BTwky95rUYYw@mail.gmail.com> <YDk/G50NWjeoia33@lion.0xfce3.net> <YDlEs6tA9e9VJJ0C@kib.kiev.ua>
next in thread | previous in thread | raw e-mail | index | archive | help
--0aKDmc0T7z5bRVAk Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Feb 26, 2021 at 08:57:55PM +0200, Konstantin Belousov wrote: > On Fri, Feb 26, 2021 at 07:34:03PM +0100, Gordon Bergling wrote: > > On Thu, Feb 25, 2021 at 03:58:07PM -0500, Ed Maste wrote: > > > As of 9a227a2fd642 (main-n245052) base system binaries are now built > > > as position-independent executable (PIE) by default, for 64-bit > > > architectures. PIE executables are used in conjunction with address > > > randomization as a mitigation for certain types of security > > > vulnerabilities. > > >=20 > > > If you track -CURRENT and normally build WITHOUT_CLEAN you'll need to > > > do one initial clean build -- either run `make cleanworld` or set > > > WITH_CLEAN=3Dyes. > > >=20 > > > No significant user-facing changes are expected from this change, but > > > there are some minor ones. For example, `file` will indicate that > > > binaries are PIE by reporting something like `ELF 64-bit LSB pie > > > executable` rather than `ELF 64-bit LSB executable`. Also, for most > > > workloads no notable performance impact is expected. > > >=20 > > > For almost all ports this should result in no change. There are a > > > small number of ports that use base system /usr/share/mk > > > infrastructure and thus inherit the base system default, and some of > > > those initially failed to build. Those found during an exp-run in > > > PR253275 have been addressed or have patches waiting. > > >=20 > > > Please watch out for any new issues after you next update the base > > > system and/or ports, and report issues via a Bugzilla PR or in reply > > > here. > >=20 > > Thats a huge step forward in terms on security. > Can you explain why? >=20 > Thanks. I can try. Enabling PIE for every 64bit architecture is in that matter a st= ep forward in security as it enables ASLR for further adoption. Thank You, again. --Gordon > > Thanks for the efforts and anyone involved. --0aKDmc0T7z5bRVAk Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQGTBAEBCgB9FiEEYbWI0KY5X7yH/Fy4OQX2V8rP09wFAmA5TMpfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDYx QjU4OEQwQTYzOTVGQkM4N0ZDNUNCODM5MDVGNjU3Q0FDRkQzREMACgkQOQX2V8rP 09xi1Qf/bzXv5q8UON5FW5fLatZSuOCE5oH1iD5/Sp80R917R6CimMO9Ofd/lcnL Yedtu6MK7WgK5WYf/nTtuOv5pesvcMTWhJo6dqjBJanynlcKx2Lt79fwV1LNn6O/ 6hPlWiTO5CvH16zgkLBpSq0dLlU4GUHlgZKwv8ysDui5Ye29a5C7NdO3WLz0Bcqs CBfgEz9cEjFiILrcp1HcREhdEGGWw5AsekocDT17P3cicNcQaH6XhhoCb8cchRj8 3L3ioN4fSntDkIwKiSIDiAKsC5//6cW5FQ0FfpcNyA+rJPOyDQanXl80Wmh3bucf LNn0VsSHm2JqVAuY6NKUo3NctXHJtg== =AHE4 -----END PGP SIGNATURE----- --0aKDmc0T7z5bRVAk--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?YDlMykRXkT03y6Kt>