Re: [gentoo-hardened] ssp random bytes solution

[Robert Connolly]

On April 20, 2004 12:02 am, Ned Ludd wrote:
> On Mon, 2004-04-19 at 22:29, Robert Connolly wrote:
> > On April 19, 2004 09:16 pm, Ned Ludd wrote:
> > > On Mon, 2004-04-19 at 17:55, Robert Connolly wrote:
> > >>...
> > >
> > > Could you test the following attachment (guard-test) a few times and
> > > post the results?  Mainly I'd like to verify that your __guard is
> > > infact working as expected. (It should SEGFAULT or SIGABRT)
> >
> > ./guard-test
> > main    =       0x800009d4;
> > __guard =       0x4012aba0;
> > __stack_smash_handler   =       0x4002de50;
> > __guard =       0x4012aba0;
> > __stack_smash_handler   =       0x4002de50;
> > guard-test: stack smashing attack in function mainAborted
>
> And how about a second run... __guard is at a different location?

No. The addresses do not change. btw, the addresses do not change using Etoh/
obsd's ssp either (using arandom). I don't have a system with ssp urandom to 
compare to right now.

> What would be the point of even looking for /dev/{e,f} if the sysctl()
> failed?  Either we are using frandom or not. Right?

If its a module /dev/erandom will still work if sysctl doesn't.

> I would think the logic would work something like this untested
> attachment.

Yes.



--
gentoo-hardened@g.o mailing list