From owner-freebsd-stable@FreeBSD.ORG Sun May 25 18:07:00 2014 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 94FE757E; Sun, 25 May 2014 18:07:00 +0000 (UTC) Received: from tensor.andric.com (unknown [IPv6:2001:7b8:3a7:1:2d0:b7ff:fea0:8c26]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (Client CN "tensor.andric.com", Issuer "CAcert Class 3 Root" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4C3C3240F; Sun, 25 May 2014 18:07:00 +0000 (UTC) Received: from [IPv6:2001:7b8:3a7::7059:63a3:928c:92b9] (unknown [IPv6:2001:7b8:3a7:0:7059:63a3:928c:92b9]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by tensor.andric.com (Postfix) with ESMTPSA id EAC3C5C43; Sun, 25 May 2014 20:06:45 +0200 (CEST) Content-Type: multipart/signed; boundary="Apple-Mail=_BA330A0E-BAD8-4F4B-A868-F6AA7CD1287E"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.2\)) Subject: Re: [CFT] ASLR, PIE, and segvguard on 11-current and 10-stable From: Dimitry Andric In-Reply-To: Date: Sun, 25 May 2014 20:06:40 +0200 Message-Id: <49702223-7624-4D44-9371-2F8C5E2D4D38@FreeBSD.org> References: <20140514135852.GC3063@pwnie.vrt.sourcefire.com> <86a9a56ac6.fsf@nine.des.no> To: Oliver Pinter X-Mailer: Apple Mail (2.1878.2) Cc: freebsd-security@freebsd.org, =?iso-8859-1?Q?Dag-Erling_Sm=F8rgrav?= , freebsd-current@freebsd.org, freebsd-stable@freebsd.org, Shawn Webb X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 25 May 2014 18:07:00 -0000 --Apple-Mail=_BA330A0E-BAD8-4F4B-A868-F6AA7CD1287E Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=iso-8859-1 On 25 May 2014, at 19:42, Oliver Pinter wrote: > On 5/25/14, Dag-Erling Sm=F8rgrav wrote: >> Oliver Pinter writes: ... >>> PAX: blacklist clang and related binaries from PIE support >>=20 >> Why? Performance, or do they actually break? >=20 > No. If you definded WITH_CLANG_EXTRAS=3D in src.conf, the breaked the = build. > (added dim@ to CC) >=20 > --- usr.bin.all__D --- > = /usr/obj/usr/data/source/git/opBSD/hardenedBSD.git/usr.bin/clang/bugpoint/= ../../../lib/clang/libllvmirreader/libllvmirreader.a: > could not read symbols: Bad value > c++: error: linker command failed with exit code 1 (use -v to see = invocation) > *** [bugpoint] Error code 1 I assume you only get this with your ASLR patches applied? Maybe this = is because the clang binary itself gets built statically (and so will = definitely not be PIE), but the rest of the 'extras', such as bugpoint, = are regular dynamic executables. And note that none of the libraries = built under lib/libclang are built with -fPIC, at the moment. So that = might cause trouble with your PIE patches. In any case, the interesting thing is what the actual linker error was. = Do you have more of the preceding build log, including the rest of the = settings that were used to build world? And also, what does "file = /usr/obj/usr/data/source/git/opBSD/hardenedBSD.git/usr.bin/clang/bugpoint/= ../../../lib/clang/libllvmirreader/libllvmirreader.a" say? -Dimitry --Apple-Mail=_BA330A0E-BAD8-4F4B-A868-F6AA7CD1287E Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) iEYEARECAAYFAlOCMTMACgkQsF6jCi4glqNQmQCgxsg9UC9JkSn8kNHnariVhESs xa4An2oaJXR9EThhr5gpLZ9LjH907/rQ =kgCZ -----END PGP SIGNATURE----- --Apple-Mail=_BA330A0E-BAD8-4F4B-A868-F6AA7CD1287E--