Re: [gentoo-hardened] ssp random bytes solution

[Ned Ludd]

On Tue, 2004-04-20 at 00:58, Ned Ludd wrote:
> On Tue, 2004-04-20 at 00:46, Robert Connolly wrote:
> > On April 20, 2004 12:02 am, Ned Ludd wrote:
> > > On Mon, 2004-04-19 at 22:29, Robert Connolly wrote:
> > > > On April 19, 2004 09:16 pm, Ned Ludd wrote:
> > > > > On Mon, 2004-04-19 at 17:55, Robert Connolly wrote:
> > > > >>...
> > > > >
> > > > > Could you test the following attachment (guard-test) a few times and
> > > > > post the results?  Mainly I'd like to verify that your __guard is
> > > > > infact working as expected. (It should SEGFAULT or SIGABRT)
> > > >
> > > > ./guard-test
> > > > main    =       0x800009d4;
> > > > __guard =       0x4012aba0;
> > > > __stack_smash_handler   =       0x4002de50;
> > > > __guard =       0x4012aba0;
> > > > __stack_smash_handler   =       0x4002de50;
> > > > guard-test: stack smashing attack in function mainAborted
> > >
> > > And how about a second run... __guard is at a different location?
> >
> > No. The addresses do not change. btw, the addresses do not change using Etoh/
> > obsd's ssp either (using arandom). I don't have a system with ssp urandom to
> > compare to right now.
>
>
> If the address does not change then it does not work.

Robert,

I must apologize the previous example code was printing the address
of __guard and not value of the __guard itself.

Can we try something like?
-------------------------
extern unsigned long __guard[];

int main () {
        printf("__guard\t=\t0x%08x;\n", __guard[0]);
	return 0;
}
-----------------------

I've also been giving some more thought into using the gettimeofday() as
we had discussed one day.. It could work across the board and would and
no kernel patching would be required which is probably more ideal for 
Gentoo users as we have a butt ton of kernels. Disadvantage of course
would be potential timing attacks by local users.

Anybody know if there is a way to get jiffies from user-land?

-- 
Ned Ludd <solar@g.o>
Gentoo Linux Developer