[gentoo-hardened] http://www.cs.ucsb.edu/~wkr/projects/heap_protection/software.html

[Alexander Gabert]

hi

the glibc patch and the .rpm packages you have on your site are totally
useless.

the patch you are applying does not create a necessary define to get the
source built in glibc.  both 1.1 and 1.2 patches are the same file.

this same bug applies to the binary rpm packages where you also have a
non heap protecting glibc in binary format packaged for shipping to end
users and customers that rely on you using redhat 9 machinas.

added to our test ebuild for getting the functionality into a glibc:
/usr/portage/sys-libs/glibc/glibc-2.3.2-r3.ebuild

 epatch /tmp/heapprotect-2.3.2-1.2.diff

    add_heap_protection "${S}/buildhere/config.h"
    add_heap_protection "${S}/malloc/malloc.c"
    add_heap_protection "${S}/malloc/hooks.c"

    einfo "Building GLIBC..."
    cd ${S}/buildhere
    make PARALLELMFLAGS="${MAKEOPTS}" || die
#   einfo "Doing GLIBC checks..."
#   make check
}

add_heap_protection() {
    einfo "adding heap protection build define to ${1}"
    echo "#define __HEAP_PROTECTION 1" > "${1}.new"
    cat "${1}" >> "${1}".new; rm "${1}"; mv "${1}.new" "${1}"
}

i know that my hack is lame and unneeded in all three files but i was
lazy and disturbed.

the working glibc must have the symbols:
17:14:37 [/usr/local/chroots/chroot001:24535.pty-s2.epoch] epoch
/usr/portage/sys-libs/glibc # readelf -s /lib/libc-2.3.2.so | grep
heap_mag
  1308: 0012aca0     4 OBJECT  LOCAL  DEFAULT   19 __heap_magic
  1309: 00130000 16384 OBJECT  LOCAL  DEFAULT   27 __heap_magic_pad

if this is not set, you lose the game and have no heap protection.

hope you get this working soon and make a notice on your website please
to give users a chance to remedy this situation.
this has lost me three days finding out why our heap demos are still not
caught.

and another technical issue from pageexec@××××××××.hu:
<pipacs> oh, one error i see: the size of __heap_magic_pad, it's 16k,
it should be 4k (PAGE_SIZE) only, but they declared it wrong: 
int __heap_magic_pad[PAGESIZE], sizeof(int) is 4 not  1
 so they should change it to char [].

thats all for now, i hope to include future known good patches of you
guys in gentoo hardened because we already support SSP and PaX kernels
for protection.

thanks in advance,

Alex


--
gentoo-hardened@g.o mailing list