Re: [gentoo-hardened] ssp random bytes solution

[Ned Ludd]

On Tue, 2004-04-20 at 00:46, Robert Connolly wrote:
> On April 20, 2004 12:02 am, Ned Ludd wrote:
> > On Mon, 2004-04-19 at 22:29, Robert Connolly wrote:
> > > On April 19, 2004 09:16 pm, Ned Ludd wrote:
> > > > On Mon, 2004-04-19 at 17:55, Robert Connolly wrote:
> > > >>...
> > > >
> > > > Could you test the following attachment (guard-test) a few times and
> > > > post the results?  Mainly I'd like to verify that your __guard is
> > > > infact working as expected. (It should SEGFAULT or SIGABRT)
> > >
> > > ./guard-test
> > > main    =       0x800009d4;
> > > __guard =       0x4012aba0;
> > > __stack_smash_handler   =       0x4002de50;
> > > __guard =       0x4012aba0;
> > > __stack_smash_handler   =       0x4002de50;
> > > guard-test: stack smashing attack in function mainAborted
> >
> > And how about a second run... __guard is at a different location?
>
> No. The addresses do not change. btw, the addresses do not change using Etoh/
> obsd's ssp either (using arandom). I don't have a system with ssp urandom to
> compare to right now.


If the address does not change then it does not work.

Example of a working  __guard_setup()

solar@simple ssp $ ./guard-test | grep guard
__guard = 0x2c773340;
solar@simple ssp $ ./guard-test | grep guard
__guard = 0x244be340;

>
> > What would be the point of even looking for /dev/{e,f} if the sysctl()
> > failed?  Either we are using frandom or not. Right?
>
> If its a module /dev/erandom will still work if sysctl doesn't.

Ok then the code would/should look something like this.
if ((i = open("/dev/erandom", 0)) == (-1))
      i = open("/dev/urandom", 0);

>
> > I would think the logic would work something like this untested
> > attachment.
>
> Yes.
>
>
>
> --
> gentoo-hardened@g.o mailing list
-- 
Ned Ludd <solar@g.o>
Gentoo Linux Developer